> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-policy-management-permissions.md).
# Application Security - Policy Management permissions
This section describes how to configure Application Security Policy Management (rules and policies) permissions.
AppSec Rules
AppSec Rules are individual security detection rules that define what security issues to detect in code, IaC templates, packages, and CI/CD configurations. Each rule has a severity, category, and detection logic. Rules are the building blocks of AppSec Policies. To access AppSec Rules, go to Modules → Application Security → Policy Management → AppSec Rules.
For more information, see [Application Security rules](/application-security/application-security-posture-management-aspm/application-security-rules/rules-inventory.md).
| Permission | Description | Roles Example |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to AppSec Rules. | SOC Tier-1 and 2 Analysts: Rule configuration is outside the scope of case investigation. |
| View | Read-only access to AppSec Rules. Users can browse, filter, and view rule details, including detection logic and severity. They cannot create, edit, enable/disable, or delete rules. | - SOC Tier-3 Analyst: May need to review detection rules to understand why specific findings were generated.
- Threat Hunter: Reviews detection rules to understand coverage and identify detection gaps.
|
| View/Edit | Full access to manage AppSec Rules. Includes all View capabilities plus: create new rules via the Rules Wizard, edit existing rules, enable/disable rules, delete rules, and clone rules. Also grants access to the Rules Wizard steps (Code/Logic and Details). | Security Engineer: Creates custom detection rules, tunes built-in rules, and manages rule severity. |
AppSec Policies
AppSec policies are collections of rules with configurable actions (detect or prevent). Policies define the enforcement behavior, whether findings should be reported only (detect) or should block PRs/CI-CD pipelines (prevent). Policies can be scoped to specific assets/repositories and configured with triggers and actions. They are the primary mechanism for enforcing security guardrails in the development lifecycle. To access AppSec Policies, go to Modules → Application Security → Policy Management → AppSec Policies.
For more information, see [Application Security policies](/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow.md).
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to AppSec Policies. | SOC Tier-1 and 2 Analysts: Rule configuration is outside the scope of case investigation. |
| View | Read-only access to AppSec Policies. Users can browse, filter, and view policy details, including conditions, scope, and actions. They cannot create, edit, enable/disable, or delete policies. | - SOC Tier-3 Analyst: May need to review policies to understand enforcement behavior during investigations.
- Threat Hunter: Reviews policies to understand what is being enforced and identify policy gaps
|
| View/Edit | Full access to manage AppSec Policies. Includes all View capabilities plus: create new policies via the Policies Wizard, edit existing policies, enable/disable policies, delete policies, and clone policies. Also grants access to all Policies Wizard steps (General, Conditions, Scope, Triggers & Actions, Summary). | Security Engineer: Creates and manages security policies, configures detection/prevention actions, and guardrails. |
Required and recommended permissions
To effectively configure Application Security policies, administrators need visibility into the broader cloud environment to understand how policies map to cloud workloads and external integrations.
| Permission | Permission Level | Reason |
| ------------ | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Policies | View or View/Edit | - View: Recommended for AppSec Rules and Policies to view related cloud workload policies for policy and rule context.
- View/Edit: Recommended for AppSec Rules and Policies to edit cloud workload policies alongside AppSec rules and policies.
|
| Integrations | View | Recommended for AppSec Policies to view the integration context for policy scoping. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-policy-management-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.