diff --git a/workbench/src/components/insight/layout/TimeRangePicker.tsx b/workbench/src/components/insight/layout/TimeRangePicker.tsx
index 4508d53..76b3ee7 100644
--- a/workbench/src/components/insight/layout/TimeRangePicker.tsx
+++ b/workbench/src/components/insight/layout/TimeRangePicker.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { InsightState } from '../../insight/store/urlState'
-import { formatDuration } from '@lib/format'
+import { formatDuration } from '../../../lib/format'
 
 interface TimeRangePickerProps {
   state: InsightState
diff --git a/workbench/src/components/insight/snippets/SnippetLibrary.tsx b/workbench/src/components/insight/snippets/SnippetLibrary.tsx
index e1e4b1e..7cceee5 100644
--- a/workbench/src/components/insight/snippets/SnippetLibrary.tsx
+++ b/workbench/src/components/insight/snippets/SnippetLibrary.tsx
@@ -2,7 +2,7 @@
 
 import { useMemo, useState } from 'react'
 import { InsightState } from '../../insight/store/urlState'
-import { canAccessSnippet } from '@lib/rbac'
+import { canAccessSnippet } from '../../../lib/rbac'
 
 interface Snippet {
   name: string
diff --git a/workbench/src/components/insight/viz/LogsTable.tsx b/workbench/src/components/insight/viz/LogsTable.tsx
index e3bdc5d..c7ed425 100644
--- a/workbench/src/components/insight/viz/LogsTable.tsx
+++ b/workbench/src/components/insight/viz/LogsTable.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { LogEntry } from '../../insight/services/adapters/logs'
-import { getLogLevelColor } from '@lib/format'
+import { getLogLevelColor } from '../../../lib/format'
 
 interface LogsTableProps {
   logs: LogEntry[]
diff --git a/workbench/src/components/insight/viz/LogsViewer.tsx b/workbench/src/components/insight/viz/LogsViewer.tsx
index e2fbcf7..59e2520 100644
--- a/workbench/src/components/insight/viz/LogsViewer.tsx
+++ b/workbench/src/components/insight/viz/LogsViewer.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { LogEntry } from '../../insight/services/adapters/logs'
-import { getLogLevelColor } from '@lib/format'
+import { getLogLevelColor } from '../../../lib/format'
 
 interface LogsViewerProps {
   logs: LogEntry[]
diff --git a/workbench/src/components/insight/viz/MetricsChart.tsx b/workbench/src/components/insight/viz/MetricsChart.tsx
index a9dd7e8..68d68e6 100644
--- a/workbench/src/components/insight/viz/MetricsChart.tsx
+++ b/workbench/src/components/insight/viz/MetricsChart.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { PrometheusResponse } from '../../insight/services/adapters/prometheus'
-import { formatNumber } from '@lib/format'
+import { formatNumber } from '../../../lib/format'
 
 interface MetricsChartProps {
   series: PrometheusResponse[]
diff --git a/workbench/src/components/insight/viz/MetricsTable.tsx b/workbench/src/components/insight/viz/MetricsTable.tsx
index 925ab8c..e4a1239 100644
--- a/workbench/src/components/insight/viz/MetricsTable.tsx
+++ b/workbench/src/components/insight/viz/MetricsTable.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { PrometheusResponse } from '../../insight/services/adapters/prometheus'
-import { formatNumber } from '@lib/format'
+import { formatNumber } from '../../../lib/format'
 
 interface MetricsTableProps {
   series: PrometheusResponse[]
diff --git a/workbench/src/components/insight/viz/MetricsTopStats.tsx b/workbench/src/components/insight/viz/MetricsTopStats.tsx
index d2264ac..c5c1763 100644
--- a/workbench/src/components/insight/viz/MetricsTopStats.tsx
+++ b/workbench/src/components/insight/viz/MetricsTopStats.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import { PrometheusResponse } from '../../insight/services/adapters/prometheus'
-import { formatNumber } from '@lib/format'
+import { formatNumber } from '../../../lib/format'
 
 interface MetricsTopStatsProps {
   series: PrometheusResponse[]
diff --git a/workbench/src/lib/rbac.ts b/workbench/src/lib/rbac.ts
new file mode 100644
index 0000000..0d5991e
--- /dev/null
+++ b/workbench/src/lib/rbac.ts
@@ -0,0 +1,14 @@
+export interface SnippetRBAC {
+    roles?: string[]
+    environments?: string[]
+}
+
+export function canAccessSnippet(rbac: SnippetRBAC | undefined, context: {
+    role: string
+    env: string
+}) {
+    if (!rbac) return true
+    if (rbac.roles && !rbac.roles.includes(context.role)) return false
+    if (rbac.environments && !rbac.environments.includes(context.env)) return false
+    return true
+}