> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-security-permissions.md).

# Data Security permissions

The Data Security permission includes the following permissions:

* Endpoint DLP: Includes permissions such as Data-in-motion rules and Endpoint Applications. For more information about Endpoint DLP permissions, see [Data Security - Endpoint DLP permissions](/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions.md).
* Data Security: Data Security Posture Management (DSPM)

This section controls access to the DSPM features, which provide deep visibility into cloud data assets (such as storage buckets, databases, and backups) and their underlying data objects (files, columns, and tables). It also controls access to the Data Pattern Inventory, Data Security Detection Rules, and the Data Security Issues queue.

Users access DSPM from Modules → Data Security.

Requires Cloud Posture Security or Cloud Runtime Security license.

| Permission | Description                                                                                                                                                                                                                                                        | Roles Example                                                                                                                                                                                                                      |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | Users cannot access the DSPM pages (All Assets, Disks, Storage Buckets, Databases, Backups), data objects (Files, Columns, Tables), Data Pattern Inventory, Data Security Issues (posture and threats), and Detection Rules.                                       | SOC Tier-1 Analyst: Data security posture management is outside the triage scope.                                                                                                                                                  |
| View       | Read-only access to all DSPM pages. Users can view the Overview dashboard, browse all discovered data assets and their classifications, and view the Data Pattern Inventory, Data Security Issues (posture and threats), and Detection Rules                       | <ul><li>SOC Tier-2 and 3 Analysts: May need to review data asset context when investigating data-related cases.</li><li>Threat Hunter: May need to understand the data asset landscape for comprehensive threat hunting.</li></ul> |
| View/Edit  | Full control over DSPM features. Users can trigger manual data scans, manage data asset configurations, interact with data security issues (acknowledge and remediate), and manage the overview dashboard. All action buttons and management forms are accessible. | Security Engineer: Responsible for configuring data security scanning and managing data classifications.                                                                                                                           |

Required and recommended permissions

To effectively secure cloud data and investigate complex data-centric threats, administrators and analysts require deep visibility into the underlying cloud configurations and standard investigation tools. Consider adding the following permissions:

| Permission      | Permission Level | Reason                                                                                                                 |
| --------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------- |
| Cases & Issues  | View             | Strongly recommended to view Cloud Data Security issues.                                                               |
| Data Sources    | View             | Recommended. Allows checking the data source status. View/Edit: Recommended. Configure cloud data source integrations. |
| Asset Inventory | View             | Recommended to view the asset context related to data security findings.                                               |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-security-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.