Reference B: RBAC permission levels by capability

Capability	Documented action	Required access
Findings	View malicious package findings	View (read)
Issues — review	View malicious package issues; prioritize by Urgency	View (read)
Issues — backlog status	Change an issue Backlog Status	View/Edit (read/write)
Assets	Filter assets by Is Malicious or the Malicious Code tab	View (read)
Dashboards	View dashboard widgets	View (read)
Scan management	Review malicious packages per scan	View (read)
Policies	Create, configure, or enable and disable malicious package policies	View/Edit (read/write)
Public API	Check or query packages for malicious status	View (read)

Grant view/edit on Policies and on Issue backlog status only to users who govern or triage malicious packages. Review-only users need view access on Findings, Issues, Assets, Dashboards, and Scan management.