> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions-1/agent-scripts-library-permissions.md).

# Agent Scripts Library permissions

Configure permissions for Agent Scripts Library.

The Agents Script Library in the Action Center (**Investigation & Response** → **Response** → **Action Center** → **Agent Script Library**) enables security teams to create, manage, and execute Python scripts on endpoints for response actions, forensic collection, and custom automation.

| Permission | Description                                                                                                                                                                                                                                                                                                                                                                                                | Roles Example                                                                                                     |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| None       | No access to the Agent Script Library. Users cannot run scripts on endpoints, access script execution history, create, edit, or delete scripts.                                                                                                                                                                                                                                                            |                                                                                                                   |
| View       | Users can access the Agent Script Library and view the script list, details, and code. Download the script code and definitions file and view the script history and results.                                                                                                                                                                                                                              | SOC Analyst Tier-1: Should have visibility into scripts and execution history, but no execution capabilities.     |
| View/Edit  | <p>When set to <strong>View/Edit</strong>, the following action checkboxes become available:</p><ul><li>Run Standard Script</li><li>Run High Risk Script</li><li>Script Configurations</li></ul><p>For more information, see <a href="/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/run-scripts-on-an-endpoint.md">Run scripts on an endpoint</a></p> | SOC Tier 2 and 3 Analysts, Threat Hunters, and Security Engineers should have full access with granular controls. |

Agent Script Sub-permissions

| Sub-permission        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Roles Example                                                  |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| Run Standard Scripts  | <p>Enables execution of standard scripts, which are lower-risk operations that don't make significant system changes, such as data collection, log retrieval, or read-only queries.</p><ul><li>Checked: Full access to run standard scripts in the Action Center (where the <strong>Outcome</strong> column is set to <strong>Standard</strong>), when defining an action (select <strong>Run Endpoint Script</strong>), Agent Management, and can rerun standard script executions and use interactive script mode for standard scripts.</li><li>Unchecked: Can view standard scripts in the Agent Script Library, but cannot execute standard scripts.</li></ul>                                                                                                                                                                                                                                                                                                                                                   | SOC Tier 2 and 3 Analysts, Security Engineers, Threat Hunters. |
| Run High-Risk Scripts | <p>Enables execution of scripts marked as High-Risk, which can make significant system changes, including file modifications, process termination, registry changes, or system configuration alterations. These scripts require elevated permissions due to their potential impact.</p><ul><li>Checked: Full access to run high-risk scripts in the Action Center (where the <strong>Outcome</strong> column is set to <strong>High-Risk</strong>), when defining an action (select <strong>Run Endpoint Script</strong>), Agent Management, and can rerun High-Risk script executions and use interactive script mode for standard scripts.</li><li>Unchecked: Can view high-risk scripts in the Agent Script Library, but cannot execute standard scripts.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Tip</strong></p><p>Consider adding Run Standard Scripts. High-risk scripts permission is typically granted alongside standard scripts.</p></div> | SOC Tier-3 Analysts, Security Engineers, and Threat Hunters.   |
| Script Configurations | <p>Controls the ability to create, edit, clone, and delete scripts in the Agents Script Library. This is separate from the ability to run scripts.</p><ul><li><p>Checked: Full script management capabilities, including creating, editing, deleting, and saving a script</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Only local scripts (created in the tenant) can be edited or deleted. Scripts from content packs can only be viewed or copied.</p></div></li><li>Unchecked: Can only view and download scripts.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                              | Security Engineer                                              |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission            | Permission Level | Reason                                                                                                                   |
| --------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Action Center         | View             | Without Action Center access, users cannot reach the Script Library page. Required.                                      |
| Cases & Issues        | View             | Strongly recommended as the script execution results link to cases.                                                      |
| Agent Administrations | View             | Required for endpoint selection for script execution.                                                                    |
| Live Terminal         | View             | Often used together. Run scripts for data collection and then use Live Terminal for hands-on investigation. Recommended. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions-1/agent-scripts-library-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.