Reference C: Feature permission requirements

This reference lists the three feature groups that Cortex Cloud evaluates against a Customer Owned GitHub App permissions, and the permission each feature group requires. When a Customer Owned GitHub App is missing a listed permission, or holds a permission at a level lower than required, Cortex Cloud raises a warning for that feature group on the integration status — refer to Refer to Update Customer Owned GitHub App permissions or resolve integration errors. A write permission satisfies a requirement for read or write; a read permission satisfies only a read requirement.

Feature group	Required permissions	Impact when missing or insufficient
Periodic Scans	contents: read, metadata: read	Repository code cannot be read and periodic scans fail
PR Scans	contents: read, pull_requests: read	Pull request code changes cannot be read and pull request scans fail
Automatic Fix PRs	contents: write, pull_requests: write	Automatic fix pull requests cannot be created. This is the same permission gate applied to the Open Fix Pull Request action

NOTE: The feature permission requirements apply only to Customer Owned GitHub App integrations. The shared Cortex GitHub App holds the required permissions and is not evaluated against these feature groups.