> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-roles-configuration-permissions.md).

# Asset Roles configuration permissions

Asset Roles Configuration allows organizations to define and manage specific functional roles for assets across their environment (such as Admin, User, or Server). By associating specific users and endpoints with these roles, security teams can enrich security events with role context and support role-based analytics and alerting. Users access these features by going to **Inventory** → **Assets** → **Asset Roles Configuration**.

{% hint style="info" %}

### Notice

Requires the Identity Threat Detection and Response add-on.
{% endhint %}

For more information, see [Asset Roles](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles.md).

The Asset Roles configuration permissions control the ability to view, create, edit, and assign endpoints to functional asset roles.

| Permissions | Description                                                                                                                                                        | Roles Example                                                                                                                                                                                                        |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None        | No access to the **Assets Roles Configuration** page.                                                                                                              | SOC Tier-1 Analyst: The role configuration is not part of daily operations                                                                                                                                           |
| View        | Read-only access to the **Assets Role Configuration** page, including viewing the roles list, details, members, and searching/filtering roles.                     | <ul><li>SOC Tier-2 Analyst: Reference role context during investigations.</li><li>SOC Tier-3 Analyst: Understand role assignments for analysis,</li><li>Threat Hunter: Reference role context for hunting.</li></ul> |
| View/Edit   | All view capabilities, plus all view/edit actions, such as add, edit, delete, and add endpoints to a role, as well as manually assign endpoints to specific roles. | Security Engineer: Configure and maintain asset roles.                                                                                                                                                               |

**Required and recommended permissions**

To effectively assign roles and investigate threats targeting specific functional users or servers, administrators and analysts require visibility into the underlying identity analytics and the overarching asset inventory. Consider adding the following permissions:

| Permission        | Permission Level | Reason                                                     |
| ----------------- | ---------------- | ---------------------------------------------------------- |
| Asset Inventory   | View             | Required to view assets associated with roles.             |
| Identity Security | View             | Strongly recommended to view identity analytics data.      |
| Host Insights     | View             | Recommended to view endpoint details for the role context. |
| Query Center      | View             | Recommended to run XQL queries on role data.               |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-roles-configuration-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.