Where are Scan Permissions Configured?

There are 2 main locations where these configurations take place:

1. Role Level (The Primary Location)

This is where you define the baseline permissions for groups of users.

• Path: User Management -> Roles tab -> Select a Role -> Manage Permissions.
• What is configured here:
• • Target Permissions: You can grant a role access to specific targets (e.g., "Finance SharePoint") or all targets. If a role has "None" for a target, users in that role cannot see or run scans against it.
  • Tag Permissions: You can grant access based on Agent Tags or Target Tags. This is the most scalable way to manage permissions (e.g., "This role can manage all agents tagged with 'London'").
  • Result Permissions: Determines if the role can view the findings from those scans and whether they can "Unmask" (see the raw sensitive data).

2. Individual User Level (Overrides)

You can set specific permissions for a single user that differ from their assigned role.

• Path: User Management -> Users tab -> Select a User -> Edit Permissions.
• What is configured here:
• • Individual overrides for specific Targets or Tags. These settings always take precedence over the role-level settings.

Key Permission Concepts to Remember

• Owner Permissions: These are not configured by an admin. They are automatically assigned to the user who created the Target or Tag. Owners always have full permissions, and currently, these cannot be overridden by role settings.
• Admin Role: Users assigned the default "Admin" role have full permissions across the entire platform. Their permissions cannot be modified or restricted.
• Visibility vs. Execution: Being able to "see" a scan (View permission) is different from being able to "run" a scan (Manage/Full permission). If a user can see a scan but the "Run Scan Now" button is missing, their permission level for the associated Targets or Tags is likely set to "View" instead of "Manage."
• Target vs. Agent Permissions: To run a scan, a user typically needs permissions for both the Target (the data source) and the Agent (the worker) involved in the scan definition.