> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/manage-roles-in-the-cortex-agentix-tenant.md).

# Manage roles in the Cortex AgentiX tenant

On the **Roles** page, you can view all roles in Cortex AgentiX, whether they are custom roles, who created the role, when it was created, and additional information about the roles. When right-clicking on a role, you can edit the role and permissions.

Cortex AgentiX includes the following role types:

* **Predefined roles:** Includes Account Admin and Instance Administrator roles. Permissions cannot be changed. You can create a duplicate of these roles, but you cannot remove them.
* **Custom roles:** Includes out-of-the-box roles and custom roles.

When right-clicking a role, you can perform several actions, such as editing a role, saving it as a new role, and removing a role (deleting a role not assigned to a user).

If you want to edit a role, right-click the relevant user role and select **Edit Role**. If you want to create a new role based on an existing role, right-click the relevant user role and select **Save As New Role**.

<details>

<summary>Create a role</summary>

The roles you create provide more granular access control. You can add as many new roles as you need and combine them with user groups. When you create or edit a role, you can perform activities such as adding permissions and permission levels.

To create, edit, or delete a role, you must have administrator permissions.

{% hint style="info" %}

### Tip

For analysts, we recommend limiting specific permissions, such as:

* Removing the ability to install, delete, Marketplace/Data Sources, which should be reserved for engineers and administrators. We recommend setting these permissions for analysts to **None** or **View**.
* Removing access to API keys. Under **CONFIGURATIONS** , set the **Public API** access to **None** or **View**. If you select **None**, the user role can still use the API, but they cannot view API keys in the UI.
  {% endhint %}

1. In the Cortex AgentiX tenant, select Settings → Configurations → Access Management → Roles → **New Role**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Tip</h3><p>We recommend making a copy of out-of-the-box roles and editing the copies, rather than creating new roles, to avoid missing any important permissions.</p></div>
2. Add the **Role name** and a meaningful **Description**.
3. In the **Components** tab, add the permissions as required. For more information, see [Role permissions by component](/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component.md).
4. Under **Datasets (Disabled)**, you have two options for setting the Cortex Query Language (XQL) dataset access permissions for the user role:
   * Set the user role with access to all XQL datasets by leaving the dataset access management as disabled (default).
   * Set the user role with limited access to certain XQL datasets by selecting the Enable dataset access management toggle and selecting the datasets under the different dataset category headings.
5. Save the role.
6. You can create user groups and add roles to them (recommended), assign roles directly to users after they have been added, or both.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/manage-roles-in-the-cortex-agentix-tenant.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.