Scope user access to applications (Application SBAC)

Scope user access to applications to ensure users only have permission, visibility, and actions within the applications explicitly assigned to them. This enforces clear security boundaries and provides consistent, application-level control across all application-related assets and issues, minimizing a user’s broad or unnecessary access by enforcing per-user application-level control and ensuring users can only access what’s relevant to them.

Application SBAC defines security boundaries and policies around the application entity itself. It provides granular, application-aware control, transitioning from infrastructure-wide permissions to application-specific enforcement.

Key features

• Granular access control (Implicit deny model): Enforces explicit user access to specific applications and their associated assets—such as repositories, packages, and vulnerabilities. Access to any application or asset not explicitly listed is automatically denied
• Contextual data filtering: Use the Business Application Names as a universal filter to scope data views (such as dashboards) to a selected application

Application-based scope across the platform

• ASPM Command Center: Limits the interactive security workflow graph in the ASPM Command Center to only the applications the user is authorized for
• Dashboards: Application scope automatically narrows platform-wide data into application-specific insights
• Coverage: Evaluate the security maturity of your application by identifying connected data sources and their coverage status of the application's assets, assessing the scanner coverage status of onboarded assets, and understanding which scanners (such as SCA, Secrets, IaC) that are actively analyzing the application's codebase and build

Setup application SBAC

1. Platform enablement: Enable SBAC at the tenant level.
2. Create or edit an Asset Group to include application assets.
3. Scope user access to an an application.

   1. Assign application-based SBAC to a User Group.
   2. Add users to the User Group.
4. Resulting visibility: Users see only the applications and related assets they are authorized to manage, based on the applied application scope.

Access Management permissions

Configure user scopes in Cortex Cloud by navigating to Settings → Configurations → Access Management. You must possess the necessary View/Edit RBAC permissions for Access Management. These permissions are granted by default to the Account Admin and Instance Administrator roles.

Enable SBAC in the Cortex Cloud tenant

Before configuring Application scope, SBAC must be enabled at the tenant level.

Prerequisites

RBAC permissions: To configure user scopes you must have Administrator or View/Edit RBAC permissions for Access Management (under Configurations).

• Navigate to Settings → Configurations → General → Server Settings → Enable Scope Based Access Control.

Note

Exclusions (roles not governed by SBAC): Certain roles cannot have SBAC applied. For these roles, access and permissions are managed through Role-Based Access Control (RBAC). You must manually ensure that these roles have all necessary base permissions (for example Edit/View permissions to assets), because SBAC is bypassed and does not impose its usual restrictions. As a result, functional access for these roles is determined solely by their RBAC configuration.

Create an application-based Asset Group

Create an application-based Asset Group if no appropriate group exists or if the application’s permissions must be isolated from existing groups.

1. Navigate to Inventory → Groups → + Add Group.
2. On the Create New Assets Group page.

   1. Provide a Group Name (required) and Description (optional).
   2. Enable the Use only the fields supported by scoping in Access Management configuration.
   3. Select Filter panel → Business Application Names → choose an application.
   4. Click Create Dynamic Group.

      The Asset Group is scoped to applications.

   Note

   You cannot create SBAC based on static groups.

For more information about Asset Groups, refer to Asset groups.

Create Asset Groups through Terraform workflows

The Cortex Cloud Terraform provider supports full Asset Group lifecycle management. It lets you control inventory boundaries for policies, rules, and compliance profiles as infrastructure as code.

Use the cortexcloud_asset_group resource. Define membership_predicate to set boundaries. For example, target GitHub repositories containing frontend.

For more information, refer to Manage resources.

Scope user access to an application

Scoping user access by application ensures that permissions are applied consistently across all related assets. Users receive access through their membership in application-scoped User Groups.

Assign application-based SBAC to a User Group

Define a User Group with SBAC permissions by setting its scope to include assets in Asset Groups that have application properties configured.

1. Navigate to Settings → Configurations → User Groups (under Access Management).
2. Right-click on a group in the table → Edit Group → select the Scope tab.
3. Define the application scope:

   1. Scope assets: Select Assets → Select asset groups → select an Asset Group associated with applications.
   2. Scope cases and issues: Select Cases and Issues → All cases and issues.
4. Click Save.

Note

For more information about User Groups, refer to User group management.

Add users to the application-scoped User Group

Add users to the User Group so they inherit the application-specific permissions and access to all related child resources, such as repositories.

1. Select Settings → Configurations → Users (under Access Management).
2. Right-click the relevant user → select Edit User Permissions.
3. Select the Scope tab.
4. Scope assets: Select the chevron icon (>) in the Assets field → Select Asset groups → select the user group scoped to the application (see above).
5. Scope cases and issues: Select the chevron icon (>) in the Cases and Issues field → Select All Cases and issues.
6. Click Save.

Create application-scoped policies

The process for creating an Cortex Cloud Application Security application-scoped policy is the same as for a standard policy. The only difference is on the Scope step of the wizard, where you can restrict the policy to a specific application(s) and their associated assets. If your user access is application-scoped, you can create policies only within your assigned scope. All other steps remain unchanged.

Note

Application-scoped policies apply to both code and CI/CD configuration policies.

1. Navigate to Modules → Application Security → AppSec Polices (under Policy Management) → Add Policy.
2. Configure the General and Conditions steps of the wizard.
3. On the Scope step of the wizard.

   1. Select Asset Types as the scope.
   2. Select Add Filter → Business Application Names → enter the required application name.
   3. Click Next.
4. Complete the remaining steps in the wizard to create the policy.

   The policy is displayed in the general AppSec Policies table, which reflects your application scope, displaying only the policies associated with applications you can access. Users with broader permissions can filter by Business Application Names to find application-scoped policies.

For more information about creating Cortex Cloud Application Security policies, refer to Create Cortex Cloud Application Security policies.