> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-classification-permissions.md).

# Data Classification permissions

Data Classification governs how sensitive data is identified, categorized, and labeled across the platform. It serves as the foundational engine that powers both Data Security Posture Management (DSPM) cloud scanning and Endpoint Data Loss Prevention (DLP) detection capabilities.

Users can access Data Classification from both Settings → Configurations → Data Classification and Modules → Data Security → Data Classification. Data Classification includes the following:

* Data Patterns: Definitions used to identify specific types of sensitive data.
* Data Profiles: Logical groupings of data patterns used to assign severity and classification labels.
* Global Settings: Overarching configurations for Optical Character Recognition (OCR), data masking, and preview samples.

Data Classification requires Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.

System-provided (predefined) patterns cannot be edited or deleted regardless of permissions.

| Permissions | Description                                                                                                                                                                                                                                                                                                                                                    | Roles Example                                                                                                                                                                                                                                                                                                                                                                                                         |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None        | No access to Data Classification configuration.                                                                                                                                                                                                                                                                                                                | SOC Tier-1 Analyst: Data classification configuration is outside Tier-1 triage responsibilities.                                                                                                                                                                                                                                                                                                                      |
| View        | Read-only access to all Data Classification configuration pages. The user can navigate to Data Patterns, Data Profiles, and Global Settings pages and see all existing configurations, but all actions are hidden or disabled.                                                                                                                                 | <ul><li>SOC Tier-2 and 3 Analysts: May need to review data patterns and profile definitions when investigating data-related cases (e.g., DLP alerts, DSPM findings) to understand what type of sensitive data was detected and how it was classified.</li><li>Threat Hunter: May need to understand data classification definitions to correlate threat-hunting findings with the data-sensitivity context.</li></ul> |
| View/Edit   | Full access to all Data Classification configuration pages. The user can view all configurations and has complete control to create new custom data patterns and profiles, edit existing custom items, duplicate patterns and profiles, delete custom items, enable/disable patterns and profiles, and modify Global Settings (OCR, masking, preview samples). | Security Engineer: Primary responsibility for defining and maintaining data classification rules.                                                                                                                                                                                                                                                                                                                     |

Required and recommended permissions

Data Classification is the engine that drives both cloud data security and endpoint DLP. To validate that classification rules are working correctly, administrators and analysts require visibility into the security issues and policies that utilize these definitions.

| Permission            | Permission Level  | Reason                                                                                                                                                                                                                                                                                 |
| --------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Data Security         | View              | Strongly Recommended. Data patterns and profiles configured in Data Classification are used to classify cloud data assets. Viewing Data Security results helps validate that classification rules are working correctly.                                                               |
| Data-In-Motion Rules  | View              | Strongly Recommended. DLP rules directly reference data profiles configured in Data Classification. Understanding which DLP rules use which profiles is essential for effective classification management. Changes to profiles can affect DLP rule behavior.                           |
| Endpoint DLP Settings | View or View/Edit | <ul><li>View: Recommended</li><li>View/Edit: Recommended for Security Engineers and Admins.</li></ul><p>Controls overarching DLP engine behavior (such as default actions and browser extensions) and operates closely with Data Classification to enforce endpoint data security.</p> |
| Dashboards            | Enabled           | Recommended. The Data Security Overview dashboard visualizes classification results and data pattern distribution. Dashboard access helps users understand the overall impact of their classification configurations.                                                                  |
| Cases & Issues        | View              | Recommended. DLP and Data Security issues reference data patterns and profiles. Viewing issues helps validate that classification rules are triggering correctly and provides feedback for tuning.                                                                                     |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-classification-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.