Reference H: Permissions

Permission	Scope
app_sec_scans_ci_cd_view	View CI scan results.
app_sec_scans_ci_cd_edit	Action-level permission on the CI Scans page.
app_sec_scans_pr_view	View pull request scan results.
app_sec_scans_pr_edit	Action-level permission on the Pull Request Scans page.
app_sec_scans_periodic_view	View branch periodic scan results.
app_sec_scans_periodic_edit	Trigger a rescan on a branch periodic scan.

Access to Scans requires at least one view permission. A user with only app_sec_scans_ci_cd_view can access CI Scans. They cannot view pull request or periodic scan results.

Pipeline embedding is governed outside these permissions. Modifying a pipeline requires CI/CD-system permission. The scan requires a Cortex Cloud API key with write permission. Without write permission, the scan creates no inventory row.

CI scans have no rescan action. Therefore, app_sec_scans_ci_cd_edit does not grant rescan access. app_sec_scans_periodic_edit grants that action for branch periodic scans.