> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions.md).

# Exceptions Configuration permissions

Configure issue exclusion permissions.

Exceptions Configuration permission controls how security teams manage alert/issue suppression and exception workflows. It provides mechanisms to:

* Suppress false-positive issues by creating exclusion rules that automatically prevent matching issues from being generated.
* Manage exception rules that define conditions under which issues are treated as exceptions (requiring approval workflows).
* Configure approval workflows for exception management, including designating approvers and toggling approval requirements.

Exceptions Configuration includes the following permissions:

* **Issue Exclusions**: Controls exclusion rules, and creating exclusions when resolving a case.
* **Exception Management Admin**: Controls exception rules.
* **Exception Approver Admin**: Controls the exception approval workflow, including approval settings, approvers, and approving or rejecting exceptions.

These permissions depend on each other. Consider them together when you configure a role.

### Permissions required for each action

The following table lists the permission required for each action or view.

#### Pages

| Action or view                                         | Required permissions                                                                                             | Notes                                                                                                                                                                                        |
| ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| View the Combined **Issue Exception & Exclusion** page | <p><strong>Issue Exclusions</strong>: View</p><p>AND</p><p><strong>Exception Management Admin</strong>: View</p> | Requires exception management to be enabled on the tenant.                                                                                                                                   |
| View the Standalone **Issue Exclusions** page          | **Issue Exclusions**: View                                                                                       | Displayed instead of the **Issue Exception & Exclusion** page when exception management is disabled on the tenant, or when the user doesn't have **Exception Management Admin** permissions. |

#### Exclusion rules

| Action or view                                     | Required permissions            | Notes |
| -------------------------------------------------- | ------------------------------- | ----- |
| View exclusion rules and their details             | **Issue Exclusions**: View      |       |
| Create an exclusion rule                           | **Issue Exclusions**: View/Edit |       |
| Edit, delete, enable, or disable an exclusion rule | **Issue Exclusions**: View/Edit |       |

#### Excluding individual or bulk issues

| Action or view                                                                                                                         | Required permissions            | Notes                                        |
| -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | -------------------------------------------- |
| <p>Exclude an issue when resolving a case</p><p>(<strong>Resolve & Create Exclusion</strong> or <strong>Create Exclusion</strong>)</p> | **Issue Exclusions**: View/Edit |                                              |
| Exclude an issue from the **Cases** and **Issues** pages right-click menu (**Manage Issue** → **Exclude Issue**) or hover action       | **Issue Exclusions**: View/Edit | Includes excluding multiple selected issues. |
| Exclude an issue from the **Issues & Insights** table in a case                                                                        | **Issue Exclusions**: View/Edit |                                              |
| Undo an issue exclusion                                                                                                                | **Issue Exclusions**: View/Edit |                                              |
| Exclude a health issue                                                                                                                 | **Issue Exclusions**: View/Edit |                                              |

#### Exception rules

| Action or view                                                                                                                 | Required permissions                                                                                              | Notes                                                      |
| ------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| <p>View exception rules and their details</p><p>(Exception Rules tab on <strong>Issue Exception & Exclusion</strong> page)</p> | <p><strong>Exception Management Admin</strong>: View</p><p>AND</p><p><strong>Issue Exclusions</strong>: View.</p> |                                                            |
| Create an exception rule                                                                                                       | **Exception Management Admin**: View/Edit                                                                         |                                                            |
| Create an exception from the Issues table (**Except Issue**)                                                                   | **Exception Management Admin**: View/Edit                                                                         | Requires exception management to be enabled on the tenant. |
| Disable an exception rule                                                                                                      | **Exception Management Admin**: View/Edit                                                                         | Exception rules can't be edited.                           |

#### Exception approval

| Action or view                                                                                                                                       | Required permissions                    | Notes                                                                                                                        |
| ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| View the **Exception Management** settings (**Settings** → **Configurations** → **General**), including **Approval Required** and the approvers list | **Exception Approver Admin**: View      | Requires exception management to be enabled on the tenant.                                                                   |
| Enable or disable **Approval Required**, and add or remove approvers                                                                                 | **Exception Approver Admin**: View/Edit | When approval is required, you can't remove the last approver. You also can't remove an approver who has pending exceptions. |
| Approve or reject a pending exception                                                                                                                | **Exception Approver Admin**: View/Edit |                                                                                                                              |

#### Public API

| Action or view                 | Required permissions                                                                                                              | Notes |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | ----- |
| Create or disable an exception | <p><strong>Exception Management Admin</strong>: View/Edit</p><p>OR</p><p><strong>Exception Approver Admin</strong>: View/Edit</p> |       |
| Search exceptions              | <p><strong>Exception Management Admin</strong>: View</p><p>OR</p><p><strong>Exception Approver Admin</strong>: View</p>           |       |

For detailed access guidance, see:

* [Issue Exclusions permissions](/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/issue-exclusions-permissions.md)
* [Exception Management Admin permissions](/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-management-admin-permissions.md)
* [Exception Approver Admin permissions](/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-approver-admin-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.