> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/prisma-cloud-administrator-roles.md). # Prisma Cloud Administrator Roles Prisma Cloud roles define the type of access that an administrative user has. A user on Prisma Cloud is someone who has been assigned administrative privileges, and a role defines the type of access that the administrator has on the service. When you define a role, you specify the permission group and the account groups or repositories that the administrator can manage or view. Prisma Cloud has the following permission groups built-in for administrators. * **System Admin**—Full control (read/write permissions) to the service, and they can create, edit, or delete account groups or cloud accounts. Only System administrators have access to all **Settings** on Prisma Cloud and can view audit logs to analyze actions performed by other users who have been assigned administrative privileges. If you use the System Admin role with **Only for runtime capabilities** enabled, the administrator only has full control (read/write permissions) to **Runtime Security** and APIs on Prisma Cloud, and does not have access to the rest of Prisma Cloud capabilities. * **Account Group Admin**—Read/write permissions for the cloud accounts and account groups to which they are granted access. An account group administrator can only view assets deployed within the cloud accounts to which they have access. Assets deployed on other cloud accounts that Prisma Cloud monitors are excluded from the search or investigation results. * **Account Group Read Only**—Read only permissions to view designated sections of Prisma Cloud. This role does not have permissions to modify any settings. * **Account and Cloud Provisioning Admin**—Combines the permissions for the **Account Group Admin** and the **Cloud Provisioning Admin** to enable an administrator who is responsible for a line of business. With this role, in addition to being able to onboard cloud accounts, the administrator can access the dashboard, manage the security policies, investigate issues, view alerts and compliance details for the designated accounts only. * **Cloud Provisioning Admin**—Permissions to onboard and manage cloud accounts from Prisma Cloud and the APIs, and the ability to create and manage the account groups. With this role access is limited to **Settings > Cloud Accounts** and **Settings > Account Groups** on the admin console. * **Build and Deploy Security**—Restricted permissions to DevOps users who need access to a subset of **Runtime Security** capabilities and/or API access to run image vulnerabilities scans. For example, the Build and Deploy Security role enables read-only permissions to review vulnerability and compliance scan reports on **runtime security** and to manage and download utilities such as Defender images, plugins and twistcli. And if you use the Build and Deploy Security role with **Access key only** enabled, the administrator can create [one access key](/content-collections/administration/create-access-keys.md#idb225a52a-85ea-4b0c-9d69-d2dfca250e16) to use the Prisma Cloud Runtime Security APIs. See [Runtime Security Roles](/content-collections/runtime-security/authentication/user-roles.md) for more details for the roles and associated permissions. * **Developer**—Restricted permissions to developers or DevOps users who need access to a subset of **Application Security** capabilities. With the exception of generating access keys, and viewing and fixing issues in IaC scan results on **Application Security**, it enables read-only permissions to view/update repository settings to which they have access, and view application security configuration. [Add Administrative Users On Prisma Cloud](/content-collections/administration/add-prisma-cloud-users.md#id2730a69c-eea8-4e00-a7f1-df3b046615bc). You can **View permissions** associated with each role on **Settings > Access Control > Permission Groups**. You can also create custom Permission Groups to define least-privileged access to Prisma Cloud. This ensures that users only have the limited permissions required to accomplish the tasks aligned with their job responsibilities. For instance, you use [custom Permission Groups](/content-collections/administration/create-custom-permission-groups.md) to allow users to only view and export Prisma Cloud Audit Logs into a third-party system. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/administration/prisma-cloud-administrator-roles.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.