> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/prisma-cloud-admin-permissions.md).
# Prisma Cloud Administrator Permissions
View a list of the access privileges associated with each Prisma Cloud role.
The following tables provides a list of the access privileges associated with each role for different areas of the Prisma Cloud administrative console.
* [Roles that Enable Access to All Areas of the Prisma Cloud Administrative Console](#roles-all)
* [Roles that Enable Runtime Access Only](#roles-compute-only)
See [Prisma Cloud Administrator Roles](/content-collections/administration/prisma-cloud-administrator-roles.md) for details on how to create roles and assign access to account groups or repositories to designate what a user is allowed to view; details on permissions for [Prisma Cloud Compute roles](/content-collections/runtime-security/authentication/prisma-cloud-user-roles.md).
## Roles that Enable Access to All Areas of the Prisma Cloud Administrative Console
| PRISMA CLOUD ROLE | SYSTEM ADMIN | ACCOUNT GROUP ADMIN | CLOUD PROVISIONING ADMIN | ACCOUNT AND CLOUD PROVISIONING ADMIN | BUILD AND DEPLOY SECURITY | ACCOUNT GROUP READ ONLY | DEVELOPER | APPSEC | DATA SECURITY POSTURE MANAGEMENT |
| -------------------------------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ---------------------------------------------------- | ---------------------------------------------------- | ---------------------------------------------------- |
| Current as of: | August 14, 2025 | | | | | | | | |
| Dashboard | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Home | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No |
| Inventory | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Inventory > Applications | All accounts | No | No | No | No | No | No | No | No |
| Save Asset filter(s) | All accounts | Designated accounts | No | Designated accounts | No | Designated Accounts | No | Designated accounts | No |
| Delete Asset Filter(s) | Yes | Users in this role | No | Users in this role | No | Users in this role | No | Designated accounts | No |
| Dashboard > Vulnerability | All accounts | All accounts | No | All accounts | No | All accounts | No | No | No |
| Investigate | | | | | | | | | |
| Running Queries | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Save Searches | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Edit/Delete Saved Search | Yes | Users in this role | No | Users in this role | No | Users in this role | No | Designated accounts | No |
| Investigate > Vulnerability | All accounts | All accounts | No | All accounts | No | All accounts | No | No | No |
| Investigate > Applications | All accounts | No | No | No | No | No | No | No | No |
| Policies | | | | | | | | | |
| View Policy | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| Create Policy | Yes | Yes | No | Yes | No | No | No | Yes | No |
| Add/Edit CLI Remediation in Policy | Yes | No | No | No | No | No | No | Yes | No |
| Edit/Delete/Disable Policy | Yes | Users in this role | No | Users in this role | No | No | No | Yes | No |
| Compliance | | | | | | | | | |
| Compliance Dashboard | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Create/Edit Reports | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Download Reports | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Delete Reports | All accounts | Designated accounts | No | Designated accounts | No | Users in this role | No | Designated accounts | No |
| Create/Edit/Delete Compliance Standards | Yes | No | No | No | No | No | No | No | No |
| View Compliance Standards | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| Save Compliance Filter(s) | All accounts | Designated accounts | No | Designated accounts | No | Designated Accounts | No | Yes | No |
| Delete Compliance Filter(s) | Yes | Users in this role | No | Users in this role | No | Users in this role | No | Yes | No |
| Adoption Advisor | | | | | | | | | |
| Adoption Advisor Console | Yes | No | No | No | No | No | No | No | No |
| Create/Edit Reports | Yes | No | No | No | No | No | No | No | No |
| Download Reports | Yes | No | No | No | No | No | No | No | No |
| Delete Reports | Yes | No | No | No | No | No | No | No | No |
| Alerts | | | | | | | | | |
| View/Search Alerts | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Dismiss/Resolve/Snooze Alerts | All accounts | Designated accounts | No | Designated accounts | No | No | No | Designated accounts | No |
| Save Alert Filter(s) | All accounts | Designated accounts | No | Designated accounts | No | Designated Accounts | No | Designated accounts | No |
| Delete Alert Filter(s) | Yes | Users in this role | No | Users in this role | No | Users in this role | No | No | No |
| Create Report | All accounts | Designated accounts | No | Designated accounts | No | Designated Accounts | No | Designated accounts | No |
| Download Reports | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Delete Reports | All accounts | Designated accounts | No | Designated accounts | No | Designated Accounts | No | Designated accounts | No |
| View Alert Rules | All accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Create/Edit/Delete/Disable Alert Rules | All accounts | Designated accounts | No | Designated accounts | No | No | No | Designated accounts | No |
| View Notification Templates | Yes | Yes | No | Yes | No | Yes | No | Designated accounts | No |
| Create/Edit/Delete Notification Templates | Yes | No | No | Yes | No | No | No | No | No |
| Alerts > Remediate Vulnerabilities | All accounts | All accounts | No | All accounts | No | No | No | No | No |
| Compute | Yes | Yes - Auditor | Yes - Defender Manager | Yes - Auditor | Yes - DevOps
Access to the APIs for running IDE, SCM, and CI plugins for IaC and Vuln scanning
| Yes- DevSecOps User | No | No | No |
| Radar | Yes | Yes read-only access to data relevant to the account in account group | No | Yes read-only access to data relevant to account in account group | No | Yes | No | No | No |
| Defend | Yes | Yes read-only access to all data | No | Yes read-only access to all data | Defend Vulnerabilities/Compliance | Defend Vulnerabilities/Compliance | No | No | No |
| Monitor | Yes | Yes read-only access to data relevant to account in account group | No | Yes read-only access to data relevant to account in account group | Monitor Vulnerabilities/Compliance but only CI tab under Images/Functions | Yes | No | No | No |
| Manage | Yes | View All Logs, Defenders - Manage deployed to account group, Alerts - View, Collections and Tags - Read Only, Authentication - Read Only, System Utilities, such as the Jenkins Plugin and twistcli, path to console, and API token | Defenders - Manage current defenders and deploy new ones, Authentication - view user certificates, System Utilities, such as the Jenkins Plugin and twistcli, path to console, and API token | View All Logs, Defenders - Manage deployed to account group, Alerts - View, Collections and Tags - Read Only, Authentication - Read Only, System Utilities, such as the Jenkins Plugin and twistcli, path to console, and API token | System - Download Utilities, such as the Jenkins Plugin and twistcli, path to console, and API token | System Utilities, such as the Jenkins Plugin and twistcli, path to console, and API token | No | No | No |
| Application Security | | | | | | | | | |
| View Scan Results in Projects | All repositories | Designated repositories | No | Designated repositories | No | Designated repositories | Designated Repositories | All repositories | No |
| Suppress and Submit Changes to repositories | All repositories | Designated repositories | No | Designated repositories | No | No | No | All repositories | No |
| Fix and Submit Changes to repositories | All repositories | Designated repositories | No | Designated repositories | No | No | Yes | All repositories | No |
| View/Edit Filters | All repositories | Designated repositories | No | No | No | Designated repositories | Designated Repositories | All repositories | No |
| View Resource Details and Resource History | All repositories | Designated repositories | No | No | No | Designated repositories | Designated Repositories | All repositories | No |
| View Open in Git | All repositories | Designated repositories | No | No | No | Designated repositories | Designated Repositories | All repositories | No |
| View Merge PR | All repositories | Designated repositories | No | No | No | Designated repositories | Designated Repositories | All repositories | No |
| Enforcement View and Add Exceptions | All repositories | All repositories | All repositories | Designated repositories | All repositories | All repositories | Designated repositories | All repositories | No |
| Edit Enforcement | All repositories | All repositories | All repositories | Designated repositories | No | No | No | All repositories | No |
| Repositories | All repositories | Designated repositories | No | Designated repositories | No | Designated repositories | Designated repositories | All repositories | No |
| Technologies | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| VCS 3rd Parties | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| Jenkins Plugins | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| Pipeline Tools | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| SBOM | Yes | Designated repositories | No | Designated repositories | No | Designated repositories | Designated repositories | Yes | No |
| CI/CD Risks | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| View Workflows | Yes | Yes | No | Yes | No | Yes | No | Yes | No |
| Manage Workflows | Yes | No | No | No | No | No | No | Yes | No |
| Settings | | | | | | | | | |
| View Accounts | All accounts | Designated accounts | Designated accounts | Designated accounts | No | Designated accounts | No | All accounts | No |
| View Account Details | Yes | No | Yes | Yes | No | No | No | No | No |
| Create/Edit/Delete/Disable Accounts | Yes | No | Yes | Yes | No | No | No | No | No |
| View Account Groups | All accounts | Designated accounts | Designated accounts | Designated accounts | No | Designated accounts | No | Designated accounts | No |
| Create/Edit/Delete Account Groups | Yes | No | Yes | Yes | No | No | No | No | No |
| Create/View/Edit/Delete User Roles | Yes | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self |
| Create/View/Edit/Delete/Disable Users | Yes | No | No | No | No | No | No | No | No |
| Add/Activate/Deactivate/Delete Access Keys | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | No |
| View Repositories | Yes | Designated Repositories | No | Designated Repositories | No | Designated Repositories | Designated Repositories | Yes | No |
| Add/Update Repositories | Yes | No | No | Yes | No | No | No | Yes | No |
| Delete Repositories | Yes | No | No | Designated repositories | No | No | No | Yes | No |
| Edit/Update Application Security Configuration | Yes | No | No | No | No | No | No | Yes | No |
| View/Edit SSO Settings | Yes | No | No | No | No | No | No | No | No |
| Create/View/Edit/Delete/Disable Integrations | Yes | No | No | No | No | No | No | Yes | No |
| View/Edit Trusted IP Addresses | Yes | No | No | No | No | No | No | No | No |
| View License Information and Credit Allocation | Yes | No | No | No | No | No | No | Yes | No |
| View Prisma Cloud Audit Logs | Yes | No | No | No | No | No | No | No | No |
| View/Edit Anomaly Settings > Alerts and Thresholds | Yes | No | No | No | No | No | No | No | No |
| View/Edit Anomaly Settings > Anomaly Trusted List | Yes | Yes, can manage trusted list entries only for self | No | Yes, can manage trusted list entries only for self | No | No | No | No | No |
| View/Edit Enterprise Settings | Yes | No | No | No | No | No | No | No | No |
| Alarm Center | Yes | Yes | No | No | No | No | No | No | No |
| Resource Lists | | | | | | | | | |
| Create Resource List | Yes | Yes, only Resource Lists for tags, with the exception of Compute Access Group | No | Yes, with the exception of Compute Access Group | No | No | No | No | No |
| Update Resource List | Yes | Yes, designated Tag type Resource Lists | No | Yes, Designated Resource Lists | No | Yes, Designated Resource Lists | No | No | No |
| Delete Resource List | Yes | No | No | No | No | No | No | No | No |
| View Resource Lists | Yes | Yes, Designated Resource Lists | No | Yes, Designated Resource Lists | Yes, Designated Resource Lists | Yes, Designated Resource Lists | No | No | No |
| Data Security Posture Management | No | No | No | No | No | No | No | No | Yes |
## Roles that Enable Runtime Access Only
| PRISMA CLOUD ROLE | SYSTEM ADMIN WITH COMPUTE ACCESS ONLY | ACCOUNT GROUP ADMIN WITH COMPUTE ACCESS ONLY | ACCOUNT AND CLOUD PROVISIONING ADMIN WITH COMPUTE ACCESS ONLY | ACCOUNT GROUP READ ONLY WITH COMPUTE ACCESS ONLY |
| ------------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------- |
| Current as of: | August 14, 2025 | | | |
| Dashboard | No | No | No | No |
| Home | Yes | Yes | Yes | Yes |
| Inventory | No | No | No | No |
| Save Asset filter(s) | No | No | No | No |
| Delete Asset Filter(s) | No | No | No | No |
| Investigate | No | No | No | No |
| Policies | No | No | No | No |
| Compliance | No | No | No | No |
| Alerts | No | No | No | No |
| Compute | Yes | Yes | Yes | Yes |
| Radar | Yes | Yes read-only access to data relevant to the account in account group | Yes read-only access to data relevant to account in account group | Yes |
| Defend | Yes | Yes read-only access to all data | Yes read-only access to all data | No |
| Monitor | Yes | Yes read-only access to data relevant to account in account group | Yes read-only access to data relevant to account in account group | Yes |
| Manage | Yes | View All Logs,
Defenders - Manage deployed to account group,
Alerts - View,
Collections and Tags - Read Only,
Authentication - Read Only,
System - Downloads - Jenkins Plugin and twistcli
| View All Logs,
Defenders - Manage deployed to account group,
Alerts - View,
Collections and Tags - Read Only,
Authentication - Read Only,
System - Downloads - Jenkins Plugin and twistcli
| Yes |
| Application Security | No | No | No | No |
| Settings | | | | |
| Create / View / Edit / Delete User Roles | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self | Read-only access to view the roles assigned for self |
| Add/Activate/Deactivate/Delete Access Keys | Yes
Can manage access keys for self
| Yes
Can manage access keys for self
| Yes
Can manage access keys for self
| Yes
Can manage access keys for self
|
| Resource Lists | No | No | No | No |
| Alarm Center | No | No | No | No |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/administration/prisma-cloud-admin-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.