> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md).
# Agent Extension Policies
Manage profiles for additional endpoint capabilities, such as configuring third-party integrations, managing agent extension modules, and defining extension deployment policies. For more information, see [Harden endpoint security](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security.md).
{% hint style="info" %}
### Note
Agent Extension Policies enable access to configure extension policies, profiles, and exceptions. Device Control rules perform device control actions within the extension policies.
{% endhint %}
| Permissions | Description | Roles Example |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | Cannot view the Agent Extensions menu (**Inventory** → **Endpoints** → **Policy Management** → **Extensions**, which includes Policy Rules, Profiles, Device Permanent Extensions, and Device Temporary Extensions. | SOC Tier-1 Analyst: Extension policies are typically not needed for basic triage. Although it may provide context for understanding additional agent capabilities |
| View | View the Agent Extensions menu and read-only access for the Policy Rules, Profiles, Device Permanent Extensions, and Device Temporary Extensions. | - SOC Tier-2 Analyst: Understanding extension policies helps explain additional agent capabilities during investigations. Extensions like Device Control or Host Firewall affect endpoint behavior.
- SOC Tier-3 Analyst: Full visibility needed for advanced analysis of agent extensions and their impact on endpoint protection and telemetry.
- Threat Hunter: Extension visibility helps understand the full agent capability set for hunting. Hunters need to know what protections are active.
|
| View/Edit | All view capabilities, plus managing Policy Rules, Profiles, Device Permanent Extensions, and Device Temporary Extensions. | Security Engineer: Responsible for extension configuration and deployment. Manages which extensions are enabled for different endpoint groups. |
**Required and recommended permissions**
Consider adding the following permissions:
| Permission | Permission Level | Reason |
| --------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Groups | View | Required for policy targeting. |
| Device Control | View | Strongly Recommended. Extension profiles include Device Control settings. The Device Control view provides violation data that complements the extension policy context. For View/Edit, required, as Extension profiles contain Device Control settings. Device Control edit access is needed to manage violations and add exceptions from the violations view. |
| Agent Administrations | View | Strongly Recommended. View endpoints to validate extension deployment and verify feature enablement after changes. |
| Host Firewall | View | Strongly Recommended. Extension profiles include Host Firewall settings. Firewall view provides event data that complements the extension policy context. |
| Agent Profiles | View | Strongly Recommended. Extension profiles work alongside agent profiles. Understanding both prevents configuration conflicts. |
| Cases & Issues | View | Recommended. Review security events related to Device Control and Host Firewall to inform extension policy decisions. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.