> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/role-based-permission-levels.md).

# Role-based Permission Levels

When editing rule-based control (RBAC) permission levels or creating new roles, you can set permission levels to the following Cortex XSOAR components:

| Component                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Account Management (Multi-tenant) | <p>Enables you to configure and manage the multi-tenant deployment, such as add/delete a host, change hosts, move to HA group, etc.</p><p>If you have read or read/write permissions, you can select whether the role can sync content to tenant accounts.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Data                              | <p>Sets the permission level generally for data related to investigations, dashboards, and reports. If you select <strong>none</strong>, the user role cannot view and edit incidents, indicators, dashboards, and reports.</p><p>When <strong>Read/Write</strong> is selected, you can define the following:</p><ul><li><p><strong>Granular data permissions</strong></p><ul><li>Execute potential harmful actions - allows executing integration commands that are marked as Potentially Harmful in the integration code/settings. You would be able to run this from the XSOAR CLI. Playbook tasks that use these commands would not be affected, as they are run by the DBot user as part of playbook execution.</li><li>Edit incident properties - allows editing an Incident's fields from the layout or via the Actions menu.</li><li>Change incident status - allows closing or reopening an incident.</li><li><p>Delete incident - allows deleting incidents. We recommend only granting this permission to the default Admin or select Administrators.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Users with Delete incident permission but without Administration Read/Write permissions can delete incidents from the main <strong>Incidents</strong> table but not from the <strong>Actions</strong> menu inside the incident.</p></div></li><li>Manage the Work Plan - allows interacting with the Playbook on the Incident.</li><li>Edit indicators - allows editing indicators either from the Threat Intel pane, or when viewing the Indicator via it’s full layout or quick view tab.</li><li>Edit layouts (incidents, indicators, and Threat Intel Reports)</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you want to limit dashboards and reports but allow other permissions, you need to remove access to those pages in the <strong>Page Access</strong> section.</p></div></li><li><strong>Incident table actions</strong>. Limit table actions in the <strong>Incidents</strong> page, such as delete, edit, and close.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Tip</strong></p><ul><li>If you want to enable chat in the War Room, but exclude permissions for everything else, you should give the role read/write permissions under <strong>Data</strong> but remove all other granular data permissions. Also remove permissions in Integrations (under Settings). This leaves the role with access to chat only.</li><li>If you want to limit specific page access such as dashboards and reports, you can limit permission in the <strong>Page Access</strong> section.</li></ul></div> |
| Exclusion List                    | Limits permissions when editing, creating, or deleting an indicator in an exclusion list.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Jobs                              | Limits permissions for managing jobs. Roles that have read permissions to content items, retain partial read access. If you do not want to retain partial read access, set the permission to none.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Scripts                           | <p>Limits permissions for managing scripts. If the role has read/write permissions, you can enable user roles to create scripts that run as a Super User.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>When creating a script, permissions for scripts are determined by the Run as and Role fields in the automation settings. Run as determines the permissions with which the automation runs. Role determines who the automation can be seen and executed by. For more information, see <a href="/spaces/9gZ0C5CI8Bl5Aulkp4dZ/pages/iy0xkMaLspR0kFd7pogZ#UUID-4d238e4a-0575-6bb3-e3a9-364720505829_id4cf8ca34-fe93-4150-825b-4b7782370b39">Automation Permissions</a>.</p></div><p>In the <strong>Script</strong> page, you can define which roles are permitted to run an automation, and according to which role the automation executes.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Caution</strong></p><p>User roles with scripts permissions (write) can create/edit/delete scripts and access credentials data. Users with such roles should have a higher level of trust in the organization.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Playbooks                         | <p>Limits permissions for creating, editing and deleting Playbooks.</p><p>You can also add, change, and remove roles from a playbook when clicking <strong>Settings</strong> in the <strong>Playbooks</strong> page.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Settings                          | <p>You can set the permission level generally for all settings or split them according to the following:</p><ul><li><p><strong>Users and Roles</strong>: Includes invitations and editing permissions.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If selecting none, it does not affect the ability to see a list of users when assigning users to an incident and other workflows.</p></div></li><li><p><strong>Integrations</strong>: Whether a role can add, edit or delete instances, pre-process rules, classify and map incidents and indicators.</p><p>Roles that have read permissions for content items, retain partial read access. If you do not want to retain partial read access, set the permission to none.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Caution</strong></p><p>User roles with integration permissions (write) can create/edit/delete integrations and access credentials data. Users with such roles should have a higher level of trust in the organization.</p></div></li><li><p><strong>Integration Permissions</strong>: Sets the permissions in the <strong>Integration Permissions</strong> page. Integration permissions enable you to assign different permission levels for the same command in each instance.</p><ul><li><strong>None</strong>: The user role cannot view the page.</li><li><strong>Read</strong>: The user role can view the page.</li><li><strong>Read/Write</strong>: The user role can view and edit permissions.</li></ul></li><li><p><strong>API Keys</strong>: Whether a role can create/delete API keys, or has read permission.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><ul><li><strong>API Key Read + Admin Read</strong>: Users can only view their own API keys (a key is attached to the generating user). Users can delete them even if they have read access, but cannot create new ones.</li><li><strong>API Key Read/Write + Admin Read</strong>: Users can only view their own API keys and can create and delete their own keys.</li><li><strong>API Key Read + Admin Read/Write</strong>: Users can see all the keys in the system but delete only their keys. They are not be able to create new ones.</li></ul></div></li><li><strong>Credentials</strong>: Whether a role can add, edit, or delete credentials.</li></ul>                                                                                                                                                                                                                                                                                                                      |
| Administration                    | Limits permissions for administration tasks, such as server configurations, audit trails, password policy, machine learning, certain Docker permissions, backups, changing logos, license upload, log bundles, and disaster recovery.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Propagation labels (Multi-tenant) | <p>Enables you to do the following:</p><p><strong>Read</strong>: Enables you to select from existing propagation labels.</p><p><strong>Read/Write</strong>: Enables you to create new and select from existing propagation labels</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Marketplace                       | <p><strong>View Marketplace</strong>: Enables you to view the Marketplace.</p><p><strong>Install Content Pack</strong>: install, upgrade, downgrade, and delete Content Pack content.</p><p><strong>Contribute to Marketplace</strong>: Enables you to contribute a Content Pack in the Contributions tab or generally.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Page Access                       | <p>Select the pages you want the user to have access to.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you select <strong>none</strong> in the <strong>Data</strong> section, even though you allow page access, the user role cannot access those pages. For example, if you allow page access to Dashboards, but <strong>Data</strong> is set to <strong>none</strong>, the user role cannot access the <strong>Dashboards</strong> page.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Default Dashboards                | Select the default dashboards for each role. If a user has not modified their dashboard, these dashboards are added automatically, otherwise users can add these dashboards to their existing dashboards.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Pre-set Role Queries              | Select the [Pre-set Query per Role](/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar.md) for each of the available components.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |

**Role Permission Example**

In the following example, the user can chat in the War Room, create widgets, create incidents, and set context entries with the **`!Set`** command. In addition, the user can view incidents, scripts, and playbooks. The user cannot create indicators.

![role-perm-6\_11.png](/files/UfBWriH4f4Jpl0qg2GeZ)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/role-based-permission-levels.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.