# Torq Roles and Scopes: Manage Access and Permissions # **Overview** Users access platform areas and actions based on their assigned roles, known as role-based access control (RBAC). Roles are assigned per workspace, so a user in multiple workspaces can have a different role in each. To manage user roles, go to **Settings > Users**. To create and manage custom roles, go to **Settings > Security > Roles**. ## **Preset roles** Torq offers the following preset roles: - **Viewer**: View-only access to the workspace. - **Operator**: Operational access without full creation rights. - **Creator**: Create and modify workflows and integrations. - **Contributor**: Creator permissions, plus publish workflows and run the **Send Email** step. - **Owner**: Full control over the workspace's assets and settings. - **Interact Only**: Access exclusively to [Torq Interact](https://kb.torq.io/en/articles/10532124-torq-interact-start-an-interaction-flow), via the navigation sidebar or a direct URL. The following roles are available in workspaces with case management enabled: - **Cases Viewer**: View-only access to case management. - **Workspace Viewer**: View-only access to the workspace, including automation and case management. - **Cases Analyst**: Work on cases without access to configuration settings. - **Cases Contributor**: Cases Analyst permissions, plus create and edit cases dashboards, and create and update triage context rules. The following roles grant access to the **Organization Management** page, which covers all of the organization's workspaces: - **Organization Manager**: Manage organization resources and data. - **Organization Viewer**: View organization resources and metrics. To set up an Organization Management page for your organization, contact Torq support. For details, see [Organization Management: Manage Workspaces in Torq](https://kb.torq.io/en/articles/9418412-organization-management-manage-workspaces-in-torq). ## **Organization-managed vs. workspace-managed roles** Custom roles in Torq can be managed at two levels: - **Workspace roles**: Created and managed within a single workspace. Only available in that workspace. - **Organization-managed roles**: Created centrally at the organization level and automatically available across all workspaces. Role IDs are consistent across workspaces, so shared workflows and integrations work without conflicts. Use organization-managed roles for standard, repeatable access patterns. Use workspace roles only when local customization is needed. In **Settings > Security > Roles**, the **Scope** column shows whether each role is **Org-managed** or **Workspace**, so you can tell at a glance where it is managed. Preset roles are labeled **Org-managed**. Organization-managed roles can be viewed and duplicated from a workspace but not edited locally. Any changes made at the organization level are automatically reflected across all workspaces. For details on assigning organization-managed roles to users or mapping them via SSO, see [Organization-managed Roles: Centralize Access Across Workspaces](https://kb.torq.io/en/articles/15413464-organization-managed-roles-centralize-access-across-workspaces). ## **How permissions combine** Every scope grants access, and none removes it. A role can do exactly what its scopes allow, and adding a scope only ever widens access. For each Torq page a role needs to access, also enable the relevant page under **UI Access** (for example, **View the Workflows page**). To limit who can see a specific case, restrict the case itself. When a case's access mode is set to **Restricted**, only its Assignees, Reviewers, and Collaborators can view and edit it. Users with the `bypass.case.access.restriction` scope, included in **Owner** by default, can view and edit all cases regardless of restrictions. For details, see [Restrict Cases Access: Ensure Information Confidentiality](https://kb.torq.io/en/articles/10748982-restrict-cases-access-ensure-information-confidentiality). # **How to use** ## **Find the scope you need** Preset roles cover most needs. When you build a custom role or a least-privilege service API key, use this table to find the scope behind a specific action. For how scopes stack together, see **How permissions combine** above. | **I want to…** | **Required scope(s)** | **Notes** | | ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Run workflows | `playbook.execute`, `step.execute` | | | Create or edit workflows | `playbook.write`, `step.write` | | | Publish workflows | `playbook.publish` | | | Read or write global variables | `playbook.write` | Global variables are managed through workflow steps. The `workspace.variables.*` scopes do not apply to them. | | Read or write workspace variables | `workspace.variables.read`, `workspace.variables.write` | These apply to workspace variables only. | | Create or edit an integration | `integration.write` | Included in **Creator**, **Contributor**, **Owner**, and **Organization Manager**. | | View step execution logs | `event.read` | | | View, create, publish, or run AI Agents | `agent.read`, `agent.write`, `agent.publish`, `agent.execute` | `agent.read` also controls access to the **AI Agents** page. | | Submit a Torq Interact form | `interaction.submit` | | | Create or update cases | `cm.case.write` | Included in **Creator**, **Contributor**, **Owner**, **Cases Analyst**, and **Cases Contributor**. | | Create or modify public case views | `cm.configuration.write` | Private views require only `cm.case.write`. Included in **Owner** only. | | View or participate in Socrates conversations inside a case | `cm.assistant.read`, `cm.assistant.write` | `cm.assistant.read` alone gives a read-only view of the conversation. To start or join a conversation, or to assign Socrates to a case, include both scopes. | | View or participate in Socrates Investigator conversations on the **Socrates** page | `socrates.investigations.read`, `socrates.investigations.write` | Applies only in workspaces with case management enabled. | | View, create, or edit Socrates Builder conversations | `socrates.builder.read`, `socrates.builder.write` | `socrates.builder.read` alone is view-only. Builder acts with the user's own permissions, so anything outside the user's role fails with an error. | | View or manage Socrates tools | `agentictools.read`, `agentictools.write` | | | View every cases dashboard, regardless of its visibility settings | `dashboard.bypass.access.restriction` | | | View triaged alerts and the triage dashboard | `triage.alert.read`, `triage.dashboard.view` | Available only in workspaces with Auto Triage enabled. Most preset roles include these scopes; see **Preset role reference** below. For a custom role, select them under the **Auto Triage** permission group in **Settings > Security > Roles**. | | Confirm or reject verdicts, and manage triage context rules | `triage.alert.write`, `triage.context.read`, `triage.context.write`, `triage.context.delete` | | | Manage IP access rules | `security.config.read`, `security.config.write` | | | Share resources across workspaces | `resource.share` | Included in **Owner** and **Organization Manager**. | | Read organization metrics through the API | `metrics.read` | Included in **Organization Manager** and **Organization Viewer**. | If a request is still denied after you add the scope, confirm that the role is assigned in the workspace where the action runs, and that any API key in use carries that role. ## **Create custom roles** You can create custom roles tailored to your organization's needs in two ways: via Settings or via workflow steps. ## **Create a role via Settings** 1. **Navigate**: Go to **Settings > Security > Roles**. 2. **Add a role**: Click **Create**. 3. **Name the role**: Enter a unique and meaningful name and description. 4. **Set permissions**: Select the activities users with this role can perform. For each Torq page the role needs, also select the page under **UI Access** (for example, **View the Workflows page**). To grant access to **Context Graph**, enable both View the **Context Graph** page and **View Context Graph** data. 5. **Add the role**: Click **Add**. Preset roles cannot be edited or deleted, but can be duplicated as templates. Click the three-dot (...) menu and select **Duplicate**. Workspace roles can be edited, duplicated, and deleted; they can only be deleted when not assigned to any user. Organization-managed roles are available across all workspaces, so an organization-managed role that appears unused in one workspace might still be assigned to users in another. To see how many members and workspaces each organization-managed role is assigned to, go to **Organization Management > Manage > Roles** and check the **Members** and **Workspaces** columns. ![](https://downloads.intercomcdn.com/i/o/eomhaz2o/2506657213/20986a91530b7cbb518a3022051d/image.png?expires=1793573100&signature=7098fea50c0024a10cd98f1b20376bdacf55269365a99ed176a8062d77ce15e1&req=diUnEM97moNeWvMW1HO4zQHS2tQyvy5opq%2FDP690IHpVswaekfSnhXAtnYD3%0AFKImfB2o1pBBIPSSNJQ%3D%0A) ## **Create a role via steps** 1. **Open a workflow**: Go to **Build > Workflows** and create or open a workflow. 2. **Find the steps**: In the **Builderbox**, search `role torq` to find steps for creating, listing, updating, and deleting roles. 3. **Configure the step**: When using the **Create Role** or **Update Role** step, list the scopes for the role in the **Scope names** parameter. 4. **Set the API key**: Use an integration instance whose Torq [service API key](https://kb.torq.io/en/articles/9145827-create-a-torq-api-key-enable-programmatic-access) has the **Owner** role. ![](https://downloads.intercomcdn.com/i/o/eomhaz2o/2506670549/4eef801ce3f498219eb3d40e312b/image.png?expires=1793573100&signature=7a1dde641c44d7eee2d7a9ee4a7a030a6a186d8e0bd5b5fd790ce47b30e947a2&req=diUnEM95nYRbUPMW1HO4zYVkIni27pDOrbSDgOg6sOobZM7dI%2BaRnExYjDOu%0AnIXujjgdwUQlsl3f%2FlE%3D%0A) # **Preset role reference** Each preset role below lists the Torq pages it can see and the permissions it grants, labeled as they appear in the role editor (**Settings > Security > Roles**). - Case-management permissions are listed separately under each role and apply only in workspaces with case management enabled. - Auto Triage permissions apply only in workspaces with Auto Triage enabled. ## **Viewer role** View-only access to the workspace. ### **Visible UI pages** - Workflows - Integrations - Workspace Variables - Templates - AI Agents - Auto Triage - Activity Log - Insights - Cases Dashboards - Settings - Context Graph ### **Permissions** | **Permission** | **Scope** | | -------------------------------------------------- | ------------------------------- | | View the Templates page | `template.page.view` | | View the Workflows page | `workflow.page.view` | | View the Activity Log page | `activity.log.page.view` | | View the Settings page | `settings.page.view` | | View the Integrations page | `integration.page.view` | | View the Insights page | `insights.page.view` | | View the Workspace Variables page | `workspace.variables.page.view` | | View activity log data | `event.read` | | View agent definitions and configurations | `agent.read` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | View triage context rules | `triage.context.read` | | View cases dashboards | `dashboard.read` | | List and view integrations | `integration.read` | | Submit Torq interactions | `interaction.submit` | | Update onboarding status | `onboarding.write` | | View custom secrets without access to their values | `secret.read` | | Read account theme | `accounts.read` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | View step execution data | `step.read` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | View existing workspace variables | `workspace.variables.read` | | View the Context Graph page | `context.graph.page.view` | | View Context Graph data | `context.graph.read` | ### **Case-management permissions** The Viewer role has no case-management permissions. ## **Operator role** Operational access without full creation rights. ### **Visible UI pages** - Workflows - Integrations - Workspace Variables - Templates - Auto Triage - Activity Log - Insights - Settings - Context Graph ### **Permissions** | **Permission** | **Scope** | | -------------------------------------------------------- | ------------------------------- | | View the Templates page | `template.page.view` | | View the Workflows page | `workflow.page.view` | | View the Activity Log page | `activity.log.page.view` | | View the Settings page | `settings.page.view` | | View the Integrations page | `integration.page.view` | | View the Insights page | `insights.page.view` | | View the Workspace Variables page | `workspace.variables.page.view` | | View activity log data | `event.read` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | Confirm or reject verdicts and submit feedback on alerts | `triage.alert.write` | | View triage context rules | `triage.context.read` | | List and view integrations | `integration.read` | | Submit Torq interactions | `interaction.submit` | | Create Torq interactions | `interaction.write` | | Update onboarding status | `onboarding.write` | | View custom secrets without access to their values | `secret.read` | | Read account theme | `accounts.read` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | View step execution data | `step.read` | | Run steps | `step.execute` | | Execute the Torq step Send Email | `email.send` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | Run workflows | `playbook.execute` | | View existing workspace variables | `workspace.variables.read` | | View the Context Graph page | `context.graph.page.view` | | View Context Graph data | `context.graph.read` | ## **Creator role** Create and modify workflows and integrations. ### **Visible UI pages** - Workflows - Integrations - Workspace Variables - Templates - AI Agents - Auto Triage - Activity Log - Insights - Cases Dashboards - Settings - Context Graph ### **Permissions** | **Permission** | **Scope** | | -------------------------------------------------------- | ------------------------------- | | View the Templates page | `template.page.view` | | View the Workflows page | `workflow.page.view` | | View the Activity Log page | `activity.log.page.view` | | View the Settings page | `settings.page.view` | | View the Integrations page | `integration.page.view` | | View the Insights page | `insights.page.view` | | View the Workspace Variables page | `workspace.variables.page.view` | | View activity log data | `event.read` | | View agent definitions and configurations | `agent.read` | | Create new agent | `agent.write` | | Publish agent across the platform | `agent.publish` | | Trigger agent executions | `agent.execute` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | Confirm or reject verdicts and submit feedback on alerts | `triage.alert.write` | | View triage context rules | `triage.context.read` | | Create and update triage context rules | `triage.context.write` | | View cases dashboards | `dashboard.read` | | Create and edit cases dashboards | `dashboard.write` | | List and view integrations | `integration.read` | | Create integrations | `integration.write` | | Submit Torq interactions | `interaction.submit` | | Create Torq interactions | `interaction.write` | | Update onboarding status | `onboarding.write` | | View custom secrets without access to their values | `secret.read` | | Create and update custom secrets | `secret.write` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | View step execution data | `step.read` | | Run steps | `step.execute` | | View list of workspace users | `user.read` | | View personal API keys | `apikey.read` | | Create personal API keys | `apikey.write` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | Run workflows | `playbook.execute` | | Create workflows | `playbook.write` | | Add steps to workflows | `step.write` | | View existing workspace variables | `workspace.variables.read` | | Create workspace variables | `workspace.variables.write` | | View the Context Graph page | `context.graph.page.view` | | View Context Graph data | `context.graph.read` | ### **Case-management permissions** In workspaces with case management enabled, this role also sees the Cases, Runbooks, Observables, and Socrates pages, and has the following permissions: | **Permission** | **Scope** | | --------------------------------------------------------- | ------------------------------------------- | | View observables page | `observables.page.view` | | View the Cases page | `cases.page.view` | | List and view cases | `cm.case.read` | | View cases assigned to others | `strict.cases.read.attr.assigned.to.others` | | View unassigned cases | `strict.cases.read.attr.unassigned` | | Create and update cases | `cm.case.write` | | Delete cases | `cm.case.delete` | | Modify the structure/lifecycle of cases | `cm.case.modify` | | List and view observables | `cm.observable.read` | | Create and update observables | `cm.observable.write` | | Delete observables | `cm.observable.delete` | | List and view runbooks | `cm.runbook.read` | | Assistant (Socrates) read permission | `cm.assistant.read` | | Assistant (Socrates) write permission | `cm.assistant.write` | | View and read Socrates Investigations conversations | `socrates.investigations.read` | | Edit and create new Socrates Investigations conversations | `socrates.investigations.write` | ## **Contributor role** Creator permissions, plus publish workflows and run the **Send Email** step. ### **Visible UI pages** - Workflows - Integrations - Workspace Variables - Templates - AI Agents - Auto Triage - Activity Log - Insights - Cases Dashboards - Settings - Context Graph ### **Permissions** | **Permission** | **Scope** | | -------------------------------------------------------- | ------------------------------- | | View the Templates page | `template.page.view` | | View the Workflows page | `workflow.page.view` | | View the Activity Log page | `activity.log.page.view` | | View the Settings page | `settings.page.view` | | View the Integrations page | `integration.page.view` | | View the Insights page | `insights.page.view` | | View the Workspace Variables page | `workspace.variables.page.view` | | View activity log data | `event.read` | | View agent definitions and configurations | `agent.read` | | Create new agent | `agent.write` | | Publish agent across the platform | `agent.publish` | | Trigger agent executions | `agent.execute` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | Confirm or reject verdicts and submit feedback on alerts | `triage.alert.write` | | View triage context rules | `triage.context.read` | | Create and update triage context rules | `triage.context.write` | | View cases dashboards | `dashboard.read` | | Create and edit cases dashboards | `dashboard.write` | | List and view integrations | `integration.read` | | Create integrations | `integration.write` | | Submit Torq interactions | `interaction.submit` | | Create Torq interactions | `interaction.write` | | Update onboarding status | `onboarding.write` | | View custom secrets without access to their values | `secret.read` | | Create and update custom secrets | `secret.write` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | View step execution data | `step.read` | | Run steps | `step.execute` | | Execute the Torq step Send Email | `email.send` | | View list of workspace users | `user.read` | | View personal API keys | `apikey.read` | | Create personal API keys | `apikey.write` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | Run workflows | `playbook.execute` | | Create workflows | `playbook.write` | | Add steps to workflows | `step.write` | | Publish workflows | `playbook.publish` | | View existing workspace variables | `workspace.variables.read` | | Create workspace variables | `workspace.variables.write` | | View the Context Graph page | `context.graph.page.view` | | View Context Graph data | `context.graph.read` | ### **Case-management permissions** In workspaces with case management enabled, this role also sees the Cases, Runbooks, Observables, and Socrates pages, and has the following permissions: | **Permission** | **Scope** | | --------------------------------------------------------- | ------------------------------------------- | | View observables page | `observables.page.view` | | View the Cases page | `cases.page.view` | | List and view cases | `cm.case.read` | | View cases assigned to others | `strict.cases.read.attr.assigned.to.others` | | View unassigned cases | `strict.cases.read.attr.unassigned` | | Create and update cases | `cm.case.write` | | Delete cases | `cm.case.delete` | | Modify the structure/lifecycle of cases | `cm.case.modify` | | List and view observables | `cm.observable.read` | | Create and update observables | `cm.observable.write` | | Delete observables | `cm.observable.delete` | | List and view runbooks | `cm.runbook.read` | | Assistant (Socrates) read permission | `cm.assistant.read` | | Assistant (Socrates) write permission | `cm.assistant.write` | | View and read Socrates Investigations conversations | `socrates.investigations.read` | | Edit and create new Socrates Investigations conversations | `socrates.investigations.write` | ## **Owner role** Full control over the workspace's assets and settings, including users and SSO. ### **Visible UI pages** - Workflows - Integrations - Workspace Variables - Templates - AI Agents - Auto Triage - Activity Log - Insights - Cases Dashboards - Settings - Context Graph ### **Permissions** | **Permission** | **Scope** | | ---------------------------------------------------------------- | ------------------------------------- | | View the Templates page | `template.page.view` | | View the Workflows page | `workflow.page.view` | | View the Activity Log page | `activity.log.page.view` | | View the Settings page | `settings.page.view` | | View the Integrations page | `integration.page.view` | | View the Insights page | `insights.page.view` | | View the Workspace Variables page | `workspace.variables.page.view` | | List audit logs | `audit.read` | | View activity log data | `event.read` | | View agent definitions and configurations | `agent.read` | | Create new agent | `agent.write` | | Publish agent across the platform | `agent.publish` | | Trigger agent executions | `agent.execute` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | Confirm or reject verdicts and submit feedback on alerts | `triage.alert.write` | | View triage context rules | `triage.context.read` | | Create and update triage context rules | `triage.context.write` | | Delete triage context rules | `triage.context.delete` | | Re-ingest or drop alerts held after the ingestion cap is reached | `triage.alert.reingest` | | View cases dashboards | `dashboard.read` | | Create and edit cases dashboards | `dashboard.write` | | Bypass cases dashboard restriction | `dashboard.bypass.access.restriction` | | List and view integrations | `integration.read` | | Create integrations | `integration.write` | | Submit Torq interactions | `interaction.submit` | | Create Torq interactions | `interaction.write` | | Update onboarding status | `onboarding.write` | | Share resources with other workspaces | `resource.share` | | View custom secrets without access to their values | `secret.read` | | Create and update custom secrets | `secret.write` | | Read account theme | `accounts.read` | | Create/Update account theme | `accounts.write` | | View the organization settings | `organizations.read` | | Deactivate/Reactivate a workspace, modify configurations | `organizations.write` | | View IP access rules | `security.config.read` | | Modify IP access rules | `security.config.write` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | List and view Socrates tools | `agentictools.read` | | Create, update, and delete Socrates tools | `agentictools.write` | | View step execution data | `step.read` | | Run steps | `step.execute` | | Execute the Torq step Send Email | `email.send` | | View list of workspace users | `user.read` | | Manage workspace users and configure SSO | `user.write` | | View personal API keys | `apikey.read` | | Create personal API keys | `apikey.write` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | Run workflows | `playbook.execute` | | Create workflows | `playbook.write` | | Add steps to workflows | `step.write` | | Publish workflows | `playbook.publish` | | View existing workspace variables | `workspace.variables.read` | | Create workspace variables | `workspace.variables.write` | | View the Context Graph page | `context.graph.page.view` | | View Context Graph data | `context.graph.read` | The Owner role includes all Auto Triage scopes by default when Auto Triage is enabled for the workspace. ### **Case-management permissions** In workspaces with case management enabled, this role also sees the Cases, Runbooks, Observables, and Socrates pages, and has the following permissions: | **Permission** | **Scope** | | --------------------------------------------------------- | ------------------------------------------- | | View observables page | `observables.page.view` | | View the Cases page | `cases.page.view` | | List and view cases | `cm.case.read` | | View cases assigned to others | `strict.cases.read.attr.assigned.to.others` | | View unassigned cases | `strict.cases.read.attr.unassigned` | | Create and update cases | `cm.case.write` | | Delete cases | `cm.case.delete` | | Modify the structure/lifecycle of cases | `cm.case.modify` | | Make changes to case management configurations | `cm.configuration.write` | | Bypass case access restriction | `bypass.case.access.restriction` | | List and view observables | `cm.observable.read` | | Create and update observables | `cm.observable.write` | | Delete observables | `cm.observable.delete` | | List and view runbooks | `cm.runbook.read` | | Create and update runbooks | `cm.runbook.write` | | Assistant (Socrates) read permission | `cm.assistant.read` | | Assistant (Socrates) write permission | `cm.assistant.write` | | View and read Socrates Investigations conversations | `socrates.investigations.read` | | Edit and create new Socrates Investigations conversations | `socrates.investigations.write` | ## **Interact Only role** Access exclusively to Torq Interact, via the navigation sidebar or a direct URL. - When an Interaction Flow starts mid-workflow, it is sent as a notification directly to the navigation sidebar. Only users granted access through email-based permissions receive the sidebar notification and can act on it. - When an Interaction Flow is trigger-initiated, authorized users can access it from the sidebar or through its permanent execution URL. ### **Visible UI pages** A standalone Interaction webpage or Torq app view that includes only the Interactions configured for sidebar access. ### **Permissions** | **Permission** | **Scope** | | ---------------------------- | -------------------- | | Submit Torq interactions | `interaction.submit` | | Read account theme | `accounts.read` | | View list of workspace users | `user.read` | Interact Only users cannot access **Settings > Security > Roles**. ## **Cases Viewer role** View-only access to cases, runbooks, and observables. Available in workspaces with case management enabled. ### **Visible UI pages** - Auto Triage - Cases - Runbooks - Observables - Socrates - Cases Dashboards - Context Graph ### **Permissions** | **Permission** | **Scope** | | --------------------------------- | ----------------------- | | View activity log data | `event.read` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | View triage context rules | `triage.context.read` | | View cases dashboards | `dashboard.read` | | List and view integrations | `integration.read` | | Submit Torq interactions | `interaction.submit` | | View step execution data | `step.read` | | View list of workspace users | `user.read` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | ### **Case-management permissions** This role also has the following case-management permissions: | **Permission** | **Scope** | | --------------------------------------------------- | ------------------------------------------- | | View observables page | `observables.page.view` | | View the Cases page | `cases.page.view` | | List and view cases | `cm.case.read` | | View cases assigned to others | `strict.cases.read.attr.assigned.to.others` | | View unassigned cases | `strict.cases.read.attr.unassigned` | | List and view observables | `cm.observable.read` | | List and view runbooks | `cm.runbook.read` | | Assistant (Socrates) read permission | `cm.assistant.read` | | View and read Socrates Investigations conversations | `socrates.investigations.read` | | View the Context Graph page | `context.graph.page.view` | | View Context Graph data | `context.graph.read` | ## **Workspace Viewer role** View-only access to the workspace, including automation and case management resources. Does not include the Context Graph scopes. ### **Visible UI pages** - Workflows - Integrations - Workspace Variables - Templates - AI Agents - Auto Triage - Cases - Runbooks - Observables - Socrates - Activity Log - Insights - Cases Dashboards - Settings ### **Permissions** | **Permission** | **Scope** | | -------------------------------------------------- | ------------------------------- | | View the Templates page | `template.page.view` | | View the Workflows page | `workflow.page.view` | | View the Activity Log page | `activity.log.page.view` | | View the Settings page | `settings.page.view` | | View the Integrations page | `integration.page.view` | | View the Insights page | `insights.page.view` | | View the Workspace Variables page | `workspace.variables.page.view` | | View activity log data | `event.read` | | View agent definitions and configurations | `agent.read` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | View triage context rules | `triage.context.read` | | Sign URLs for download | `file.read` | | View cases dashboards | `dashboard.read` | | List and view integrations | `integration.read` | | Submit Torq interactions | `interaction.submit` | | Update onboarding status | `onboarding.write` | | View custom secrets without access to their values | `secret.read` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | View step execution data | `step.read` | | View list of workspace users | `user.read` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | View existing workspace variables | `workspace.variables.read` | ### **Case-management permissions** This role also has the following case-management permissions: | **Permission** | **Scope** | | --------------------------------------------------- | ------------------------------------------- | | View observables page | `observables.page.view` | | View the Cases page | `cases.page.view` | | List and view cases | `cm.case.read` | | View cases assigned to others | `strict.cases.read.attr.assigned.to.others` | | View unassigned cases | `strict.cases.read.attr.unassigned` | | List and view observables | `cm.observable.read` | | List and view runbooks | `cm.runbook.read` | | Assistant (Socrates) read permission | `cm.assistant.read` | | View and read Socrates Investigations conversations | `socrates.investigations.read` | ## **Cases Analyst role** Work on cases, observables, and triaged alerts without access to case management configuration. ### **Visible UI pages** - Auto Triage - Cases - Runbooks - Observables - Socrates - Cases Dashboards - Context Graph ### **Permissions** | **Permission** | **Scope** | | -------------------------------------------------------- | ------------------------- | | View activity log data | `event.read` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | Confirm or reject verdicts and submit feedback on alerts | `triage.alert.write` | | View triage context rules | `triage.context.read` | | View cases dashboards | `dashboard.read` | | List and view integrations | `integration.read` | | Submit Torq interactions | `interaction.submit` | | Create Torq interactions | `interaction.write` | | View step execution data | `step.read` | | View list of workspace users | `user.read` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | Run workflows | `playbook.execute` | | View the Context Graph page | `context.graph.page.view` | | View Context Graph data | `context.graph.read` | ### **Case-management permissions** This role also has the following case-management permissions: | **Permission** | **Scope** | | --------------------------------------------------------- | ------------------------------------------- | | View observables page | `observables.page.view` | | View the Cases page | `cases.page.view` | | List and view cases | `cm.case.read` | | View cases assigned to others | `strict.cases.read.attr.assigned.to.others` | | View unassigned cases | `strict.cases.read.attr.unassigned` | | Create and update cases | `cm.case.write` | | Delete cases | `cm.case.delete` | | List and view observables | `cm.observable.read` | | Create and update observables | `cm.observable.write` | | Delete observables | `cm.observable.delete` | | List and view runbooks | `cm.runbook.read` | | Assistant (Socrates) read permission | `cm.assistant.read` | | Assistant (Socrates) write permission | `cm.assistant.write` | | View and read Socrates Investigations conversations | `socrates.investigations.read` | | Edit and create new Socrates Investigations conversations | `socrates.investigations.write` | ## **Cases Contributor role** Cases Analyst permissions, plus create and edit cases dashboards, and create and update triage context rules. Does not include the Context Graph scopes. ### **Visible UI pages** - Auto Triage - Cases - Runbooks - Observables - Socrates - Cases Dashboards ### **Permissions** | **Permission** | **Scope** | | -------------------------------------------------------- | ----------------------- | | View activity log data | `event.read` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | Confirm or reject verdicts and submit feedback on alerts | `triage.alert.write` | | View triage context rules | `triage.context.read` | | Create and update triage context rules | `triage.context.write` | | View cases dashboards | `dashboard.read` | | Create and edit cases dashboards | `dashboard.write` | | List and view integrations | `integration.read` | | Submit Torq interactions | `interaction.submit` | | Create Torq interactions | `interaction.write` | | View step execution data | `step.read` | | View list of workspace users | `user.read` | | List existing workflows | `playbook.list` | | View existing workflows | `playbook.get` | | Run workflows | `playbook.execute` | ### **Case-management permissions** This role also has the following case-management permissions: | **Permission** | **Scope** | | --------------------------------------------------------- | ------------------------------------------- | | View observables page | `observables.page.view` | | View the Cases page | `cases.page.view` | | List and view cases | `cm.case.read` | | View cases assigned to others | `strict.cases.read.attr.assigned.to.others` | | View unassigned cases | `strict.cases.read.attr.unassigned` | | Create and update cases | `cm.case.write` | | Delete cases | `cm.case.delete` | | List and view observables | `cm.observable.read` | | Create and update observables | `cm.observable.write` | | Delete observables | `cm.observable.delete` | | List and view runbooks | `cm.runbook.read` | | Assistant (Socrates) read permission | `cm.assistant.read` | | Assistant (Socrates) write permission | `cm.assistant.write` | | View and read Socrates Investigations conversations | `socrates.investigations.read` | | Edit and create new Socrates Investigations conversations | `socrates.investigations.write` | ## **Organization Manager role** Manage organization resources and data from the **Organization Management** page. ### **Visible UI pages** - Workspaces - Cases Dashboards - Auto Triage - Roles ### **Permissions** | **Permission** | **Scope** | | ---------------------------------------------------------------- | --------------------------- | | View the Settings page | `settings.page.view` | | List audit logs | `audit.read` | | List and view triage alerts | `triage.alert.read` | | View triage dashboard and metrics | `triage.dashboard.view` | | Re-ingest or drop alerts held after the ingestion cap is reached | `triage.alert.reingest` | | View cases dashboards | `dashboard.read` | | Create and edit cases dashboards | `dashboard.write` | | Create integrations | `integration.write` | | Read metrics | `metrics.read` | | Get organization license | `get.organization.license` | | Share resources with other workspaces | `resource.share` | | Create and update custom secrets | `secret.write` | | Read account theme | `accounts.read` | | Create/Update account theme | `accounts.write` | | View the organization settings | `organizations.read` | | Deactivate/Reactivate a workspace, modify configurations | `organizations.write` | | View IP access rules | `security.config.read` | | Modify IP access rules | `security.config.write` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | View list of workspace users | `user.read` | | Manage workspace users and configure SSO | `user.write` | | View personal API keys | `apikey.read` | | Create personal API keys | `apikey.write` | | Create workflows | `playbook.write` | | Create workspace variables | `workspace.variables.write` | ### **Case-management permissions** This role also has the following case-management permission: | **Permission** | **Scope** | | ------------------- | -------------- | | List and view cases | `cm.case.read` | ## **Organization Viewer role** View organization resources and metrics on the **Organization Management** page. ### **Visible UI pages** - Workspaces - Cases Dashboards ### **Permissions** | **Permission** | **Scope** | | ----------------------------------------- | -------------------------- | | View the Settings page | `settings.page.view` | | List audit logs | `audit.read` | | View cases dashboards | `dashboard.read` | | Read metrics | `metrics.read` | | Get organization license | `get.organization.license` | | Read account theme | `accounts.read` | | View the organization settings | `organizations.read` | | View IP access rules | `security.config.read` | | View and read Builder conversations | `socrates.builder.read` | | Edit and create new Builder conversations | `socrates.builder.write` | | View list of workspace users | `user.read` | ### **Case-management permissions** This role also has the following case-management permission: | **Permission** | **Scope** | | ------------------- | -------------- | | List and view cases | `cm.case.read` | # **Deprecated scopes** The following scopes have been deprecated. Some preset roles still include them; they are omitted from the tables above. - `alert.read` - `alert.write` - `files.read` (replaced by `file.read`) - `files.write` (replaced by `file.write`) - `interaction.execute` (replaced by `interaction.write`) - `ip.access.rule.read` (replaced by `security.config.read`) - `ip.access.rule.write` (replaced by `security.config.write`)