> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-groups-permissions.md).

# Asset Groups permissions

Configure permissions for asset groups.

**Asset Groups permissions**

Asset Groups enable organizations to manage asset groups, such as creating logical groupings of assets, applying policies and rules to asset groups, scoping user access to specific asset groups (SBAC), and supporting automation exclusions by asset group.

{% hint style="warning" %}

### Caution

SBAC: Asset Groups form the foundation of Scope-Based Access Control (SBAC). Granting a user View/Edit access to Asset Groups allows them to modify the groups that dictate data access boundaries for other users in the tenant.
{% endhint %}

The following features are affected:

* Asset Groups: **Inventory** → **Assets** → **Groups**. For more information, see [Asset groups](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-groups.md).
* User Groups: When defining or editing a user group, you can scope an asset by defining the access group. For more information, see [Scope user access to applications (Application SBAC)](/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md).
* Automations Exclusion Center: When selecting Edit Policy, you can add an Asset Group to exclude the relevant asset class. For more information, see [Manage automation exclusion policies](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/manage-automation-exclusion-policies.md).

| Permissions | Description                                                                                                                | Roles Example                                                                                                                                                                                                             |
| ----------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None        | No access to the Asset Group Menu, and limited ability to view groups in SBAC and Select groups in Automation Exclusion.   | SOC Tier 1 Analyst: Asset group management is not part of the daily operations.                                                                                                                                           |
| View        | Read-only access to the View Assets Group list, details, members, search and filter groups, and only view groups in SBAC.  | <ul><li>SOC Tier 2 Analyst: Reference asset groups during investigations</li><li>SOC Tier 3 Analyst: Understand asset groupings for analysis.</li><li>Threat Hunter: Reference asset groups for scoped hunting.</li></ul> |
| View/Edit   | All View capabilities, plus create, edit, delete, add assets to a group in SBAC, and select groups in automation exclusion | Security Engineer: Configure and maintain asset groups                                                                                                                                                                    |

**Recommended permissions**

Consider adding the following permissions:

| Permission      | Permission Level  | Reason                                                                                                                                |
| --------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| Asset Inventory | View or View/Edit | <ul><li>View: Required to view assets to add to groups.</li><li>View/Edit: Recommended to manage asset tags and properties.</li></ul> |
| Host Insights   | View              | Recommended to view endpoint details for group context                                                                                |
| Query Center    | View              | Recommended to run XQL queries on asset group data.                                                                                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-groups-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.