> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management.md).
# Roles management
You can assign the following permissions to various components in Cortex:
| Permission | Description |
| ---------- | ---------------------------------------------- |
| None | No access to the specified component. |
| View | View, but cannot edit the specified component. |
| View/Edit | View and edit the specified component. |
**Out-of-the-box roles**
Cortex products include several out-of-the-box roles, such as:
| Role | Type | Description |
| ---------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Account Admin | Predefined | A super user role that is assigned directly to the user in Cortex Gateway or tenant and has full access to all Cortex products in your account, including all tenants added in the future. In Cortex Gateway, the Account Admin can assign roles for Cortex instances, and can also activate Cortex tenants specific to the product. This user has the same view/edit permissions in the tenant as the Instance Administrator.
Note
The user who activated the Cortex product is assigned the Account Admin role.
You can add the role to a user in Cortex Gateway or the tenant. You can only remove the Account Admin role from a user in Cortex Gateway.
Only users with the Account Admin role can add or remove another Account Admin user role.
You cannot edit this role. You can copy the role by saving it as a new role and then changing permissions.
|
| Instance Administrator | Predefined | View/edit permissions for all components and access to all pages in the Cortex tenant. The Instance Administrator can also assign the Instance Administrator role to other users on the tenant. If the application has predefined or custom roles, the Instance Administrator can assign those roles to other users.
You cannot edit this role. You can copy the role by saving it as a new role and then changing permissions.
|
| Viewer | Predefined | Read permissions for all components and pages in the Cortex tenant.
Cortex AgentiX products comes out-of-the-box with the following Viewer roles:
Viewer role created in Cortex Gateway.
This role applies to all tenants.
In the Cortex AgentiX tenant, you cannot edit this role, apart from changing advanced settings such as default dashboards.
In Cortex Gateway, you can change permissions, apart from advanced settings. You can also delete the role (if not assigned to a user).
Viewer role created in the tenant.
This role is specific to the tenant. You can edit all permissions and delete the role (if not assigned to a user) in the tenant.
|
{% hint style="info" %}
### Note
By default, users do not have roles assigned. If no direct or user group role has been assigned, users don't have permission to view or edit data in the Cortex tenant.
{% endhint %}
**Next steps**
Before you start creating or customizing roles, do the following:
* Review the Role-based permissions topic.
* Decide where you want to create roles (Cortex Gateway, the tenant, or both).
Any roles and user groups created in Cortex Gateway are available for all tenants. In the Cortex tenant, all roles created in the tenant are specific to the tenant. Advanced settings such as default dashboards/queries and shifts can only be defined at the tenant level. Only user groups created on the tenant can be mapped to SAML groups when using SAML SSO.
* Decide whether you want to assign roles to users directly or through membership in user groups (recommended) in Cortex Gateway or the Cortex tenant.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.