> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/manage-automation-exclusion-policies.md).

# Manage automation exclusion policies

Automation exclusion policies prevent commands and scripts from performing automated remediation actions on critical assets, such as users, IP addresses, and domains. For example, a playbook task might block multiple domains, but mission-critical domains in the policy list would not be blocked.

Admin users and all roles with read/write permissions to the Automation Exclusion Center can edit, disable, and enable policies.

1. Go to **Settings** → **Configurations** → **Automation** → **Automation Exclusion Center**.
2. Right-click on a policy and choose **Edit**.
3. From the **Edit Policy** page, you can do the following:
   * Enable or disable the policy. Policies are enabled by default.
   * Enable or disable policy overrides. If you enable policy overrides, users can manually run the commands and scripts on the excluded critical assets, using the `override-policy` parameter. Use of the `override-policy` parameter is included in the Management Audit Logs.
   * Select one or more lists of excluded assets.

     Clicking the list icon opens a new browser tab for the **Lists** page, where you can create and edit lists.

     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>For the <strong>IAM User Hard Remediation</strong> and <strong>User Soft Remediation</strong> policies, we recommend including username, email, and ID for each user you want to exclude. Example: <code>username1, user@example.com, userID112</code>.</p></div>

     Each list can be filtered by conditions, such as `Equals`, `Ends with`, and `Doesn't include`. For example, you can exclude all email addresses with your company's domain using the `Ends with` filter.
   * For **IAM User Hard Remediation** and **User Soft Remediation** policies, you can also select asset groups. These policies can include only lists, only asset groups, or a combination of asset groups and lists.
   * Under **THEN skip execution of the following commands and scripts**, click to view the scripts and commands affected by the policy. Commands only appear if they are part of an active integration instance. You cannot edit the list of scripts and commands.
4. **Save** your changes.

{% hint style="info" %}
You can also right click on a policy from the main **Automation Exclusion Center** page to disable or enable the policy.

If you click on a list name in the **Exclude** column, that list opens in the **Lists** page.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/manage-automation-exclusion-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.