From Chris : 

The backend of our Dashboard is supposed to be going away.  It should just proxy out to other apis (like the kube api) and pass along user information.  So you shouldn't depend on the dashboard to do auth for you and only query what it should query.  If you guys need to control who queries what, you should design and implement that yourselves.  The example given during the meeting is that user 1 should not be able to see stats from user 2.  That should be implemented by something in your stack, wither that's a exposing your own separate API server or some other prometheus methods.

^^ Investigate how to do it and create possible follow up implementation JIRAs as necessary