> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/explore-permissions-using-the-simple-and-advanced-access-tables.md).

# Explore permissions using the simple and advanced access tables

#### Overview

Analyzing an identity's permissions can be complex due to the numerous ways permissions are granted, including various granters, policy types, wildcards, and explicit resource access.

The access tables in Cortex Cloud Identity Security simplify this task by providing distinct views for exploring permissions of both identities and destinations at different levels of granularity.

Open an access table

1. In the Cortex Cloud Identity Security module, open an asset.
2. Click the **Identity** tab.

   The **Graph** view of the asset's identity is displayed.
3. Click **Table** to display the graph content in table view.

   A simple table is displayed.
4. To display the advanced view of the table, click the **Advanced view** toggle.
5. To go back to the simple table display, click the **Advanced view** toggle again.

#### Access table granularities

Cortex Cloud Identity Security offers two access views: the Simple access table and the Advanced access table.

**Simple access table**

The Simple access table provides a high-level overview of the following:

* **Identities:** Shows the services an identity can access (such as RDS, cloud storage, or Vertex).
* **Destinations:** Shows the identity types that have access to the destination asset.

**Advanced access table**

The Advanced access table offers a deeper, more granular view of permissions, including crucial context for security analysis:.

* **Granters:** Identifies granters that provide the specific permission.
* **Policy Patterns:** Shows the patterns written in the policies that grant access to destination assets. For example, if a policy includes a wildcard pattern that is relevant to many assets, you are able to explore which specific patterns granted access to each one.
* **Security Context:** Provides additional insights, such as:
  * Unused permissions
  * Excessive policies
  * Cross-account access
  * Sensitive data related to the permission

#### Exploring an identity's permissions

When exploring an identity, its **Access** tab lists all the permissions that the identity holds.

* **Simple view:** Initially displays the broad service categories that the identity can access, such as RDS, cloud storage, or Vertex.
* **Drill down:** Clicking on each service reveals the exact assets the identity can access within that service.
* **Advanced analysis:** To understand how permissions are granted, use the Advanced access table.
  * Hovering over an access line exposes a redirection button.
  * Clicking the **Advanced** toggle button displays the Advanced access table, where you can analyze the granting policies, view the last used time for the permission, and check for associated sensitive data, unused permissions, or excessive permissions.

#### Exploring a destination asset's permissions

When exploring a destination asset, such as a specific Amazon S3 bucket or database, the focus shifts to who can access it.

* **Simple view:** The Simple access table shows all the identity asset types such as roles, users, and functions that can access the destination.
* **Advanced analysis:** To understand the details of access for a specific identity type:
  * Explore that identity type in the Advanced access table.
  * This view shows how the permission is granted, the specific permission pattern used, and provides contextual data, for example, the exact sensitive data that is related to the permission.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/explore-permissions-using-the-simple-and-advanced-access-tables.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.