> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/ai-security-permissions.md).
# AI Security permissions
Cloud AI Security provides a comprehensive overview of the AI assets within an organization. It is designed to ensure AI security by offering tools to review and prioritize AI risks effectively. Users access these features by going to Modules → AI Security). This module covers the following:
* AI Security Dashboard: An overview of AI security posture with asset summaries, risk breakdowns, and vulnerability widgets.
* AI Inventory: A comprehensive inventory of all AI assets, such as Models, Model Endpoints, and Software Packages.
* AI Security Issues: Security findings and posture violations related to AI assets.
* AI Security Detection Rules: Rules that detect security issues in AI deployments.
Requires Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
| Permission | Description | Roles Example |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to AI Security; AI Security functions are hidden. | |
| View | Read-only access to AI Security, such as the AI Security Dashboard, AI Inventory, and AI Security Issues. Users cannot modify configurations or detection rules. | - SOC Tier-1 Analyst: Needs visibility into AI Security issues and threats for initial triage. Can view the AI Security dashboard and inventory to understand the AI asset landscape and identify potential security incidents. Should not modify configurations or detection rules.
- SOC Tier-2 Analyst: Requires deeper investigation capabilities for AI security incidents. Can review AI asset details, ecosystem relationships, and posture findings. May need to correlate AI security issues with broader incident context. Should not modify configurations.
- Threat Hunter: Needs read-only access to AI Security inventory and issues for proactive threat hunting across AI assets. Can investigate AI ecosystem relationships, review model endpoints, and analyze AI-specific threats like model poisoning and prompt injection. Does not need edit access.
|
| View/Edit | Full access to AI Security, such as modifying AI Security configurations, AI detection rules, and managing AI asset classifications. | - SOC Tier-3 Analyst: Advanced analysts who may need to tune AI detection rules, manage AI security posture configurations, and take response actions on complex AI security incidents. Requires edit access for rule tuning and case response.
- Security Engineer: Responsible for configuring and maintaining AI Security detection rules, posture policies, and integration with cloud environments. Needs full edit access to manage the AI security infrastructure.
|
Required and recommended permissions
To effectively secure AI workloads and investigate complex AI-specific threats, analysts and engineers require deep visibility into the underlying cloud configurations, assets, and standard investigation tools:
| Permission | Permission Level | Reason |
| --------------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cases & Issues/Action Center | View or View/Edit | - View access: Strongly recommended to view the AI threats that feed into the issues queue and the response actions taken on them.
- View/Edit: Recommended to actively triage these issues and initiate response actions
|
| Dashboards & Reports | Enabled | - Enabled: Required to view the AI Security dashboard and widgets.
- Enabled with checkboxes selected: Recommended to customize the AI Security dashboard and to generate and customize AI security reports.
|
| Asset Inventory/Groups | View or View/Edit | - View: Strongly recommended to view assets associated with the AI inventory and how they are organized into asset groups.
- View/Edit: Recommended to manage AI-related assets.
|
| Cloud Security & Compute Policies | View or View/Edit | - View: Strongly recommended. Provides critical context regarding the broader cloud security posture, compliance status, and cloud workload protection policies applied to the infrastructure hosting the AI assets
- View/Edit: Recommended to modify AI Security rules, polices, and dashboards.
|
| Query Center/Query Library | View or View/Edit | - View/Enabled: Strongly recommended for the Query Center to run XQL queries on AI security data for investigation. Recommended for Personal Query to save queries for AI security investigation
- View/Edit/Enabled with checkboxes selected: Recommended. Create, run, and edit custom XQL queries for AI security analysis.
|
| Playbooks & Scripts | Enabled | Required to view and understand the automated scripts and playbooks used in AI security response workflows |
| Credentials | View | Recommended to view credentials used for AI data source connections. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/ai-security-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.