Permissions reference

This page lists every permission in Cortex, grouped the same way as the Create custom role side panel. Use it to decide which default role to assign, or which permissions to turn on in a custom role. Each permission pairs an action (such as View, Edit, or Configure) with the thing it applies to. Throughout the docs, permissions are written as the action followed by the name, such as Edit Scorecards or View Audit logs. The Default roles column shows the lowest default role that includes the permission. Default roles build on each other, so a permission marked User is also included in Manager and Admin. Every permission is available to add to a custom role.

Catalogs

Permission	What it allows	Default roles
View Catalogs	View catalogs and the entities in them.	Viewer
Edit Catalogs	Create, edit, and delete catalogs.	Manager
Edit Entity types	Create, edit, and delete entity types.	User
Edit Entities	Create and edit entities.	User
Archive Entities	Archive entities.	User
Delete Entities	Delete entities.	User
Enable Entity dependency discovery	Sync dependencies directly from the dependency graph.	Admin
Configure Entity verification periods	Create and edit verification periods for entities.	Admin
Execute Verify any entity	Verify any entity, not only the entities the user owns.	Admin
Edit Relationship types	Create, edit, and delete relationship types for entities.	Admin

Scorecards & Initiatives

Permission	What it allows	Default roles
View Scorecards	View Scorecards.	Viewer
Edit Scorecards	Create, edit, and delete Scorecards.	Manager
Execute Scorecards re-evaluation	Manually trigger a Scorecard evaluation from the UI.	Manager
View Scorecard exemptions	View Scorecard exemptions.	User
Configure Scorecard exemptions	Approve or revoke Scorecard exemptions.	Admin
View Initiatives	View Initiatives.	Viewer
Edit Initiatives	Create, edit, and delete Initiatives.	User

Reporting & Metrics

Permission	What it allows	Default roles
View Scorecard reports	View Scorecard reports.	Viewer
View CQL reports	View CQL reports.	Viewer
Edit CQL reports	Create, edit, and delete CQL reports.	User

OpEx

Permission	What it allows	Default roles
View OpEx	View OpEx Review reports, comments, and follow-ups.	Manager
Configure OpEx	Configure OpEx Review, including each report’s metrics and tabs.	Admin
Edit OpEx comments & Follow-ups	Add, reply to, and resolve comments, and add, edit, complete, and delete follow-ups on an OpEx Review report.	Manager

View OpEx gives access to every OpEx Review report in your workspace. It can’t be limited to a single team’s report. To let users outside the default Manager and Admin roles comment on reports, create a custom role with both View OpEx and Edit OpEx comments & Follow-ups.

Cortex AI

Permission	What it allows	Default roles
Enable AI Chat	Use Cortex AI chat, including within OpEx Review reports. This includes access to all metrics and Scorecard scores for any entity, even if they’re hidden from the user elsewhere in Cortex. It doesn’t apply to the Slack AI Assistant or the Cortex MCP.	Manager

Eng Intelligence

Permission	What it allows	Default roles
View Eng Intelligence	View Eng Intelligence metrics. Viewing data by individual users also requires View User dimensions.	Manager
Configure Eng Intelligence	Configure Eng Intelligence settings.	Manager
View User dimensions	Filter, group, and export Eng Intelligence data by individual users, such as PR authors and reviewers, deployers, assignees, and entity owners.	Manager
Edit Dashboards, Modules	Edit Eng Intelligence dashboards and modules.	Manager
Configure Eng Intelligence custom metrics	Create, edit, and delete Eng Intelligence custom metrics.	Manager
Edit Manage Eng Intelligence custom metrics data via API	Create, edit, and delete custom metric data points through the API.	Manager
Configure User Labels	Manage user labels for Eng Intelligence and assign them to users.	Manager

Custom roles that could already view Eng Intelligence were given View User dimensions automatically, so existing users keep the access they had. To limit a role to team- and entity-level Eng Intelligence data, turn off View User dimensions for that role.

Workflows & Scaffolder

Permission	What it allows	Default roles
View Workflows	View Workflows.	User
View Workflow runs	View Workflow runs.	User
Edit Workflows	Create, edit, and delete Workflows.	Manager
Execute Workflow runs	Run Workflows.	User
Configure Scaffolder templates	Create, edit, and delete Scaffolder templates.	User
Execute Scaffolder	Run the Scaffolder.	User

Some Workflows have extra restrictions on who can run them. See Configuring Workflow settings.

Plugins

Permission	What it allows	Default roles
Edit Plugins	Create, edit, and delete plugins.	Admin
Edit Plugin proxies	Create, edit, and delete plugin proxies.	Admin
Configure Plugin appearance	Manage where plugins appear in Cortex.	Admin

Tools

Permission	What it allows	Default roles
Enable Relationship graph	View and use the relationship graph.	Viewer
Configure Discovery audit events	Ignore or import entities found in the discovery audit.	Admin
View Onboarding management	View onboarding management.	Viewer
Enable Onboarding management	Send onboarding management notifications.	Admin
Enable Query builder (basic)	Create and run ad hoc CQL queries in the Query builder.	User
Enable Query builder (with 3rd party integrations)	Create and run ad hoc CQL queries in the Query builder, including queries on third-party integration data.	Admin

Enable Query builder (with third-party integrations) is limited to Admins by default to avoid hitting third-party rate limits. You can add it to a custom role.

Notifications

Permission	What it allows	Default roles
View Notification logs	View notification logs.	Admin
Execute Notification logs	Resend a notification.	Admin
Configure Workspace notification settings	Turn workspace notification settings on or off.	Admin

Settings

Permission	What it allows	Default roles
Configure Settings	Edit workspace settings, identity mappings, and integration configurations.	Admin
Configure Appearance settings	Edit workspace appearance settings, including the logo, plugin placement, entity overview tabs and navigation order, and catalog sort order.	Admin
Configure Integrations	Install, uninstall, and configure integrations.	Admin

Access management

Permission	What it allows	Default roles
Edit Create secrets	Create, edit, and delete secrets used in plugin proxies and other third-party API access.	Admin
Configure IP allowlist	Restrict access to the Cortex app and public API to specific IP addresses. See IP allowlist.	Admin
Configure Open ID Connector & SCIM	Manage OpenID Connect and SCIM settings for Auth0, Microsoft Entra ID, Google, and Okta.	Admin
View Roles	View role definitions and the roles assigned to users and teams.	Admin
Configure Roles	Create, edit, and delete custom roles, and assign roles to users and teams.	Admin
Configure Identity mappings	Review and manage how team members are matched to external accounts, such as GitHub, Jira, PagerDuty, ClickUp, or Slack. See Identity mappings.	Manager
Edit API keys	Create, edit, and delete Cortex API keys.	Admin
Configure API key policy	Configure the API key expiration policy.	Admin
View Breaking API changes	View breaking API changes.	Admin
View Audit logs	View audit logs.	Admin
View GitOps logs	View GitOps logs.	User

Cortex

Get Started

Connect data

Standardize

Improve

Streamline

Configure

Resources

Permissions reference

Catalogs

Scorecards & Initiatives

Reporting & Metrics

OpEx

Cortex AI

Eng Intelligence

Workflows & Scaffolder

Plugins

Tools

Notifications

Settings

Access management

​Catalogs

​Scorecards & Initiatives

​Reporting & Metrics

​OpEx

​Cortex AI

​Eng Intelligence

​Workflows & Scaffolder

​Plugins

​Tools

​Notifications

​Settings

​Access management

Catalogs

Scorecards & Initiatives

Reporting & Metrics

OpEx

Cortex AI

Eng Intelligence

Workflows & Scaffolder

Plugins

Tools

Notifications

Settings

Access management