> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/agentic-ai-in-cortex-xdr/agentic-assistant-security.md).

# Agentic Assistant security

The Agentic Assistant is built on responsible AI principles to ensure its use is safe, fair, and trustworthy. We design our AI to be transparent about its actions, accountable for its decisions, and fair in its operations, avoiding biases.

The following describes how the Agentic Assistant protects sensitive data and gives you control and understanding over its automated actions.

**Access control and permissions**

**User roles and RBAC options**

Instance and Account admins have full control over the permissions and access that users have to the Cortex Agentic Assistant. Cortex XDR uses Role-Based Access Control (RBAC) to manage access to the chat, as well as access to view, create, edit, delete, disable, and enable Agents and Actions in the Agentic Assistant Hub.

**Action Execution Scope**

Agents can only use actions that have been assigned to them, and execution is limited to the user's existing permissions in your Cortex XDR tenant. If a required integration is not active, its commands and any actions that wrap them will not work.

To perform actions in Slack, your Slack email must match your Cortex XDR user email. This ensures the system can strictly follow your assigned permissions (RBAC). If you do not have the required permissions to interact with agents, the system will block the action.

**Data security and control**

**How sensitive data is protected**

Data is hosted and encrypted by default on a dedicated Google Cloud Platform (GCP) project, and is isolated and protected by your specific IAM permissions. Google's multi-tenant architecture enforces strict data separation between customers.

**User approval for sensitive actions**

Actions marked as sensitive require explicit user approval before execution and are never run automatically. This gives you final control over critical or data-modifying steps.

**Data user policy**

Your prompts and outputs are processed only to generate the immediate response. They are not collected for model training or shared with third parties.

**Data residency**

All prompts and responses stay inside that region’s compute boundary, aligning with modern data-residency practices.

**Transparency**

**How the Cortex Agentic Assistant maintains transparency**

You can see how the agent reaches its answer. Click the down arrow next to **Plan**, to view how the user input was interpreted, the planned steps, and the actions used. You can view JSON artifacts created during the plan execution, when data was retrieved or an object was created.

All actions an agent takes are saved in an audit dataset. You can see which agent ran which action, and which user invoked it.

In addition, all chat logs and actions initiated via Slack are stored in the Cortex XDR database and labelled with a specific Slack prefix or metadata tag.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/agentic-ai-in-cortex-xdr/agentic-assistant-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.