Policy permissions control access to Cloud Workload rules and policies (Compute Policies). This module maintains security compliance, prevents misconfigurations, and reduces risks across your cloud environments. Users manage Cloud Workload Policies and Rules by going to Posture Management → Rules & Policies and then selecting Cloud Workload under Policies or Rules.
Requires Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
**Cloud Workload Policies Controls**
Controls the ability to view, create, edit, duplicate, and delete cloud workload policies and rules.
| Permission | Description | Roles Example |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Cloud Workload Policies and Rules. Users can't access Cloud Workload Policies even from within associated issues. | SOC Tier-1 Analyst: Focus on issue triage, not policy management. |
| View | Read-only access. Users can browse the policies table, open policy side panels to view details, view linked rules, search and filter policies, and export policy data. They cannot modify or take action on policies. | <ul><li>SOC Tier 2 and 3 Analysts: Reference policy configurations during investigations/deep analysis of policy effectiveness.</li><li>Threat Hunter: Understand policy coverage for threat hunting.</li></ul> |
| View/Edit | Full edit access. Users can create, edit, delete, and duplicate Cloud Workload Policies and Rules. | <ul><li>Security Engineer: Create and maintain compute security policies.</li><li>Cloud Security Architect: Full administrative access to policy management.</li></ul> |
Required and recommended permissions
To effectively configure Cloud Workload policies and respond to the issues they generate, administrators and analysts require visibility into cloud assets, compliance standards, and issue queues.
| Permission | Permission Level | Reason |
| ----------------------------- | ----------------- | ----------------------------------------------------------------------------------------------------- |
| Cases & Issues | View or View/Edit | Strongly recommended to view and triage issues generated by compute and cloud security policies. |
| Asset Groups | View/Edit | Strongly recommended to configure policy scope using asset groups |
| Cloud Security | View | Strongly recommended. CSPM Policies reference Cloud Security Rules. |
| Data Sources | View or View/Edit | View and View/Edit. Recommended to view and configure cloud data sources. |
| Asset Inventory | View | View: Recommended to view cloud compute instances and assets targeted by policies. |
| Compliance | View | View: Recommended to view the compliance status of cloud workloads. |
| Cloud Security Command Center | View | View: Recommended. View Cloud Security dashboards (Command Center and Cloud Security Command Center). |