> ## Documentation Index > Fetch the complete documentation index at: https://docs.cortex.io/llms.txt > Use this file to discover all available pages before exploring further. # Permissions reference > Every permission you can grant in Cortex, what it allows, and which default roles include it. This page lists every permission in Cortex, grouped the same way as the **Create custom role** side panel. Use it to decide which [default role](https://docs.cortex.io/configure/settings/managing-users/permissioning#default-roles) to assign, or which permissions to turn on in a [custom role](https://docs.cortex.io/configure/settings/managing-users/permissioning/custom-roles.md). Each permission pairs an action (such as **View**, **Edit**, or **Configure**) with the thing it applies to. Throughout the docs, permissions are written as the action followed by the name, such as **Edit Scorecards** or **View Audit logs**. The **Default roles** column shows the lowest default role that includes the permission. Default roles build on each other, so a permission marked **User** is also included in Manager and Admin. Every permission is available to add to a custom role. ## Catalogs | Permission | What it allows | Default roles | | - | - | - | | **View Catalogs** | View catalogs and the entities in them. | Viewer | | **Edit Catalogs** | Create, edit, and delete catalogs. | Manager | | **Edit Entity types** | Create, edit, and delete entity types. | User | | **Edit Entities** | Create and edit entities. | User | | **Archive Entities** | Archive entities. | User | | **Delete Entities** | Delete entities. | User | | **Enable Entity dependency discovery** | Sync dependencies directly from the dependency graph. | Admin | | **Configure Entity verification periods** | Create and edit [verification periods](https://docs.cortex.io/configure/settings/entity-settings/verification.md) for entities. | Admin | | **Execute Verify any entity** | Verify any entity, not only the entities the user owns. | Admin | | **Edit Relationship types** | Create, edit, and delete relationship types for entities. | Admin | ## Scorecards & Initiatives | Permission | What it allows | Default roles | | - | - | - | | **View Scorecards** | View Scorecards. | Viewer | | **Edit Scorecards** | Create, edit, and delete Scorecards. | Manager | | **Execute Scorecards re-evaluation** | Manually trigger a Scorecard evaluation from the UI. | Manager | | **View Scorecard exemptions** | View Scorecard exemptions. | User | | **Configure Scorecard exemptions** | Approve or revoke Scorecard exemptions. | Admin | | **View Initiatives** | View Initiatives. | Viewer | | **Edit Initiatives** | Create, edit, and delete Initiatives. | User | ## Reporting & Metrics | Permission | What it allows | Default roles | | - | - | - | | **View Scorecard reports** | View Scorecard reports. | Viewer | | **View CQL reports** | View CQL reports. | Viewer | | **Edit CQL reports** | Create, edit, and delete CQL reports. | User | ## OpEx | Permission | What it allows | Default roles | | - | - | - | | **View OpEx** | View OpEx Review reports, comments, and follow-ups. | Manager | | **Configure OpEx** | Configure OpEx Review, including each report's metrics and tabs. | Admin | | **Edit OpEx comments & Follow-ups** | Add, reply to, and resolve comments, and add, edit, complete, and delete follow-ups on an OpEx Review report. | Manager | > [!NOTE] > > **View OpEx** gives access to every OpEx Review report in your workspace. It can't be limited to a single team's report. To let users outside the default Manager and Admin roles comment on reports, create a custom role with both **View OpEx** and **Edit OpEx comments & Follow-ups**. ## Cortex AI | Permission | What it allows | Default roles | | - | - | - | | **Enable AI Chat** | Use Cortex AI chat, including within OpEx Review reports. This includes access to all metrics and Scorecard scores for any entity, even if they're hidden from the user elsewhere in Cortex. It doesn't apply to the Slack AI Assistant or the Cortex MCP. | Manager | ## Eng Intelligence | Permission | What it allows | Default roles | | - | - | - | | **View Eng Intelligence** | View Eng Intelligence metrics. Viewing data by individual users also requires **View User dimensions**. | Manager | | **Configure Eng Intelligence** | Configure Eng Intelligence settings. | Manager | | **View User dimensions** | Filter, group, and export Eng Intelligence data by individual users, such as PR authors and reviewers, deployers, assignees, and entity owners. | Manager | | **Edit Dashboards, Modules** | Edit Eng Intelligence dashboards and modules. | Manager | | **Configure Eng Intelligence custom metrics** | Create, edit, and delete Eng Intelligence custom metrics. | Manager | | **Edit Manage Eng Intelligence custom metrics data via API** | Create, edit, and delete custom metric data points through the API. | Manager | | **Configure User Labels** | Manage user labels for Eng Intelligence and assign them to users. | Manager | > [!NOTE] > > Custom roles that could already view Eng Intelligence were given **View User dimensions** automatically, so existing users keep the access they had. To limit a role to team- and entity-level Eng Intelligence data, turn off **View User dimensions** for that role. ## Workflows & Scaffolder | Permission | What it allows | Default roles | | - | - | - | | **View Workflows** | View Workflows. | User | | **View Workflow runs** | View Workflow runs. | User | | **Edit Workflows** | Create, edit, and delete Workflows. | Manager | | **Execute Workflow runs** | Run Workflows. | User | | **Configure Scaffolder templates** | Create, edit, and delete Scaffolder templates. | User | | **Execute Scaffolder** | Run the Scaffolder. | User | Some Workflows have extra restrictions on who can run them. See [Configuring Workflow settings](https://docs.cortex.io/streamline/workflows/configuring-workflow-settings.md). ## Plugins | Permission | What it allows | Default roles | | - | - | - | | **Edit Plugins** | Create, edit, and delete plugins. | Admin | | **Edit Plugin proxies** | Create, edit, and delete plugin proxies. | Admin | | **Configure Plugin appearance** | Manage where plugins appear in Cortex. | Admin | ## Tools | Permission | What it allows | Default roles | | - | - | - | | **Enable Relationship graph** | View and use the relationship graph. | Viewer | | **Configure Discovery audit events** | Ignore or import entities found in the discovery audit. | Admin | | **View Onboarding management** | View onboarding management. | Viewer | | **Enable Onboarding management** | Send onboarding management notifications. | Admin | | **Enable Query builder (basic)** | Create and run ad hoc CQL queries in the Query builder. | User | | **Enable Query builder (with 3rd party integrations)** | Create and run ad hoc CQL queries in the Query builder, including queries on third-party integration data. | Admin | > [!NOTE] > > **Enable Query builder (with third-party integrations)** is limited to Admins by default to avoid hitting third-party rate limits. You can add it to a custom role. ## Notifications | Permission | What it allows | Default roles | | - | - | - | | **View Notification logs** | View notification logs. | Admin | | **Execute Notification logs** | Resend a notification. | Admin | | **Configure Workspace notification settings** | Turn workspace notification settings on or off. | Admin | ## Settings | Permission | What it allows | Default roles | | - | - | - | | **Configure Settings** | Edit workspace settings, identity mappings, and integration configurations. | Admin | | **Configure Appearance settings** | Edit workspace appearance settings, including the logo, plugin placement, entity overview tabs and navigation order, and catalog sort order. | Admin | | **Configure Integrations** | Install, uninstall, and configure integrations. | Admin | ## Access management | Permission | What it allows | Default roles | | - | - | - | | **Edit Create secrets** | Create, edit, and delete [secrets](https://docs.cortex.io/configure/settings/api-keys/secrets.md) used in plugin proxies and other third-party API access. | Admin | | **Configure IP allowlist** | Restrict access to the Cortex app and public API to specific IP addresses. See [IP allowlist](https://docs.cortex.io/configure/settings/ip-allowlist.md). | Admin | | **Configure Open ID Connector & SCIM** | Manage OpenID Connect and SCIM settings for Auth0, Microsoft Entra ID, Google, and Okta. | Admin | | **View Roles** | View role definitions and the roles assigned to users and teams. | Admin | | **Configure Roles** | Create, edit, and delete custom roles, and assign roles to users and teams. | Admin | | **Configure Identity mappings** | Review and manage how team members are matched to external accounts, such as GitHub, Jira, PagerDuty, ClickUp, or Slack. See [Identity mappings](https://docs.cortex.io/configure/settings/managing-users/identity-mapping.md). | Manager | | **Edit API keys** | Create, edit, and delete Cortex [API keys](https://docs.cortex.io/configure/settings/api-keys). | Admin | | **Configure API key policy** | Configure the API key expiration policy. | Admin | | **View Breaking API changes** | View breaking API changes. | Admin | | **View Audit logs** | View [audit logs](https://docs.cortex.io/configure/settings/audit-logs.md). | Admin | | **View GitOps logs** | View GitOps logs. | User | ## Related topics - [Data Explorer reference](https://docs.cortex.io/improve/eng-intelligence/data-explorer/data-explorer-reference.md) - [Roles and permissions](https://docs.cortex.io/configure/settings/managing-users/permissioning.md) - [Custom roles](https://docs.cortex.io/configure/settings/managing-users/permissioning/custom-roles.md)