Reference I: Permissions

Permission	Scope
app_sec_scans_pr_view	View pull request scan results
app_sec_scans_pr_edit	Action-level permission on the Pull Request Scans page
app_sec_scans_periodic_view	View branch periodic scan results
app_sec_scans_periodic_edit	Trigger a rescan on a branch periodic scan
app_sec_scans_ci_cd_view	View CI scan results
Data Sources (View/Edit)	Open and save the repository Scan Configuration, where Scan PR and Fail PR on scan error are set

Access to Scans requires at least one scan view permission. A user holding only app_sec_scans_pr_view can access Pull Request Scans, but cannot view periodic or CI scan results.

Viewing scan results and enabling pull request scanning require different permissions. Scan permissions govern the inventory only. A practitioner closing a coverage gap also needs Data Sources (View/Edit).

Note: Pull request scans have no rescan action. Therefore, app_sec_scans_pr_edit does not gate a rescan as app_sec_scans_periodic_edit does for branch periodic scans.