> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md).

# Policies - Cloud Workload permissions

Policies permissions control access to Cloud Workload rules and policies (Compute Policies). This module maintains security compliance, prevents misconfigurations, and reduces risks across your cloud environments. Users manage Cloud Workload Policies and Rules by going to **Posture Management → Rules & Policies** and then selecting **Cloud Workload** under **Policies** or **Rules**.

Requires Cloud Posture Security or Cloud Runtime Security license.

**Cloud Workload Policies Controls**

Controls the ability to view, create, edit, duplicate, and delete cloud workload policies and rules.

For more information, see [Cloud workload policies and rules](/cortex-cloud-posture-management/cloud-workload-policies-and-rules/cloud-workload-policies-and-rules.md).

| Permission | Description                                                                                                                                                                                                           | Roles Example                                                                                                                                                                                                   |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | No access to Cloud Workload Policies and Rules. Users can't access Cloud Workload Policies even from within associated issues.                                                                                        | SOC Tier-1 Analyst: Focus on issue triage, not policy management.                                                                                                                                               |
| View       | Read-only access. Users can browse the policies table, open policy side panels to view details, view linked rules, search and filter policies, and export policy data. They cannot modify or take action on policies. | <ul><li>SOC Tier 2 and 3 Analysts: Reference policy configurations during investigations/deep analysis of policy effectiveness.</li><li>Threat Hunter: Understand policy coverage for threat hunting.</li></ul> |
| View/Edit  | Full edit access. Users can create, edit, delete, and duplicate Cloud Workload Policies and Rules.                                                                                                                    | <ul><li>Security Engineer: Create and maintain compute security policies.</li><li>Cloud Security Architect: Full administrative access to policy management.</li></ul>                                          |

Required and recommended permissions

To effectively configure Cloud Workload policies and respond to the issues they generate, administrators and analysts require visibility into cloud assets, compliance standards, and issue queues.

| Permission                    | Permission Level  | Reason                                                                                                |
| ----------------------------- | ----------------- | ----------------------------------------------------------------------------------------------------- |
| Cases & Issues                | View or View/Edit | Strongly recommended to view and triage issues generated by compute and cloud security policies.      |
| Asset Groups                  | View/Edit         | Strongly recommended to configure policy scope using asset groups                                     |
| Cloud Security                | View              | Strongly recommended. CSPM Policies reference Cloud Security Rules.                                   |
| Data Sources                  | View or View/Edit | View and View/Edit. Recommended to view and configure cloud data sources.                             |
| Asset Inventory               | View              | View: Recommended to view cloud compute instances and assets targeted by policies.                    |
| Compliance                    | View              | View: Recommended to view the compliance status of cloud workloads.                                   |
| Cloud Security Command Center | View              | View: Recommended. View Cloud Security dashboards (Command Center and Cloud Security Command Center). |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.