> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md).

# Agent Extension Policies

Configure permissions for agent extension policies.

Manage profiles for additional endpoint capabilities, such as configuring third-party integrations, managing agent extension modules, and defining extension deployment policies. For more information, see [Harden endpoint security](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security.md).

{% hint style="info" %}

### Note

Agent Extension Policies enable access to configure extension policies, profiles, and exceptions. Device Control rules perform device control actions within the extension policies.
{% endhint %}

| Permissions | Description                                                                                                                                                                                                         | Roles Example                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None        | Cannot view the Agent Extensions menu (**Inventory** → **Endpoints** → **Policy Management** → **Extensions**, which includes Policy Rules, Profiles, Device Permanent Extensions, and Device Temporary Extensions. | SOC Tier-1 Analyst: Extension policies are typically not needed for basic triage. Although it may provide context for understanding additional agent capabilities                                                                                                                                                                                                                                                                                                                                                                 |
| View        | View the Agent Extensions menu and read-only access for the Policy Rules, Profiles, Device Permanent Extensions, and Device Temporary Extensions.                                                                   | <ul><li>SOC Tier-2 Analyst: Understanding extension policies helps explain additional agent capabilities during investigations. Extensions like Device Control or Host Firewall affect endpoint behavior.</li><li>SOC Tier-3 Analyst: Full visibility needed for advanced analysis of agent extensions and their impact on endpoint protection and telemetry.</li><li>Threat Hunter: Extension visibility helps understand the full agent capability set for hunting. Hunters need to know what protections are active.</li></ul> |
| View/Edit   | All view capabilities, plus managing Policy Rules, Profiles, Device Permanent Extensions, and Device Temporary Extensions.                                                                                          | Security Engineer: Responsible for extension configuration and deployment. Manages which extensions are enabled for different endpoint groups.                                                                                                                                                                                                                                                                                                                                                                                    |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission            | Permission Level | Reason                                                                                                                                                                                                                                                                                                                                                          |
| --------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Groups          | View             | Required for policy targeting.                                                                                                                                                                                                                                                                                                                                  |
| Device Control        | View             | Strongly Recommended. Extension profiles include Device Control settings. The Device Control view provides violation data that complements the extension policy context. For View/Edit, required, as Extension profiles contain Device Control settings. Device Control edit access is needed to manage violations and add exceptions from the violations view. |
| Agent Administrations | View             | Strongly Recommended. View endpoints to validate extension deployment and verify feature enablement after changes.                                                                                                                                                                                                                                              |
| Host Firewall         | View             | Strongly Recommended. Extension profiles include Host Firewall settings. Firewall view provides event data that complements the extension policy context.                                                                                                                                                                                                       |
| Agent Profiles        | View             | Strongly Recommended. Extension profiles work alongside agent profiles. Understanding both prevents configuration conflicts.                                                                                                                                                                                                                                    |
| Cases & Issues        | View             | Recommended. Review security events related to Device Control and Host Firewall to inform extension policy decisions.                                                                                                                                                                                                                                           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.