> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/agent-scripts-library-permissions.md).

# Agent Scripts Library permissions

The Agents Script Library in the Action Center (**Investigation & Response** → **Response** → **Action Center** → **Agent Script Library**) enables security teams to create, manage, and execute Python scripts on endpoints for response actions, forensic collection, and custom automation.

| Permission | Description                                                                                                                                                                                             | Roles Example                                                                                                     |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| None       | No access to the Agent Script Library. Users cannot run scripts on endpoints, access script execution history, create, edit, or delete scripts.                                                         |                                                                                                                   |
| View       | Users can access the Agent Script Library and view the script list, details, and code. Download the script code and definitions file and view the script history and results.                           | SOC Analyst Tier-1: Should have visibility into scripts and execution history, but no execution capabilities.     |
| View/Edit  | <p>When set to <strong>View/Edit</strong>, the following action checkboxes become available:</p><ul><li>Run Standard Script</li><li>Run High Risk Script</li><li>Script Configurations</li></ul><p></p> | SOC Tier 2 and 3 Analysts, Threat Hunters, and Security Engineers should have full access with granular controls. |

Agent Script Sub-permissions

| Sub-permission        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Roles Example                                                  |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| Run Standard Scripts  | <p>Enables execution of standard scripts, which are lower-risk operations that don't make significant system changes, such as data collection, log retrieval, or read-only queries.</p><ul><li>Checked: Full access to run standard scripts in the Action Center (where the <strong>Outcome</strong> column is set to <strong>Standard</strong>), when defining an action (select <strong>Run Endpoint Script</strong>), Agent Management, and can rerun standard script executions and use interactive script mode for standard scripts.</li><li>Unchecked: Can view standard scripts in the Agent Script Library, but cannot execute standard scripts.</li></ul>                                                                                                                                                                                                                                                                                                                                                   | SOC Tier 2 and 3 Analysts, Security Engineers, Threat Hunters. |
| Run High-Risk Scripts | <p>Enables execution of scripts marked as High-Risk, which can make significant system changes, including file modifications, process termination, registry changes, or system configuration alterations. These scripts require elevated permissions due to their potential impact.</p><ul><li>Checked: Full access to run high-risk scripts in the Action Center (where the <strong>Outcome</strong> column is set to <strong>High-Risk</strong>), when defining an action (select <strong>Run Endpoint Script</strong>), Agent Management, and can rerun High-Risk script executions and use interactive script mode for standard scripts.</li><li>Unchecked: Can view high-risk scripts in the Agent Script Library, but cannot execute standard scripts.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Tip</strong></p><p>Consider adding Run Standard Scripts. High-risk scripts permission is typically granted alongside standard scripts.</p></div> | SOC Tier-3 Analysts, Security Engineers, and Threat Hunters.   |
| Script Configurations | <p>Controls the ability to create, edit, clone, and delete scripts in the Agents Script Library. This is separate from the ability to run scripts.</p><ul><li><p>Checked: Full script management capabilities, including creating, editing, deleting, and saving a script</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Only local scripts (created in the tenant) can be edited or deleted. Scripts from content packs can only be viewed or copied.</p></div></li><li>Unchecked: Can only view and download scripts.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                              | Security Engineer                                              |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission            | Permission Level | Reason                                                                                                                   |
| --------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Action Center         | View             | Without Action Center access, users cannot reach the Script Library page. Required.                                      |
| Cases & Issues        | View             | Strongly recommended as the script execution results link to cases.                                                      |
| Agent Administrations | View             | Required for endpoint selection for script execution.                                                                    |
| Live Terminal         | View             | Often used together. Run scripts for data collection and then use Live Terminal for hands-on investigation. Recommended. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/agent-scripts-library-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.