Overview

Users access platform areas and actions based on their assigned roles, known as role-based access control (RBAC). RBAC settings are unique to each workspace, so a user assigned to multiple workspaces can have a different role in each.

To manage user roles, go to Settings > Users. To create and manage custom roles, go to Settings > Security > Roles.

Preset roles

Torq offers the following preset roles:

Viewer: View-only access to the workspace.
Operator: Operational access without full creation rights.
Creator: Create and modify workflows and integrations.
Contributor: Creator permissions, plus publish workflows and run the Send Email step.
Owner: Full control over the workspace's assets and settings.
Interact Only: Access exclusively to Torq Interact, via the navigation sidebar or a direct URL.

The following roles are available in workspaces with case management enabled:

Cases Viewer: View-only access to case management.
Workspace Viewer: View-only access to the workspace, including automation and case management.
Cases Analyst: Work on cases without access to configuration settings.
Cases Contributor: Cases Analyst permissions, plus create and edit cases dashboards, and create and update triage context rules.

The following roles grant access to the Organization Management page, which covers all of the organization's workspaces:

Organization Manager: Manage organization resources and data.
Organization Viewer: View organization resources and metrics.

To set up an Organization Management page for your organization, contact Torq support. For details, see Organization Management: Manage Workspaces in Torq.

Organization-managed vs. workspace-managed roles

Custom roles in Torq can be managed at two levels:

Workspace roles: Created and managed within a single workspace. Only available in that workspace.
Organization-managed roles: Created centrally at the organization level and automatically available across all workspaces. Role IDs are consistent across workspaces, so shared workflows and integrations work without conflicts.

Use organization-managed roles for standard, repeatable access patterns. Use workspace roles only when local customization is needed.

In Settings > Security > Roles, the Scope column shows whether each role is Org-managed or Workspace, so you can tell at a glance where it is managed. Preset roles are labeled Org-managed. Organization-managed roles can be viewed and duplicated from a workspace but not edited locally. Any changes made at the organization level are automatically reflected across all workspaces.

For details on assigning organization-managed roles to users or mapping them via SSO, see Organization-managed Roles: Centralize Access Across Workspaces.

How permissions combine

Every scope grants access, and none removes it. A role can do exactly what its scopes allow, and adding a scope only ever widens access.

For each Torq page a role needs to access, also enable the relevant page under UI Access (for example, View the Workflows page).

To limit who can see a specific case, restrict the case itself. When a case's access mode is set to Restricted, only its Assignees, Reviewers, and Collaborators can view and edit it. Users with the bypass.case.access.restriction scope, included in Owner by default, can view and edit all cases regardless of restrictions. For details, see Restrict Cases Access: Ensure Information Confidentiality.

How to use

Find the scope you need

Preset roles cover most needs. When you build a custom role or a least-privilege service API key, use this table to find the scope behind a specific action. For how scopes stack together, see How permissions combine above.

I want to…	Required scope(s)	Notes
Run workflows	`playbook.execute`, `step.execute`
Create or edit workflows	`playbook.write`, `step.write`
Publish workflows	`playbook.publish`
Read or write global variables	`playbook.write`	Global variables are managed through workflow steps. The `workspace.variables.*` scopes do not apply to them.
Read or write workspace variables	`workspace.variables.read`, `workspace.variables.write`	These apply to workspace variables only.
Create or edit an integration	`integration.write`	Included in Creator, Contributor, Owner, and Organization Manager.
View step execution logs	`secret.read`	Shown in the role editor as Secrets Management > View custom secrets without access to their values.
View, create, publish, or run AI Agents	`agent.read`, `agent.write`, `agent.publish`, `agent.execute`	`agent.read` also controls access to the AI Agents page. Shown in the role editor under Agents Hub and Agents Orchestrator.
Submit a Torq Interact form	`interaction.submit`
Create or update cases	`cm.case.write`	Included in Creator, Contributor, Owner, Cases Analyst, and Cases Contributor.
Create or modify public case views	`cm.configuration.write`	Private views require only `cm.case.write`. Included in Owner only.
View or participate in Socrates conversations inside a case	`cm.assistant.read`, `cm.assistant.write`	`cm.assistant.read` alone gives a read-only view of the conversation. To start or join a conversation, or to assign Socrates to a case, include both scopes.
View or participate in Socrates Investigator conversations on the Socrates page	`socrates.investigations.read`, `socrates.investigations.write`	Applies only in workspaces with case management enabled.
View, create, or edit Socrates Builder conversations	`socrates.builder.read`, `socrates.builder.write`	`socrates.builder.read` alone is view-only. Builder acts with the user's own permissions, so anything outside the user's role fails with an error.
View or manage Socrates tools	`agentictools.read`, `agentictools.write`	Shown in the role editor under Socrates Tool Management. Included in Owner only.
View every cases dashboard, regardless of its visibility settings	`dashboard.bypass.access.restriction`	Shown in the role editor as Bypass cases dashboard restriction. Included in Owner only.
View triaged alerts and the triage dashboard	`triage.alert.read`, `triage.dashboard.view`	Available only in workspaces with Auto Triage enabled. Most preset roles include these scopes; see Preset role reference below. For a custom role, select them under the Auto Triage permission group in Settings > Security > Roles.
Confirm or reject verdicts, and manage triage context rules	`triage.alert.write`, `triage.context.read`, `triage.context.write`, `triage.context.delete`
Manage IP access rules	`security.config.read`, `security.config.write`
Share resources across workspaces	`resource.share`	Included in Owner and Organization Manager.
Read organization metrics through the API	`metrics.read`	Included in Organization Manager and Organization Viewer.

If a request is still denied after you add the scope, confirm that the role is assigned in the workspace where the action runs, and that any API key in use carries that role.

Create custom roles

You can create custom roles tailored to your organization's needs in two ways: via Settings or via workflow steps.

Create a role via Settings

Navigate: Go to Settings > Security > Roles.
Add a role: Click Create.
Name the role: Enter a unique and meaningful name and description.
Set permissions: Select the activities users with this role can perform. For each Torq page the role needs, also select the page under UI Access (for example, View the Workflows page).
To grant access to Context Graph, enable both View the Context Graph page and View Context Graph data.
Add the role: Click Add.

Preset roles cannot be edited or deleted, but can be duplicated as templates. Click the three-dot (...) menu and select Duplicate. Custom roles can be edited, duplicated, and deleted; they can only be deleted when not assigned to any user.

Organization-managed roles are available across all workspaces, so an organization-managed role that appears unused in one workspace might still be assigned to users in another. To see how many members and workspaces each organization-managed role is assigned to, go to Organization Management > Manage > Roles and check the Members and Workspaces columns.

Create a role via steps

Open a workflow: Go to Build > Workflows and create or open a workflow.
Find the steps: In the Builderbox, search role torq to find steps for creating, listing, updating, and deleting roles.
Configure the step: When using the Create Role or Update Role step, list the scopes for the role in the Scope names parameter.
Set the API key: Use an integration instance whose Torq service API key has the Owner role.

To view step execution logs, ensure the custom role has the Secrets Management > View custom secrets without access to their values permission.

Preset role reference

Each preset role below lists the Torq pages it can see and the permissions it grants, labeled as they appear in the role editor (Settings > Security > Roles) and listed in the same order as the role editor's permission groups.

Case-management permissions are listed separately under each role and apply only in workspaces with case management enabled.
Auto Triage permissions apply only in workspaces with Auto Triage enabled.

Viewer role

View-only access to the workspace.

Visible UI pages

Workflows
Integrations
Workspace Variables
Templates
AI Agents
Auto Triage
Activity Log
Insights
Cases Dashboards
Settings
Context Graph

Permissions

Permission	Scope
View the Templates page	`template.page.view`
View the Workflows page	`workflow.page.view`
View the Activity Log page	`activity.log.page.view`
View the Settings page	`settings.page.view`
View the Integrations page	`integration.page.view`
View the Insights page	`insights.page.view`
View the Workspace Variables page	`workspace.variables.page.view`
View activity log data	`event.read`
View agent definitions and configurations	`agent.read`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
View triage context rules	`triage.context.read`
View cases dashboards	`dashboard.read`
List and view integrations	`integration.read`
Submit Torq interactions	`interaction.submit`
Update onboarding status	`onboarding.write`
View custom secrets without access to their values	`secret.read`
Read account theme	`accounts.read`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
View step execution data	`step.read`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
View existing workspace variables	`workspace.variables.read`
View the Context Graph page	`context.graph.page.view`
View Context Graph data	`context.graph.read`

Case-management permissions

The Viewer role has no case-management permissions.

Operator role

Operational access without full creation rights.

Visible UI pages

Workflows
Integrations
Workspace Variables
Templates
Auto Triage
Activity Log
Insights
Settings
Context Graph

Permissions

Permission	Scope
View the Templates page	`template.page.view`
View the Workflows page	`workflow.page.view`
View the Activity Log page	`activity.log.page.view`
View the Settings page	`settings.page.view`
View the Integrations page	`integration.page.view`
View the Insights page	`insights.page.view`
View the Workspace Variables page	`workspace.variables.page.view`
View activity log data	`event.read`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
Confirm or reject verdicts and submit feedback on alerts	`triage.alert.write`
View triage context rules	`triage.context.read`
List and view integrations	`integration.read`
Submit Torq interactions	`interaction.submit`
Create Torq interactions	`interaction.write`
Update onboarding status	`onboarding.write`
View custom secrets without access to their values	`secret.read`
Read account theme	`accounts.read`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
View step execution data	`step.read`
Run steps	`step.execute`
Execute the Torq step Send Email	`email.send`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
Run workflows	`playbook.execute`
View existing workspace variables	`workspace.variables.read`
View the Context Graph page	`context.graph.page.view`
View Context Graph data	`context.graph.read`

Creator role

Create and modify workflows and integrations.

Visible UI pages

Workflows
Integrations
Workspace Variables
Templates
AI Agents
Auto Triage
Activity Log
Insights
Cases Dashboards
Settings
Context Graph

Permissions

Permission	Scope
View the Templates page	`template.page.view`
View the Workflows page	`workflow.page.view`
View the Activity Log page	`activity.log.page.view`
View the Settings page	`settings.page.view`
View the Integrations page	`integration.page.view`
View the Insights page	`insights.page.view`
View the Workspace Variables page	`workspace.variables.page.view`
View activity log data	`event.read`
View agent definitions and configurations	`agent.read`
Create new agent	`agent.write`
Publish agent across the platform	`agent.publish`
Trigger agent executions	`agent.execute`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
Confirm or reject verdicts and submit feedback on alerts	`triage.alert.write`
View triage context rules	`triage.context.read`
Create and update triage context rules	`triage.context.write`
View cases dashboards	`dashboard.read`
Create and edit cases dashboards	`dashboard.write`
List and view integrations	`integration.read`
Create integrations	`integration.write`
Submit Torq interactions	`interaction.submit`
Create Torq interactions	`interaction.write`
Update onboarding status	`onboarding.write`
View custom secrets without access to their values	`secret.read`
Create and update custom secrets	`secret.write`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
View step execution data	`step.read`
Run steps	`step.execute`
View list of workspace users	`user.read`
View personal API keys	`apikey.read`
Create personal API keys	`apikey.write`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
Run workflows	`playbook.execute`
Create workflows	`playbook.write`
Add steps to workflows	`step.write`
View existing workspace variables	`workspace.variables.read`
Create workspace variables	`workspace.variables.write`
View the Context Graph page	`context.graph.page.view`
View Context Graph data	`context.graph.read`

Case-management permissions

In workspaces with case management enabled, this role also sees the Cases, Runbooks, Observables, and Socrates pages, and has the following permissions:

Permission	Scope
View observables page	`observables.page.view`
View the Cases page	`cases.page.view`
List and view cases	`cm.case.read`
View cases assigned to others	`strict.cases.read.attr.assigned.to.others`
View unassigned cases	`strict.cases.read.attr.unassigned`
Create and update cases	`cm.case.write`
Delete cases	`cm.case.delete`
Modify the structure/lifecycle of cases	`cm.case.modify`
List and view observables	`cm.observable.read`
Create and update observables	`cm.observable.write`
Delete observables	`cm.observable.delete`
List and view runbooks	`cm.runbook.read`
Assistant (Socrates) read permission	`cm.assistant.read`
Assistant (Socrates) write permission	`cm.assistant.write`
View and read Socrates Investigations conversations	`socrates.investigations.read`
Edit and create new Socrates Investigations conversations	`socrates.investigations.write`

Contributor role

Creator permissions, plus publish workflows and run the Send Email step.

Visible UI pages

Workflows
Integrations
Workspace Variables
Templates
AI Agents
Auto Triage
Activity Log
Insights
Cases Dashboards
Settings
Context Graph

Permissions

Permission	Scope
View the Templates page	`template.page.view`
View the Workflows page	`workflow.page.view`
View the Activity Log page	`activity.log.page.view`
View the Settings page	`settings.page.view`
View the Integrations page	`integration.page.view`
View the Insights page	`insights.page.view`
View the Workspace Variables page	`workspace.variables.page.view`
View activity log data	`event.read`
View agent definitions and configurations	`agent.read`
Create new agent	`agent.write`
Publish agent across the platform	`agent.publish`
Trigger agent executions	`agent.execute`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
Confirm or reject verdicts and submit feedback on alerts	`triage.alert.write`
View triage context rules	`triage.context.read`
Create and update triage context rules	`triage.context.write`
View cases dashboards	`dashboard.read`
Create and edit cases dashboards	`dashboard.write`
List and view integrations	`integration.read`
Create integrations	`integration.write`
Submit Torq interactions	`interaction.submit`
Create Torq interactions	`interaction.write`
Update onboarding status	`onboarding.write`
View custom secrets without access to their values	`secret.read`
Create and update custom secrets	`secret.write`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
View step execution data	`step.read`
Run steps	`step.execute`
Execute the Torq step Send Email	`email.send`
View list of workspace users	`user.read`
View personal API keys	`apikey.read`
Create personal API keys	`apikey.write`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
Run workflows	`playbook.execute`
Create workflows	`playbook.write`
Add steps to workflows	`step.write`
Publish workflows	`playbook.publish`
View existing workspace variables	`workspace.variables.read`
Create workspace variables	`workspace.variables.write`
View the Context Graph page	`context.graph.page.view`
View Context Graph data	`context.graph.read`

Case-management permissions

In workspaces with case management enabled, this role also sees the Cases, Runbooks, Observables, and Socrates pages, and has the following permissions:

Permission	Scope
View observables page	`observables.page.view`
View the Cases page	`cases.page.view`
List and view cases	`cm.case.read`
View cases assigned to others	`strict.cases.read.attr.assigned.to.others`
View unassigned cases	`strict.cases.read.attr.unassigned`
Create and update cases	`cm.case.write`
Delete cases	`cm.case.delete`
Modify the structure/lifecycle of cases	`cm.case.modify`
List and view observables	`cm.observable.read`
Create and update observables	`cm.observable.write`
Delete observables	`cm.observable.delete`
List and view runbooks	`cm.runbook.read`
Assistant (Socrates) read permission	`cm.assistant.read`
Assistant (Socrates) write permission	`cm.assistant.write`
View and read Socrates Investigations conversations	`socrates.investigations.read`
Edit and create new Socrates Investigations conversations	`socrates.investigations.write`

Owner role

Full control over the workspace's assets and settings, including users and SSO.

Visible UI pages

Workflows
Integrations
Workspace Variables
Templates
AI Agents
Auto Triage
Activity Log
Insights
Cases Dashboards
Settings
Context Graph

Permissions

Permission	Scope
View the Templates page	`template.page.view`
View the Workflows page	`workflow.page.view`
View the Activity Log page	`activity.log.page.view`
View the Settings page	`settings.page.view`
View the Integrations page	`integration.page.view`
View the Insights page	`insights.page.view`
View the Workspace Variables page	`workspace.variables.page.view`
List audit logs	`audit.read`
View activity log data	`event.read`
View agent definitions and configurations	`agent.read`
Create new agent	`agent.write`
Publish agent across the platform	`agent.publish`
Trigger agent executions	`agent.execute`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
Confirm or reject verdicts and submit feedback on alerts	`triage.alert.write`
View triage context rules	`triage.context.read`
Create and update triage context rules	`triage.context.write`
Delete triage context rules	`triage.context.delete`
Re-ingest or drop alerts held after the ingestion cap is reached	`triage.alert.reingest`
View cases dashboards	`dashboard.read`
Create and edit cases dashboards	`dashboard.write`
Bypass cases dashboard restriction	`dashboard.bypass.access.restriction`
List and view integrations	`integration.read`
Create integrations	`integration.write`
Submit Torq interactions	`interaction.submit`
Create Torq interactions	`interaction.write`
Update onboarding status	`onboarding.write`
Share resources with other workspaces	`resource.share`
View custom secrets without access to their values	`secret.read`
Create and update custom secrets	`secret.write`
Read account theme	`accounts.read`
Create/Update account theme	`accounts.write`
View the organization settings	`organizations.read`
Deactivate/Reactivate a workspace, modify configurations	`organizations.write`
View IP access rules	`security.config.read`
Modify IP access rules	`security.config.write`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
List and view Socrates tools	`agentictools.read`
Create, update, and delete Socrates tools	`agentictools.write`
View step execution data	`step.read`
Run steps	`step.execute`
Execute the Torq step Send Email	`email.send`
View list of workspace users	`user.read`
Manage workspace users and configure SSO	`user.write`
View personal API keys	`apikey.read`
Create personal API keys	`apikey.write`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
Run workflows	`playbook.execute`
Create workflows	`playbook.write`
Add steps to workflows	`step.write`
Publish workflows	`playbook.publish`
View existing workspace variables	`workspace.variables.read`
Create workspace variables	`workspace.variables.write`
View the Context Graph page	`context.graph.page.view`
View Context Graph data	`context.graph.read`

The Owner role includes all Auto Triage scopes by default when Auto Triage is enabled for the workspace.

Case-management permissions

In workspaces with case management enabled, this role also sees the Cases, Runbooks, Observables, and Socrates pages, and has the following permissions:

Permission	Scope
View observables page	`observables.page.view`
View the Cases page	`cases.page.view`
List and view cases	`cm.case.read`
View cases assigned to others	`strict.cases.read.attr.assigned.to.others`
View unassigned cases	`strict.cases.read.attr.unassigned`
Create and update cases	`cm.case.write`
Delete cases	`cm.case.delete`
Modify the structure/lifecycle of cases	`cm.case.modify`
Make changes to case management configurations	`cm.configuration.write`
Bypass case access restriction	`bypass.case.access.restriction`
List and view observables	`cm.observable.read`
Create and update observables	`cm.observable.write`
Delete observables	`cm.observable.delete`
List and view runbooks	`cm.runbook.read`
Create and update runbooks	`cm.runbook.write`
Assistant (Socrates) read permission	`cm.assistant.read`
Assistant (Socrates) write permission	`cm.assistant.write`
View and read Socrates Investigations conversations	`socrates.investigations.read`
Edit and create new Socrates Investigations conversations	`socrates.investigations.write`

Interact Only role

Access exclusively to Torq Interact, via the navigation sidebar or a direct URL.

When an Interaction Flow starts mid-workflow, it is sent as a notification directly to the navigation sidebar. Only users granted access through email-based permissions receive the sidebar notification and can act on it.
When an Interaction Flow is trigger-initiated, authorized users can access it from the sidebar or through its permanent execution URL.

Visible UI pages

A standalone Interaction webpage or Torq app view that includes only the Interactions configured for sidebar access.

Permissions

Permission	Scope
Submit Torq interactions	`interaction.submit`
Read account theme	`accounts.read`
View list of workspace users	`user.read`

Interact Only users cannot access Settings > Security > Roles.

Cases Viewer role

View-only access to cases, runbooks, and observables. Available in workspaces with case management enabled.

Visible UI pages

Auto Triage
Cases
Runbooks
Observables
Socrates
Cases Dashboards
Context Graph

Permissions

Permission	Scope
View activity log data	`event.read`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
View triage context rules	`triage.context.read`
View cases dashboards	`dashboard.read`
List and view integrations	`integration.read`
Submit Torq interactions	`interaction.submit`
View step execution data	`step.read`
View list of workspace users	`user.read`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`

Case-management permissions

This role also has the following case-management permissions:

Permission	Scope
View observables page	`observables.page.view`
View the Cases page	`cases.page.view`
List and view cases	`cm.case.read`
View cases assigned to others	`strict.cases.read.attr.assigned.to.others`
View unassigned cases	`strict.cases.read.attr.unassigned`
List and view observables	`cm.observable.read`
List and view runbooks	`cm.runbook.read`
Assistant (Socrates) read permission	`cm.assistant.read`
View and read Socrates Investigations conversations	`socrates.investigations.read`
View the Context Graph page	`context.graph.page.view`
View Context Graph data	`context.graph.read`

Workspace Viewer role

View-only access to the workspace, including automation and case management resources. Does not include the Context Graph scopes.

Visible UI pages

Workflows
Integrations
Workspace Variables
Templates
AI Agents
Auto Triage
Cases
Runbooks
Observables
Socrates
Activity Log
Insights
Cases Dashboards
Settings

Permissions

Permission	Scope
View the Templates page	`template.page.view`
View the Workflows page	`workflow.page.view`
View the Activity Log page	`activity.log.page.view`
View the Settings page	`settings.page.view`
View the Integrations page	`integration.page.view`
View the Insights page	`insights.page.view`
View the Workspace Variables page	`workspace.variables.page.view`
View activity log data	`event.read`
View agent definitions and configurations	`agent.read`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
View triage context rules	`triage.context.read`
Sign URLs for download	`file.read`
View cases dashboards	`dashboard.read`
List and view integrations	`integration.read`
Submit Torq interactions	`interaction.submit`
Update onboarding status	`onboarding.write`
View custom secrets without access to their values	`secret.read`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
View step execution data	`step.read`
View list of workspace users	`user.read`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
View existing workspace variables	`workspace.variables.read`

Case-management permissions

This role also has the following case-management permissions:

Permission	Scope
View observables page	`observables.page.view`
View the Cases page	`cases.page.view`
List and view cases	`cm.case.read`
View cases assigned to others	`strict.cases.read.attr.assigned.to.others`
View unassigned cases	`strict.cases.read.attr.unassigned`
List and view observables	`cm.observable.read`
List and view runbooks	`cm.runbook.read`
Assistant (Socrates) read permission	`cm.assistant.read`
View and read Socrates Investigations conversations	`socrates.investigations.read`

Cases Analyst role

Work on cases, observables, and triaged alerts without access to case management configuration.

Visible UI pages

Auto Triage
Cases
Runbooks
Observables
Socrates
Cases Dashboards
Context Graph

Permissions

Permission	Scope
View activity log data	`event.read`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
Confirm or reject verdicts and submit feedback on alerts	`triage.alert.write`
View triage context rules	`triage.context.read`
View cases dashboards	`dashboard.read`
List and view integrations	`integration.read`
Submit Torq interactions	`interaction.submit`
Create Torq interactions	`interaction.write`
View step execution data	`step.read`
View list of workspace users	`user.read`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
Run workflows	`playbook.execute`
View the Context Graph page	`context.graph.page.view`
View Context Graph data	`context.graph.read`

Case-management permissions

This role also has the following case-management permissions:

Permission	Scope
View observables page	`observables.page.view`
View the Cases page	`cases.page.view`
List and view cases	`cm.case.read`
View cases assigned to others	`strict.cases.read.attr.assigned.to.others`
View unassigned cases	`strict.cases.read.attr.unassigned`
Create and update cases	`cm.case.write`
Delete cases	`cm.case.delete`
List and view observables	`cm.observable.read`
Create and update observables	`cm.observable.write`
Delete observables	`cm.observable.delete`
List and view runbooks	`cm.runbook.read`
Assistant (Socrates) read permission	`cm.assistant.read`
Assistant (Socrates) write permission	`cm.assistant.write`
View and read Socrates Investigations conversations	`socrates.investigations.read`
Edit and create new Socrates Investigations conversations	`socrates.investigations.write`

Cases Contributor role

Cases Analyst permissions, plus create and edit cases dashboards, and create and update triage context rules. Does not include the Context Graph scopes.

Visible UI pages

Auto Triage
Cases
Runbooks
Observables
Socrates
Cases Dashboards

Permissions

Permission	Scope
View activity log data	`event.read`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
Confirm or reject verdicts and submit feedback on alerts	`triage.alert.write`
View triage context rules	`triage.context.read`
Create and update triage context rules	`triage.context.write`
View cases dashboards	`dashboard.read`
Create and edit cases dashboards	`dashboard.write`
List and view integrations	`integration.read`
Submit Torq interactions	`interaction.submit`
Create Torq interactions	`interaction.write`
View step execution data	`step.read`
View list of workspace users	`user.read`
List existing workflows	`playbook.list`
View existing workflows	`playbook.get`
Run workflows	`playbook.execute`

Case-management permissions

This role also has the following case-management permissions:

Permission	Scope
View observables page	`observables.page.view`
View the Cases page	`cases.page.view`
List and view cases	`cm.case.read`
View cases assigned to others	`strict.cases.read.attr.assigned.to.others`
View unassigned cases	`strict.cases.read.attr.unassigned`
Create and update cases	`cm.case.write`
Delete cases	`cm.case.delete`
List and view observables	`cm.observable.read`
Create and update observables	`cm.observable.write`
Delete observables	`cm.observable.delete`
List and view runbooks	`cm.runbook.read`
Assistant (Socrates) read permission	`cm.assistant.read`
Assistant (Socrates) write permission	`cm.assistant.write`
View and read Socrates Investigations conversations	`socrates.investigations.read`
Edit and create new Socrates Investigations conversations	`socrates.investigations.write`

Organization Manager role

Manage organization resources and data from the Organization Management page.

Visible UI pages

Workspaces
Cases Dashboards
Auto Triage
Roles

Permissions

Permission	Scope
View the Settings page	`settings.page.view`
List audit logs	`audit.read`
List and view triage alerts	`triage.alert.read`
View triage dashboard and metrics	`triage.dashboard.view`
Re-ingest or drop alerts held after the ingestion cap is reached	`triage.alert.reingest`
View cases dashboards	`dashboard.read`
Create and edit cases dashboards	`dashboard.write`
Create integrations	`integration.write`
Read metrics	`metrics.read`
Get organization license	`get.organization.license`
Share resources with other workspaces	`resource.share`
Create and update custom secrets	`secret.write`
Read account theme	`accounts.read`
Create/Update account theme	`accounts.write`
View the organization settings	`organizations.read`
Deactivate/Reactivate a workspace, modify configurations	`organizations.write`
View IP access rules	`security.config.read`
Modify IP access rules	`security.config.write`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
View list of workspace users	`user.read`
Manage workspace users and configure SSO	`user.write`
View personal API keys	`apikey.read`
Create personal API keys	`apikey.write`
Create workflows	`playbook.write`
Create workspace variables	`workspace.variables.write`

Case-management permissions

This role also has the following case-management permission:

Permission	Scope
List and view cases	`cm.case.read`

Organization Viewer role

View organization resources and metrics on the Organization Management page.

Visible UI pages

Workspaces
Cases Dashboards

Permissions

Permission	Scope
View the Settings page	`settings.page.view`
List audit logs	`audit.read`
View cases dashboards	`dashboard.read`
Read metrics	`metrics.read`
Get organization license	`get.organization.license`
Read account theme	`accounts.read`
View the organization settings	`organizations.read`
View IP access rules	`security.config.read`
View and read Builder conversations	`socrates.builder.read`
Edit and create new Builder conversations	`socrates.builder.write`
View list of workspace users	`user.read`

Case-management permissions

This role also has the following case-management permission:

Permission	Scope
List and view cases	`cm.case.read`

Deprecated scopes

The following scopes have been deprecated. Some preset roles still include them; they are omitted from the tables above.

alert.read
alert.write
files.read (replaced by file.read)
files.write (replaced by file.write)
interaction.execute (replaced by interaction.write)
ip.access.rule.read (replaced by security.config.read)
ip.access.rule.write (replaced by security.config.write)

Torq Roles and Scopes: Manage Access and Permissions

Overview

Preset roles

Organization-managed vs. workspace-managed roles

How permissions combine

How to use

Find the scope you need

Create custom roles

Create a role via Settings

Create a role via steps

Preset role reference

Viewer role

Visible UI pages

Permissions

Case-management permissions

Operator role

Visible UI pages

Permissions

Creator role

Visible UI pages

Permissions

Case-management permissions

Contributor role

Visible UI pages

Permissions

Case-management permissions

Owner role

Visible UI pages

Permissions

Case-management permissions

Interact Only role

Visible UI pages

Permissions

Cases Viewer role

Visible UI pages

Permissions

Case-management permissions

Workspace Viewer role

Visible UI pages

Permissions

Case-management permissions

Cases Analyst role

Visible UI pages

Permissions

Case-management permissions

Cases Contributor role

Visible UI pages

Permissions

Case-management permissions

Organization Manager role

Visible UI pages

Permissions

Case-management permissions

Organization Viewer role

Visible UI pages

Permissions

Case-management permissions

Deprecated scopes