This section describes how to configure Application Security Policy Management (rules and policies) permissions.
### AppSec Rules
AppSec Rules are individual security detection rules that define what security issues to detect in code, IaC templates, packages, and CI/CD configurations. Each rule has a severity, category, and detection logic. Rules are the building blocks of AppSec Policies. To access AppSec Rules, go to Modules → Application Security → Policy Management → AppSec Rules.
| Permission | Description | Roles Example |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to AppSec Rules. | SOC Tier-1 and 2 Analysts: Rule configuration is outside the scope of case investigation. |
| View | Read-only access to AppSec Rules. Users can browse, filter, and view rule details, including detection logic and severity. They cannot create, edit, enable/disable, or delete rules. | <ul><li>SOC Tier-3 Analyst: May need to review detection rules to understand why specific findings were generated.</li><li>Threat Hunter: Reviews detection rules to understand coverage and identify detection gaps.</li></ul> |
| View/Edit | Full access to manage AppSec Rules. Includes all View capabilities plus: create new rules via the Rules Wizard, edit existing rules, enable/disable rules, delete rules, and clone rules. Also grants access to the Rules Wizard steps (Code/Logic and Details). | Security Engineer: Creates custom detection rules, tunes built-in rules, and manages rule severity. |
### AppSec Policies
AppSec policies are collections of rules with configurable actions (detect or prevent). Policies define the enforcement behavior, whether findings should be reported only (detect) or should block PRs/CI-CD pipelines (prevent). Policies can be scoped to specific assets/repositories and configured with triggers and actions. They are the primary mechanism for enforcing security guardrails in the development lifecycle. To access AppSec Policies, go to Modules → Application Security → Policy Management → AppSec Policies.
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to AppSec Policies. | SOC Tier-1 and 2 Analysts: Rule configuration is outside the scope of case investigation. |
| View | Read-only access to AppSec Policies. Users can browse, filter, and view policy details, including conditions, scope, and actions. They cannot create, edit, enable/disable, or delete policies. | <ul><li>SOC Tier-3 Analyst: May need to review policies to understand enforcement behavior during investigations.</li><li>Threat Hunter: Reviews policies to understand what is being enforced and identify policy gaps</li></ul> |
| View/Edit | Full access to manage AppSec Policies. Includes all View capabilities plus: create new policies via the Policies Wizard, edit existing policies, enable/disable policies, delete policies, and clone policies. Also grants access to all Policies Wizard steps (General, Conditions, Scope, Triggers & Actions, Summary). | Security Engineer: Creates and manages security policies, configures detection/prevention actions, and guardrails. |
### Required and recommended permissions
To effectively configure Application Security policies, administrators need visibility into the broader cloud environment to understand how policies map to cloud workloads and external integrations.
| Permission | Permission Level | Reason |
| ------------ | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Policies | View or View/Edit | <ul><li>View: Recommended for AppSec Rules and Policies to view related cloud workload policies for policy and rule context.</li><li>View/Edit: Recommended for AppSec Rules and Policies to edit cloud workload policies alongside AppSec rules and policies.</li></ul> |
| Integrations | View | Recommended for AppSec Policies to view the integration context for policy scoping. |