diff --git a/confluent_server/confluent/auth.py b/confluent_server/confluent/auth.py
index 136e36fe..e01e8826 100644
--- a/confluent_server/confluent/auth.py
+++ b/confluent_server/confluent/auth.py
@@ -68,6 +68,15 @@ _allowedbyrole = {
             '/node*/*/events/hardware/log',
         ],
     },
+    'Monitor': {
+        'retrieve': [
+            '/node*/health/hardware',
+            '/node*/power/state',
+            '/node*/sensors/*',
+            '/nodes/',
+            '/',
+        ],
+    }
 }
 
 _deniedbyrole = {
diff --git a/confluent_server/confluent/config/configmanager.py b/confluent_server/confluent/config/configmanager.py
index 8c2f588e..0d1f8284 100644
--- a/confluent_server/confluent/config/configmanager.py
+++ b/confluent_server/confluent/config/configmanager.py
@@ -99,7 +99,7 @@ _attraliases = {
     'bmcpass': 'secret.hardwaremanagementpassword',
     'switchpass': 'secret.hardwaremanagementpassword',
 }
-_validroles = ('Administrator', 'Operator')
+_validroles = ('Administrator', 'Operator', 'Monitor')
 
 def _mkpath(pathname):
     try: