> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow.md). # Tenant (UI) workflow Manage Unified Application Security Policies through the tenant. **Navigate to policies** * Navigate to **Posture Management** → **Rules & Policies** → **Policy** → **Application Security** The policy table displays all policies (out-of-the-box (OOTB) and custom). **Understanding the AppSec Policies inventory** The policies inventory provides a comprehensive view of all policy attributes, both visible and underlying, allowing you understand how each policy is defined, evaluated, and enforced across the system. **Visible attributes (default)** The following attributes display by default when the policy table loads. | Attribute | Description | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | The policy name. OOTB policies display a system-defined name; custom policies display the user-defined name | | Status | The policy status: **Enabled** (actively evaluating findings) or **Disabled** (not evaluating findings) | | Triggers | The enabled triggers for the policy (PR scan, CI scan, Periodic scan). Triggers display in shift-left order: PR scan (leftmost enforcement) before CI scan before Periodic scan | | Actions | The configured actions for each enabled trigger (Create Issue, Block PR, Report PR Comment, Block CI, Report CI) | | Conditions | The finding types and condition filters configured for the policy | | Scope | The asset scope: specific asset groups, asset type matching criteria, or all assets | | Issues Count | Total issues created by the policy. Displays both the cumulative total and the count from the last seven days | | Blocked PRs | Total pull requests blocked by the policy. Displays both the cumulative total and the count from the last seven days | | Blocked CI | Total CI pipelines blocked by the policy. Displays both the cumulative total and the count from the last seven days | | Last Triggered | The timestamp of the most recent policy evaluation that produced a match | | Created By | The user who created the policy. OOTB policies display **System** | | Modified By | The user who last modified the policy | **Hidden attributes (available via column picker)** The following attributes are not displayed by default. Select the attribute settings icon to enable these columns. | Attribute | Description | Use when | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | | Description | The user-defined description of the policy (maximum 500 characters) | Reviewing policy intent or purpose across a large policy inventory | | Policy Type | The policy type: Code Scanners, CI/CD Configuration Scanners, or Drift Detection Scanner | Filtering or sorting policies by enforcement category | | Finding Types | The specific finding types the policy evaluates (Vulnerabilities, Secrets, IaC Misconfigurations, Code Weaknesses, License Miscompliance, Operational Risk, CI/CD Risks, Drift, Malware) | Identifying which finding categories each policy covers to detect coverage gaps | | Grace Period | The configured grace period duration (1–365 days) before enforcement actions activate. Displays "None" when no grace period is configured | Auditing grace period alignment with organizational SLA targets by Urgency tier | | Created Date | The timestamp when the policy was created | Auditing policy creation history or identifying recently added policies | | Modified Date | The timestamp of the most recent policy modification | Tracking policy change frequency or identifying stale policies that have not been updated | | Policy ID | The unique system-generated identifier for the policy. Required for API operations | Referencing policies in API calls (GET /public\_api/appsec/v1/policies/{policyId}) or automation scripts | | Custom/OOTB | Indicates whether the policy is a custom (user-created) policy or an out-of-the-box (system-defined) policy | Distinguishing between system-provided baseline policies and organization-specific custom policies | {% hint style="info" %} ### Note SBAC restricts table visibility. The policy table displays only policies scoped to assets within the user's assigned application boundary. Policies scoped to assets outside the user's SBAC scope are not visible {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.