diff --git a/changelog.d/20241007_130122_dmitrii.lavrukhin_analytics_bool_field_v3.md b/changelog.d/20241007_130122_dmitrii.lavrukhin_analytics_bool_field_v3.md
new file mode 100644
index 00000000000..4c044836650
--- /dev/null
+++ b/changelog.d/20241007_130122_dmitrii.lavrukhin_analytics_bool_field_v3.md
@@ -0,0 +1,4 @@
+### Added
+
+- Access to /analytics can now be granted
+  (<https://github.com/cvat-ai/cvat/pull/8509>)
diff --git a/cvat-core/src/server-response-types.ts b/cvat-core/src/server-response-types.ts
index e28a6f9ec71..af6cd760ed4 100644
--- a/cvat-core/src/server-response-types.ts
+++ b/cvat-core/src/server-response-types.ts
@@ -54,6 +54,7 @@ export interface SerializedUser {
     last_login?: string;
     date_joined?: string;
     email_verification_required: boolean;
+    has_analytics_access: boolean;
 }
 
 interface SerializedStorage {
diff --git a/cvat-core/src/user.ts b/cvat-core/src/user.ts
index 1b0eb5ecfec..6d7366151fb 100644
--- a/cvat-core/src/user.ts
+++ b/cvat-core/src/user.ts
@@ -1,5 +1,5 @@
 // Copyright (C) 2019-2022 Intel Corporation
-// Copyright (C) 2022 CVAT.ai Corporation
+// Copyright (C) 2022-2024 CVAT.ai Corporation
 //
 // SPDX-License-Identifier: MIT
 
@@ -18,6 +18,7 @@ export default class User {
     public readonly isSuperuser: boolean;
     public readonly isActive: boolean;
     public readonly isVerified: boolean;
+    public readonly hasAnalyticsAccess: boolean;
 
     constructor(initialData: SerializedUser) {
         const data = {
@@ -33,6 +34,7 @@ export default class User {
             is_superuser: null,
             is_active: null,
             email_verification_required: null,
+            has_analytics_access: null,
         };
 
         for (const property in data) {
@@ -80,6 +82,9 @@ export default class User {
                 isVerified: {
                     get: () => !data.email_verification_required,
                 },
+                hasAnalyticsAccess: {
+                    get: () => data.has_analytics_access,
+                },
             }),
         );
     }
@@ -98,6 +103,7 @@ export default class User {
             is_superuser: this.isSuperuser,
             is_active: this.isActive,
             email_verification_required: this.isVerified,
+            has_analytics_access: this.hasAnalyticsAccess,
         };
     }
 }
diff --git a/cvat-ui/src/components/header/header.tsx b/cvat-ui/src/components/header/header.tsx
index 2621edddfa2..0feeae4be57 100644
--- a/cvat-ui/src/components/header/header.tsx
+++ b/cvat-ui/src/components/header/header.tsx
@@ -513,7 +513,7 @@ function HeaderComponent(props: Props): JSX.Element {
                         Models
                     </Button>
                 ) : null}
-                {isAnalyticsPluginActive && user.isSuperuser ? (
+                {isAnalyticsPluginActive && user.hasAnalyticsAccess ? (
                     <Button
                         className={getButtonClassName('analytics', false)}
                         type='link'
diff --git a/cvat/apps/engine/migrations/0086_profile_has_analytics_access.py b/cvat/apps/engine/migrations/0086_profile_has_analytics_access.py
new file mode 100644
index 00000000000..efd66a0fe23
--- /dev/null
+++ b/cvat/apps/engine/migrations/0086_profile_has_analytics_access.py
@@ -0,0 +1,35 @@
+# Generated by Django 4.2.16 on 2024-10-22 08:41
+
+from django.conf import settings
+from django.db import migrations, models
+
+
+def set_has_analytics_access(apps, schema_editor):
+    User = apps.get_model('auth', 'User')
+    for user in User.objects.all():
+        is_admin = user.groups.filter(name=settings.IAM_ADMIN_ROLE).exists()
+        user.profile.has_analytics_access = user.is_superuser or is_admin
+        user.profile.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("engine", "0085_segment_chunks_updated_date"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="profile",
+            name="has_analytics_access",
+            field=models.BooleanField(
+                default=False,
+                help_text="Designates whether the user can access analytics.",
+                verbose_name="has access to analytics",
+            ),
+        ),
+        migrations.RunPython(
+            set_has_analytics_access,
+            reverse_code=migrations.RunPython.noop,
+        ),
+    ]
diff --git a/cvat/apps/engine/models.py b/cvat/apps/engine/models.py
index 647a0ada552..6212ce3a8bc 100644
--- a/cvat/apps/engine/models.py
+++ b/cvat/apps/engine/models.py
@@ -16,19 +16,21 @@
 
 from django.conf import settings
 from django.contrib.auth.models import User
-from django.core.files.storage import FileSystemStorage
 from django.core.exceptions import ValidationError
+from django.core.files.storage import FileSystemStorage
 from django.db import IntegrityError, models, transaction
-from django.db.models.fields import FloatField
 from django.db.models import Q, TextChoices
+from django.db.models.fields import FloatField
+from django.utils.translation import gettext_lazy as _
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import extend_schema_field
 
 from cvat.apps.engine.lazy_list import LazyList
 from cvat.apps.engine.model_utils import MaybeUndefined
-from cvat.apps.engine.utils import parse_specific_attributes, chunked_list
+from cvat.apps.engine.utils import chunked_list, parse_specific_attributes
 from cvat.apps.events.utils import cache_deleted
 
+
 class SafeCharField(models.CharField):
     def get_prep_value(self, value):
         value = super().get_prep_value(value)
@@ -1091,9 +1093,16 @@ class TrackedShapeAttributeVal(AttributeVal):
     shape = models.ForeignKey(TrackedShape, on_delete=models.DO_NOTHING,
         related_name='attributes', related_query_name='attribute')
 
+
 class Profile(models.Model):
     user = models.OneToOneField(User, on_delete=models.CASCADE)
     rating = models.FloatField(default=0.0)
+    has_analytics_access = models.BooleanField(
+        _("has access to analytics"),
+        default=False,
+        help_text=_("Designates whether the user can access analytics."),
+    )
+
 
 class Issue(TimestampedModel):
     frame = models.PositiveIntegerField()
diff --git a/cvat/apps/engine/serializers.py b/cvat/apps/engine/serializers.py
index 6b858ceb25e..5b3845f8260 100644
--- a/cvat/apps/engine/serializers.py
+++ b/cvat/apps/engine/serializers.py
@@ -223,21 +223,28 @@ class Meta:
         model = User
         fields = ('url', 'id', 'username', 'first_name', 'last_name')
 
+
 class UserSerializer(serializers.ModelSerializer):
     groups = serializers.SlugRelatedField(many=True,
         slug_field='name', queryset=Group.objects.all())
+    has_analytics_access = serializers.BooleanField(
+        source='profile.has_analytics_access',
+        required=False,
+        read_only=True,
+    )
 
     class Meta:
         model = User
         fields = ('url', 'id', 'username', 'first_name', 'last_name', 'email',
             'groups', 'is_staff', 'is_superuser', 'is_active', 'last_login',
-            'date_joined')
-        read_only_fields = ('last_login', 'date_joined')
+            'date_joined', 'has_analytics_access')
+        read_only_fields = ('last_login', 'date_joined', 'has_analytics_access')
         write_only_fields = ('password', )
         extra_kwargs = {
             'last_login': { 'allow_null': True }
         }
 
+
 class DelimitedStringListField(serializers.ListField):
     def to_representation(self, value):
         return super().to_representation(value.split('\n'))
@@ -245,6 +252,7 @@ def to_representation(self, value):
     def to_internal_value(self, data):
         return '\n'.join(super().to_internal_value(data))
 
+
 class AttributeSerializer(serializers.ModelSerializer):
     id = serializers.IntegerField(required=False)
     values = DelimitedStringListField(allow_empty=True,
@@ -255,6 +263,7 @@ class Meta:
         model = models.AttributeSpec
         fields = ('id', 'name', 'mutable', 'input_type', 'default_value', 'values')
 
+
 class SublabelSerializer(serializers.ModelSerializer):
     id = serializers.IntegerField(required=False)
     attributes = AttributeSerializer(many=True, source='attributespec_set', default=[],
@@ -273,6 +282,7 @@ class Meta:
         fields = ('id', 'name', 'color', 'attributes', 'type', 'has_parent', )
         read_only_fields = ('parent',)
 
+
 class SkeletonSerializer(serializers.ModelSerializer):
     id = serializers.IntegerField(required=False)
     svg = serializers.CharField(allow_blank=True, required=False)
@@ -281,6 +291,7 @@ class Meta:
         model = models.Skeleton
         fields = ('id', 'svg',)
 
+
 class LabelSerializer(SublabelSerializer):
     deleted = serializers.BooleanField(required=False, write_only=True,
         help_text='Delete the label. Only applicable in the PATCH methods of a project or a task.')
diff --git a/cvat/apps/engine/signals.py b/cvat/apps/engine/signals.py
index 297baec9488..3a964d90c2c 100644
--- a/cvat/apps/engine/signals.py
+++ b/cvat/apps/engine/signals.py
@@ -1,13 +1,14 @@
 # Copyright (C) 2019-2022 Intel Corporation
-# Copyright (C) 2023 CVAT.ai Corporation
+# Copyright (C) 2023-2024 CVAT.ai Corporation
 #
 # SPDX-License-Identifier: MIT
 import functools
 import shutil
 
+from django.conf import settings
 from django.contrib.auth.models import User
 from django.db import transaction
-from django.db.models.signals import post_delete, post_save
+from django.db.models.signals import m2m_changed, post_delete, post_save
 from django.dispatch import receiver
 
 from .models import CloudStorage, Data, Job, Profile, Project, StatusChoice, Task, Asset
@@ -36,13 +37,28 @@ def __save_job_handler(instance, created, **kwargs):
         db_task.status = status
         db_task.save(update_fields=["status", "updated_date"])
 
-@receiver(post_save, sender=User,
-    dispatch_uid=__name__ + ".save_user_handler")
-def __save_user_handler(instance, **kwargs):
+
+@receiver(post_save, sender=User, dispatch_uid=__name__ + ".save_user_handler")
+def __save_user_handler(instance: User, **kwargs):
+    should_access_analytics = instance.is_superuser or instance.groups.filter(name=settings.IAM_ADMIN_ROLE).exists()
     if not hasattr(instance, 'profile'):
         profile = Profile()
         profile.user = instance
+        profile.has_analytics_access = should_access_analytics
         profile.save()
+    elif should_access_analytics and not instance.profile.has_analytics_access:
+        instance.profile.has_analytics_access = True
+        instance.profile.save()
+
+
+@receiver(m2m_changed, sender=User.groups.through, dispatch_uid=__name__ + ".m2m_user_groups_change_handler")
+def __m2m_user_groups_change_handler(sender, instance: User, action: str, **kwargs):
+    if action == 'post_add':
+        is_admin = instance.groups.filter(name=settings.IAM_ADMIN_ROLE).exists()
+        if is_admin and hasattr(instance, 'profile') and not instance.profile.has_analytics_access:
+            instance.profile.has_analytics_access = True
+            instance.profile.save()
+
 
 @receiver(post_delete, sender=Project,
     dispatch_uid=__name__ + ".delete_project_handler")
diff --git a/cvat/apps/engine/tests/test_rest_api.py b/cvat/apps/engine/tests/test_rest_api.py
index 8331856a5fa..d3ef484ffee 100644
--- a/cvat/apps/engine/tests/test_rest_api.py
+++ b/cvat/apps/engine/tests/test_rest_api.py
@@ -637,6 +637,8 @@ def _check_data(self, user, data, is_full):
         extra_check("is_active", data)
         extra_check("last_login", data)
         extra_check("date_joined", data)
+        extra_check("has_analytics_access", data)
+
 
 class UserListAPITestCase(UserAPITestCase):
     def _run_api_v2_users(self, user):
@@ -671,6 +673,7 @@ def test_api_v2_users_no_auth(self):
         response = self._run_api_v2_users(None)
         self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
 
+
 class UserSelfAPITestCase(UserAPITestCase):
     def _run_api_v2_users_self(self, user):
         with ForceLogin(user, self.client):
@@ -698,6 +701,7 @@ def test_api_v2_users_self_no_auth(self):
         response = self._run_api_v2_users_self(None)
         self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
 
+
 class UserGetAPITestCase(UserAPITestCase):
     def _run_api_v2_users_id(self, user, user_id):
         with ForceLogin(user, self.client):
@@ -740,6 +744,7 @@ def test_api_v2_users_id_no_auth(self):
         response = self._run_api_v2_users_id(None, self.user.id)
         self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
 
+
 class UserPartialUpdateAPITestCase(UserAPITestCase):
     def _run_api_v2_users_id(self, user, user_id, data):
         with ForceLogin(user, self.client):
@@ -786,6 +791,7 @@ def test_api_v2_users_id_no_auth_partial(self):
         response = self._run_api_v2_users_id(None, self.user.id, data)
         self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
 
+
 class UserDeleteAPITestCase(UserAPITestCase):
     def _run_api_v2_users_id(self, user, user_id):
         with ForceLogin(user, self.client):
diff --git a/cvat/apps/iam/admin.py b/cvat/apps/iam/admin.py
index 1cfceb19d60..648e15dc2da 100644
--- a/cvat/apps/iam/admin.py
+++ b/cvat/apps/iam/admin.py
@@ -1,4 +1,5 @@
 # Copyright (C) 2021-2022 Intel Corporation
+# Copyright (C) 2024 CVAT.ai Corporation
 #
 # SPDX-License-Identifier: MIT
 
@@ -7,7 +8,19 @@
 from django.contrib.auth.admin import GroupAdmin, UserAdmin
 from django.utils.translation import gettext_lazy as _
 
+from cvat.apps.engine.models import Profile
+
+
+class ProfileInline(admin.StackedInline):
+    model = Profile
+
+    fieldsets = (
+        (None, {'fields': ('has_analytics_access', )}),
+    )
+
+
 class CustomUserAdmin(UserAdmin):
+    inlines = (ProfileInline,)
     list_display = ("username", "email", "first_name", "last_name", "is_active", "is_staff")
     fieldsets = (
         (None, {'fields': ('username', 'password')}),
diff --git a/cvat/apps/iam/permissions.py b/cvat/apps/iam/permissions.py
index 366f85192a8..55a91cc570b 100644
--- a/cvat/apps/iam/permissions.py
+++ b/cvat/apps/iam/permissions.py
@@ -15,7 +15,7 @@
 from attrs import define, field
 from django.apps import AppConfig
 from django.conf import settings
-from django.db.models import Q, Model
+from django.db.models import Model, Q
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.permissions import BasePermission
 
@@ -24,15 +24,18 @@
 
 from .utils import add_opa_rules_path
 
+
 class StrEnum(str, Enum):
     def __str__(self) -> str:
         return self.value
 
+
 @define
 class PermissionResult:
     allow: bool
     reasons: List[str] = field(factory=list)
 
+
 def get_organization(request, obj):
     # Try to get organization from an object otherwise, return the organization that is specified in query parameters
     if isinstance(obj, Organization):
@@ -56,6 +59,7 @@ def get_organization(request, obj):
 
     return request.iam_context['organization']
 
+
 def get_membership(request, organization):
     if organization is None:
         return None
@@ -66,6 +70,7 @@ def get_membership(request, organization):
         is_active=True
     ).first()
 
+
 def build_iam_context(request, organization: Optional[Organization], membership: Optional[Membership]):
     return {
         'user_id': request.user.id,
@@ -126,7 +131,7 @@ def __init__(self, **kwargs):
                 'auth': {
                     'user': {
                         'id': self.user_id,
-                        'privilege': self.group_name
+                        'privilege': self.group_name,
                     },
                     'organization': {
                         'id': self.org_id,
@@ -219,11 +224,14 @@ def get_per_field_update_scopes(cls, request, scopes_per_field):
 
         return scopes
 
+
 T = TypeVar('T', bound=Model)
 
+
 def is_public_obj(obj: T) -> bool:
     return getattr(obj, "is_public", False)
 
+
 class PolicyEnforcer(BasePermission):
     # pylint: disable=no-self-use
     def check_permission(self, request, view, obj) -> bool:
@@ -258,13 +266,15 @@ def is_metadata_request(request, view):
         return request.method == 'OPTIONS' \
             or (request.method == 'POST' and view.action == 'metadata' and len(request.data) == 0)
 
+
 class IsAuthenticatedOrReadPublicResource(BasePermission):
     def has_object_permission(self, request, view, obj) -> bool:
         return bool(
-            request.user and request.user.is_authenticated or
-            request.method == 'GET' and is_public_obj(obj)
+            (request.user and request.user.is_authenticated) or
+            (request.method == 'GET' and is_public_obj(obj))
         )
 
+
 def load_app_permissions(config: AppConfig) -> None:
     """
     Ensures that permissions and OPA rules from the given app are loaded.
diff --git a/cvat/apps/log_viewer/permissions.py b/cvat/apps/log_viewer/permissions.py
index 2d9500a29ea..c50cf9302c6 100644
--- a/cvat/apps/log_viewer/permissions.py
+++ b/cvat/apps/log_viewer/permissions.py
@@ -5,9 +5,12 @@
 
 from django.conf import settings
 
-from cvat.apps.iam.permissions import OpenPolicyAgentPermission, StrEnum
+from cvat.apps.iam.permissions import OpenPolicyAgentPermission, StrEnum, get_iam_context
+
 
 class LogViewerPermission(OpenPolicyAgentPermission):
+    has_analytics_access: bool
+
     class Scopes(StrEnum):
         VIEW = 'view'
 
@@ -21,8 +24,21 @@ def create(cls, request, view, obj, iam_context):
 
         return permissions
 
-    def __init__(self, **kwargs):
+    @classmethod
+    def create_base_perm(cls, request, view, scope, iam_context, obj=None, **kwargs):
+        if not iam_context and request:
+            iam_context = get_iam_context(request, obj)
+        return cls(
+            scope=scope,
+            obj=obj,
+            has_analytics_access=request.user.profile.has_analytics_access,
+            **iam_context,
+            **kwargs
+        )
+
+    def __init__(self, has_analytics_access=False, **kwargs):
         super().__init__(**kwargs)
+        self.payload['input']['auth']['user']['has_analytics_access'] = has_analytics_access
         self.url = settings.IAM_OPA_DATA_URL + '/analytics/allow'
 
     @staticmethod
diff --git a/cvat/apps/log_viewer/rules/analytics.rego b/cvat/apps/log_viewer/rules/analytics.rego
index 970a6a3e97d..b43a9c1b111 100644
--- a/cvat/apps/log_viewer/rules/analytics.rego
+++ b/cvat/apps/log_viewer/rules/analytics.rego
@@ -9,7 +9,8 @@ import data.utils
 #     "auth": {
 #         "user": {
 #             "id": <num>,
-#             "privilege": <"admin"|"business"|"user"|"worker"> or null
+#             "privilege": <"admin"|"business"|"user"|"worker"> or null,
+#             "has_analytics_access": <true|false>
 #         },
 #         "organization": {
 #             "id": <num>,
@@ -28,12 +29,12 @@ import data.utils
 
 default allow := false
 
-allow if {
-    utils.is_admin
-}
-
 allow if {
     input.resource.visibility == utils.PUBLIC
     input.scope == utils.VIEW
     utils.has_perm(utils.BUSINESS)
 }
+
+allow if {
+    input.auth.user.has_analytics_access
+}
diff --git a/cvat/apps/log_viewer/rules/tests/configs/analytics.csv b/cvat/apps/log_viewer/rules/tests/configs/analytics.csv
index d38b0514425..a581e0716e5 100644
--- a/cvat/apps/log_viewer/rules/tests/configs/analytics.csv
+++ b/cvat/apps/log_viewer/rules/tests/configs/analytics.csv
@@ -1,3 +1,3 @@
-Scope,Resource,Context,Ownership,Limit,Method,URL,Privilege,Membership
-view,Analytics,N/A,N/A,resource['visibility']=='public',GET,"/analytics",business,N/A
-view,Analytics,N/A,N/A,,GET,"/analytics",admin,N/A
+Scope,Resource,Context,Ownership,Limit,Method,URL,Privilege,Membership,HasAnalyticsAccess
+view,Analytics,N/A,N/A,resource['visibility']=='public',GET,"/analytics",business,N/A,N/A
+view,Analytics,N/A,N/A,,GET,"/analytics",none,N/A,true
diff --git a/cvat/apps/log_viewer/rules/tests/generators/analytics_test.gen.rego.py b/cvat/apps/log_viewer/rules/tests/generators/analytics_test.gen.rego.py
index ce4b50a7c8f..7e40f092607 100644
--- a/cvat/apps/log_viewer/rules/tests/generators/analytics_test.gen.rego.py
+++ b/cvat/apps/log_viewer/rules/tests/generators/analytics_test.gen.rego.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2022 CVAT.ai Corporation
+# Copyright (C) 2022-2024 CVAT.ai Corporation
 #
 # SPDX-License-Identifier: MIT
 
@@ -43,6 +43,7 @@ def read_rules(name):
 OWNERSHIPS = ["none"]
 GROUPS = ["admin", "business", "user", "worker", "none"]
 ORG_ROLES = ["owner", "maintainer", "supervisor", "worker", None]
+HAS_ANALYTICS_ACCESS = [True, False]
 
 
 def RESOURCES(scope):
@@ -55,10 +56,7 @@ def RESOURCES(scope):
     return [None]
 
 
-def eval_rule(scope, context, ownership, privilege, membership, data):
-    if privilege == "admin":
-        return True
-
+def eval_rule(scope, context, ownership, privilege, membership, data, has_analytics_access):
     rules = list(filter(lambda r: scope == r["scope"], simple_rules))
     rules = list(filter(lambda r: r["context"] == "na" or context == r["context"], rules))
     rules = list(filter(lambda r: r["ownership"] == "na" or ownership == r["ownership"], rules))
@@ -70,17 +68,22 @@ def eval_rule(scope, context, ownership, privilege, membership, data):
         )
     )
     rules = list(filter(lambda r: GROUPS.index(privilege) <= GROUPS.index(r["privilege"]), rules))
+    rules = list(filter(lambda r: r["hasanalyticsaccess"] in ("na", str(has_analytics_access).lower()), rules))
     resource = data["resource"]
-    rules = list(filter(lambda r: eval(r["limit"], {"resource": resource}), rules))
+    rules = list(filter(lambda r: not r["limit"] or eval(r["limit"], {"resource": resource}), rules))
 
     return bool(rules)
 
 
-def get_data(scope, context, ownership, privilege, membership, resource):
+def get_data(scope, context, ownership, privilege, membership, resource, has_analytics_access):
     data = {
         "scope": scope,
         "auth": {
-            "user": {"id": random.randrange(0, 100), "privilege": privilege},
+            "user": {
+                "id": random.randrange(0, 100),  # nosec B311 NOSONAR
+                "privilege": privilege,
+                "has_analytics_access": has_analytics_access,
+            },
             "organization": {
                 "id": random.randrange(100, 200),
                 "owner": {"id": random.randrange(200, 300)},
@@ -123,7 +126,7 @@ def _get_name(prefix, **kwargs):
     return name
 
 
-def get_name(scope, context, ownership, privilege, membership, resource):
+def get_name(scope, context, ownership, privilege, membership, resource, has_analytics_access):
     return _get_name("test", **locals())
 
 
@@ -139,16 +142,16 @@ def is_valid(scope, context, ownership, privilege, membership, resource):
 def gen_test_rego(name):
     with open(f"{name}_test.gen.rego", "wt") as f:
         f.write(f"package {name}\nimport rego.v1\n\n")
-        for scope, context, ownership, privilege, membership in product(
-            SCOPES, CONTEXTS, OWNERSHIPS, GROUPS, ORG_ROLES
+        for scope, context, ownership, privilege, membership, has_analytics_access in product(
+            SCOPES, CONTEXTS, OWNERSHIPS, GROUPS, ORG_ROLES, HAS_ANALYTICS_ACCESS
         ):
             for resource in RESOURCES(scope):
                 if not is_valid(scope, context, ownership, privilege, membership, resource):
                     continue
 
-                data = get_data(scope, context, ownership, privilege, membership, resource)
-                test_name = get_name(scope, context, ownership, privilege, membership, resource)
-                result = eval_rule(scope, context, ownership, privilege, membership, data)
+                data = get_data(scope, context, ownership, privilege, membership, resource, has_analytics_access)
+                test_name = get_name(scope, context, ownership, privilege, membership, resource, has_analytics_access)
+                result = eval_rule(scope, context, ownership, privilege, membership, data, has_analytics_access)
                 f.write(
                     "{test_name} if {{\n    {allow} with input as {data}\n}}\n\n".format(
                         test_name=test_name,
diff --git a/cvat/schema.yml b/cvat/schema.yml
index 4a33b80c24a..4bda991cbb1 100644
--- a/cvat/schema.yml
+++ b/cvat/schema.yml
@@ -11103,6 +11103,9 @@ components:
           type: string
           format: date-time
           readOnly: true
+        has_analytics_access:
+          type: boolean
+          readOnly: true
       required:
       - groups
       - username
diff --git a/tests/python/rest_api/test_analytics.py b/tests/python/rest_api/test_analytics.py
index 7ac3004e63f..f14cdd206f8 100644
--- a/tests/python/rest_api/test_analytics.py
+++ b/tests/python/rest_api/test_analytics.py
@@ -35,11 +35,18 @@ def _test_cannot_see(self, user):
         assert response.status_code == HTTPStatus.FORBIDDEN
 
     @pytest.mark.parametrize(
-        "privilege, is_allow",
-        [("admin", True), ("business", True), ("worker", False), ("user", False)],
+        "conditions, is_allow",
+        [
+            (dict(privilege="admin"), True),
+            (dict(privilege="business"), True),
+            (dict(privilege="worker", has_analytics_access=False), False),
+            (dict(privilege="worker", has_analytics_access=True), True),
+            (dict(privilege="user", has_analytics_access=False), False),
+            (dict(privilege="user", has_analytics_access=True), True),
+        ],
     )
-    def test_can_see(self, privilege, is_allow, find_users):
-        user = find_users(privilege=privilege)[0]["username"]
+    def test_can_see(self, conditions, is_allow, find_users):
+        user = find_users(**conditions)[0]["username"]
 
         if is_allow:
             self._test_can_see(user)
diff --git a/tests/python/shared/assets/cvat_db/data.json b/tests/python/shared/assets/cvat_db/data.json
index 8a836d7d695..7bb20c4507c 100644
--- a/tests/python/shared/assets/cvat_db/data.json
+++ b/tests/python/shared/assets/cvat_db/data.json
@@ -6180,54 +6180,6 @@
     "frames": "[]"
   }
 },
-{
-  "model": "engine.segment",
-  "pk": 38,
-  "fields": {
-    "task": 29,
-    "start_frame": 0,
-    "stop_frame": 7,
-    "chunks_updated_date": "2024-10-02T08:13:16.623Z",
-    "type": "range",
-    "frames": "[]"
-  }
-},
-{
-  "model": "engine.segment",
-  "pk": 39,
-  "fields": {
-    "task": 29,
-    "start_frame": 8,
-    "stop_frame": 15,
-    "chunks_updated_date": "2024-10-02T08:13:16.623Z",
-    "type": "range",
-    "frames": "[]"
-  }
-},
-{
-  "model": "engine.segment",
-  "pk": 40,
-  "fields": {
-    "task": 29,
-    "start_frame": 16,
-    "stop_frame": 22,
-    "chunks_updated_date": "2024-10-02T08:13:16.623Z",
-    "type": "range",
-    "frames": "[]"
-  }
-},
-{
-  "model": "engine.segment",
-  "pk": 41,
-  "fields": {
-    "task": 29,
-    "start_frame": 23,
-    "stop_frame": 28,
-    "chunks_updated_date": "2024-10-02T08:13:16.623Z",
-    "type": "range",
-    "frames": "[]"
-  }
-},
 {
   "model": "engine.job",
   "pk": 2,
@@ -12710,7 +12662,8 @@
     "user": [
       "admin1"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": true
   }
 },
 {
@@ -12720,7 +12673,8 @@
     "user": [
       "user1"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12730,7 +12684,8 @@
     "user": [
       "user2"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12740,7 +12695,8 @@
     "user": [
       "user3"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12750,7 +12706,8 @@
     "user": [
       "user4"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": true
   }
 },
 {
@@ -12760,7 +12717,8 @@
     "user": [
       "worker1"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12770,7 +12728,8 @@
     "user": [
       "worker2"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12780,7 +12739,8 @@
     "user": [
       "worker3"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12790,7 +12750,8 @@
     "user": [
       "worker4"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": true
   }
 },
 {
@@ -12800,7 +12761,8 @@
     "user": [
       "business1"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12810,7 +12772,8 @@
     "user": [
       "business2"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12820,7 +12783,8 @@
     "user": [
       "business3"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12830,7 +12794,8 @@
     "user": [
       "business4"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12840,7 +12805,8 @@
     "user": [
       "dummy1"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12850,7 +12816,8 @@
     "user": [
       "dummy2"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12860,7 +12827,8 @@
     "user": [
       "dummy3"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12870,7 +12838,8 @@
     "user": [
       "dummy4"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12880,7 +12849,8 @@
     "user": [
       "admin2"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": true
   }
 },
 {
@@ -12890,7 +12860,8 @@
     "user": [
       "user5"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12900,7 +12871,8 @@
     "user": [
       "user6"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
@@ -12910,7 +12882,8 @@
     "user": [
       "lonely_user"
     ],
-    "rating": 0.0
+    "rating": 0.0,
+    "has_analytics_access": false
   }
 },
 {
diff --git a/tests/python/shared/assets/users.json b/tests/python/shared/assets/users.json
index 7a3172c70a4..d3a420b297a 100644
--- a/tests/python/shared/assets/users.json
+++ b/tests/python/shared/assets/users.json
@@ -10,6 +10,7 @@
       "groups": [
         "user"
       ],
+      "has_analytics_access": false,
       "id": 21,
       "is_active": true,
       "is_staff": false,
@@ -26,6 +27,7 @@
       "groups": [
         "user"
       ],
+      "has_analytics_access": false,
       "id": 20,
       "is_active": true,
       "is_staff": false,
@@ -42,6 +44,7 @@
       "groups": [
         "user"
       ],
+      "has_analytics_access": false,
       "id": 19,
       "is_active": true,
       "is_staff": false,
@@ -58,6 +61,7 @@
       "groups": [
         "admin"
       ],
+      "has_analytics_access": true,
       "id": 18,
       "is_active": true,
       "is_staff": true,
@@ -72,6 +76,7 @@
       "email": "dummy4@cvat.org",
       "first_name": "Dummy",
       "groups": [],
+      "has_analytics_access": false,
       "id": 17,
       "is_active": true,
       "is_staff": false,
@@ -86,6 +91,7 @@
       "email": "dummy3@cvat.org",
       "first_name": "Dummy",
       "groups": [],
+      "has_analytics_access": false,
       "id": 16,
       "is_active": true,
       "is_staff": false,
@@ -100,6 +106,7 @@
       "email": "dummy2@cvat.org",
       "first_name": "Dummy",
       "groups": [],
+      "has_analytics_access": false,
       "id": 15,
       "is_active": true,
       "is_staff": false,
@@ -114,6 +121,7 @@
       "email": "dummy1@cvat.org",
       "first_name": "Dummy",
       "groups": [],
+      "has_analytics_access": false,
       "id": 14,
       "is_active": true,
       "is_staff": false,
@@ -130,6 +138,7 @@
       "groups": [
         "business"
       ],
+      "has_analytics_access": false,
       "id": 13,
       "is_active": true,
       "is_staff": false,
@@ -146,6 +155,7 @@
       "groups": [
         "business"
       ],
+      "has_analytics_access": false,
       "id": 12,
       "is_active": true,
       "is_staff": false,
@@ -162,6 +172,7 @@
       "groups": [
         "business"
       ],
+      "has_analytics_access": false,
       "id": 11,
       "is_active": true,
       "is_staff": false,
@@ -178,6 +189,7 @@
       "groups": [
         "business"
       ],
+      "has_analytics_access": false,
       "id": 10,
       "is_active": true,
       "is_staff": false,
@@ -194,6 +206,7 @@
       "groups": [
         "worker"
       ],
+      "has_analytics_access": true,
       "id": 9,
       "is_active": true,
       "is_staff": false,
@@ -210,6 +223,7 @@
       "groups": [
         "worker"
       ],
+      "has_analytics_access": false,
       "id": 8,
       "is_active": true,
       "is_staff": false,
@@ -226,6 +240,7 @@
       "groups": [
         "worker"
       ],
+      "has_analytics_access": false,
       "id": 7,
       "is_active": true,
       "is_staff": false,
@@ -242,6 +257,7 @@
       "groups": [
         "worker"
       ],
+      "has_analytics_access": false,
       "id": 6,
       "is_active": true,
       "is_staff": false,
@@ -258,6 +274,7 @@
       "groups": [
         "user"
       ],
+      "has_analytics_access": true,
       "id": 5,
       "is_active": true,
       "is_staff": false,
@@ -274,6 +291,7 @@
       "groups": [
         "user"
       ],
+      "has_analytics_access": false,
       "id": 4,
       "is_active": true,
       "is_staff": false,
@@ -290,6 +308,7 @@
       "groups": [
         "user"
       ],
+      "has_analytics_access": false,
       "id": 3,
       "is_active": true,
       "is_staff": false,
@@ -306,6 +325,7 @@
       "groups": [
         "user"
       ],
+      "has_analytics_access": false,
       "id": 2,
       "is_active": true,
       "is_staff": false,
@@ -322,6 +342,7 @@
       "groups": [
         "admin"
       ],
+      "has_analytics_access": true,
       "id": 1,
       "is_active": true,
       "is_staff": true,
diff --git a/tests/python/shared/fixtures/data.py b/tests/python/shared/fixtures/data.py
index 64ac7d09cbb..13f128d2edf 100644
--- a/tests/python/shared/fixtures/data.py
+++ b/tests/python/shared/fixtures/data.py
@@ -367,14 +367,28 @@ def find(**kwargs):
 @pytest.fixture(scope="session")
 def test_db(users, users_by_name, memberships):
     data = []
-    fields = ["username", "id", "privilege", "role", "org", "membership_id", "is_superuser"]
+    fields = [
+        "username",
+        "id",
+        "privilege",
+        "role",
+        "org",
+        "membership_id",
+        "is_superuser",
+        "has_analytics_access",
+    ]
 
     def add_row(**kwargs):
         data.append({field: kwargs.get(field) for field in fields})
 
     for user in users:
         for group in user["groups"]:
-            add_row(username=user["username"], id=user["id"], privilege=group)
+            add_row(
+                username=user["username"],
+                id=user["id"],
+                privilege=group,
+                has_analytics_access=user["has_analytics_access"],
+            )
 
     for membership in memberships:
         username = membership["user"]["username"]
@@ -386,6 +400,7 @@ def add_row(**kwargs):
                 id=membership["user"]["id"],
                 org=membership["organization"],
                 membership_id=membership["id"],
+                has_analytics_access=users_by_name[username]["has_analytics_access"],
             )
 
     return data