> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md).

# Policies - Cloud Workload permissions

Configure permissions for cloud workload policies.

Policies permissions control access to Cloud Workload rules and policies (Compute Policies). This module maintains security compliance, prevents misconfigurations, and reduces risks across your cloud environments. Users manage Cloud Workload Policies and Rules by going to **Posture Management → Rules & Policies** and then selecting **Cloud Workload** under **Policies** or **Rules**.

Requires Cloud Posture Security or Cloud Runtime Security license.

**Cloud Workload Policies Controls**

Controls the ability to view, create, edit, duplicate, and delete cloud workload policies and rules.

For more information, see [Cloud workload policies and rules](/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules.md).

| Permission | Description                                                                                                                                                                                                           | Roles Example                                                                                                                                                                                                   |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | No access to Cloud Workload Policies and Rules. Users can't access Cloud Workload Policies even from within associated issues.                                                                                        | SOC Tier-1 Analyst: Focus on issue triage, not policy management.                                                                                                                                               |
| View       | Read-only access. Users can browse the policies table, open policy side panels to view details, view linked rules, search and filter policies, and export policy data. They cannot modify or take action on policies. | <ul><li>SOC Tier 2 and 3 Analysts: Reference policy configurations during investigations/deep analysis of policy effectiveness.</li><li>Threat Hunter: Understand policy coverage for threat hunting.</li></ul> |
| View/Edit  | Full edit access. Users can create, edit, delete, and duplicate Cloud Workload Policies and Rules.                                                                                                                    | <ul><li>Security Engineer: Create and maintain compute security policies.</li><li>Cloud Security Architect: Full administrative access to policy management.</li></ul>                                          |

Required and recommended permissions

To effectively configure Cloud Workload policies and respond to the issues they generate, administrators and analysts require visibility into cloud assets, compliance standards, and issue queues.

| Permission                    | Permission Level  | Reason                                                                                                |
| ----------------------------- | ----------------- | ----------------------------------------------------------------------------------------------------- |
| Cases & Issues                | View or View/Edit | Strongly recommended to view and triage issues generated by compute and cloud security policies.      |
| Asset Groups                  | View/Edit         | Strongly recommended to configure policy scope using asset groups                                     |
| Cloud Security                | View              | Strongly recommended. CSPM Policies reference Cloud Security Rules.                                   |
| Data Sources                  | View or View/Edit | View and View/Edit. Recommended to view and configure cloud data sources.                             |
| Asset Inventory               | View              | View: Recommended to view cloud compute instances and assets targeted by policies.                    |
| Compliance                    | View              | View: Recommended to view the compliance status of cloud workloads.                                   |
| Cloud Security Command Center | View              | View: Recommended. View Cloud Security dashboards (Command Center and Cloud Security Command Center). |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.