Securing Prometheus and Grafana with OAuth and RBAC

Act as an IT Security Auditor and DevSecOps Lead. Define an impenetrable security posture for a highly sensitive Grafana instance. You must enforce strict integration with a corporate [AUTH_PROVIDER] (e.g., Okta, Entra ID, GitHub) via OAuth2 and implement aggressive, team-level Role-Based Access Control (RBAC). Provide the exact `grafana.ini` configuration blocks required to bind the OAuth2 client ID/secrets and explicitly describe the JSON mapping logic used to automatically assign active directory [USER_ROLES] (Admin, Editor, Viewer) directly to specific Grafana Organizations and Folders. Furthermore, architect a ruthless Kubernetes [NETWORK_POLICY] YAML manifest designed to physically block all lateral network traffic, restricting Prometheus scrape access exclusively to authorized, whitelisted service ports.