Roles

Custom roles let you define precisely which areas of the Tenable One AI Exposure Console a user or group can access. You create a role by selecting individual permissions from a list of Console modules, then assign it to users or groups in User Management.

Use custom roles when the built-in roles (Viewer, Collaborator, Administrator) grant more or less access than a user needs. For example, you can create a read-only compliance role without granting the broader access that Collaborator includes. For information about built-in roles and the permissions they include, see Built-in Roles and Permissions.

Common Use Cases

The following table shows typical custom roles and the minimum permissions required to support them.

Use Case	Who It Is For	Minimum Permissions
Audit Viewer	Compliance officers or external auditors who need to review Console activity without access to other product areas.	Audit — View
AI Conversations Viewer	Users who need visibility into the complete conversation history. Without this role, users can only view evidence snippets in AI Activity Detections.	AI Conversations — View
Reports Viewer	Executive stakeholders or compliance reviewers who need to generate and download reports without broader Console access.	Reports — View
Compliance Viewer	Users who monitor compliance benchmark status and scores without the ability to create or modify compliance rules.	Compliance — View
Read-Only Findings Reviewer	Stakeholders who need visibility into risk findings, threats, and vulnerabilities without the ability to respond to or modify them.	Risks — View Threats — View Vulnerabilities — View
JIT Visibility	Users who need to view JIT eligibility configurations and audit events via the Console without managing eligibilities or holding the JIT Administrator role.	JIT - Eligibility — View JIT - Audit — View
Automation Manager	DevSecOps team members or integration owners who need to create and manage automation rules without full Administrator access.	Automation — View Automation — Manage

Create a Custom Role

To create a custom role:

In the AI Exposure, navigate to Settings > Access Management > Roles.
Click + Create Role.
In the Name box, type a name for the role.
In the Permissions section, select the checkboxes for the modules you want to include.

To view sub-permissions for a module, click the expand arrow. For example, Inventory includes separate View and Manage sub-permissions.

Some permissions are automatically selected and marked Required because they support other selected permissions. Hover over the Required badge to see which selected permissions depend on it.
Click Create.

Edit a Custom Role

Edit a custom role to change the name or permission mapping of the role.

To edit a custom role:

In the AI Exposure Console, navigate to Settings > Access Management > Roles.
In the roles list, click the options menu next to the role you want to edit.
Click Edit.
Update the role name or permissions as needed.
Click Save.

Duplicate a Role

Duplicate a built-in or custom role to create a new role based on existing permission mappings.

In the AI Exposure Console, navigate to Settings > Access Management > Roles.
In the roles list, click the options menu next to the role you want to edit.
Click Duplicate.
Update the role name or permissions as needed.
Click Create.

Delete a Custom Role

Deleting a custom role will immediately revoke permissions from any users who have been granted it.

To delete a custom role:

In the AI Exposure Console, navigate to Settings > Access Management > Roles.
In the roles list, click the options menu next to the role you want to delete.
Click Delete.
In the confirmation window, click Delete.

Available Permissions

The following table lists the permissions available when creating or editing a custom role. Each top-level permission maps to a module in the Console. Where a permission includes sub-permissions, selecting the parent does not automatically select its children. You must select each sub-permission individually.

Permission	What It Controls
Dashboards	View — See dashboards and widget data. Manage — Create, edit, and delete dashboards. Includes separate sub-permissions for Private Dashboards and Public Dashboards.
Inventory	View — See cloud resources, IAM principals, access graph, network graph, and entity details. Manage — Add labels to resources, mark resources as sensitive, and set custom property values.
Workload Resources	Scan Now — Request an on-demand scan for a workload resource.
Data Resources	Scan — Request an on-demand scan for a data resource.
Events	View — See cloud events and Kubernetes admission controller events.
AI Conversations	View — See the content of AI conversations.
CI/CD Scans	View — See security scan results for container images, code pipelines, and pull requests.
Queries	View — See and run saved queries. Manage — Create, edit, and delete queries. Includes separate sub-permissions for Private Queries and Public Queries.
Findings	View — See AI posture findings. Manage — Includes the following sub-permissions: Comment (add and delete comments on findings) Status — Update the finding state to Open or Closed (To ignore findings, use the Exclusions > Manage permission) Star (star findings) Remediation — Trigger automated cloud remediation. Share (create Jira issues and ServiceNow incidents from findings).
AI Activity Risks	View — See activity detections and activity issues. Manage — Includes the following sub-permissions: Comment (add and delete comments) Share (create Jira issues and ServiceNow incidents from threats) Star (star threats) Status (change threat status)
Threat Detections	View — See threat detection findings. Manage — Includes the following sub-permissions: Comment (add and delete comments); Status (change threat status); Share (create Jira issues and ServiceNow incidents from threats); Star (star threats).
Vulnerabilities	View — See vulnerability findings, packages, and CVE details.
Malicious Files	View — See malicious file detections.
Policies	View — See built-in and custom risk policies. Manage — Create and delete custom risk policies. Enable and disable built-in policies.
Exclusions	Applies to risk/finding exclusions only. Data/workload exclusions are managed through the Settings permission. View — See risk exclusions. Manage — Create, update, and delete risk exclusions, and manually ignore individual findings.
Automation	View — See automation rules. Manage — Create, update, and delete automation rules.
Reports	View — See, generate, and download reports. Manage — Schedule and delete reports.
Compliance	View — See compliance benchmarks and scores. Manage — Create and delete custom compliance rules; enable and disable built-in compliance benchmarks.
Settings	Covers the Access Management, Inventory, Security, and Licensing pages in Settings, including all child pages. View — See user and role assignments and licensing data. Manage — Add, edit, and delete user and group role assignments, and create or update custom roles.
Settings - Organization	View — See projects and the account and folder hierarchy. Manage — Create, update, and delete projects, and organize the account and folder hierarchy.
Settings - Integrations	View — See configured integrations. Manage — Create, update, and delete integrations. Includes connecting Kubernetes clusters, which is accessible via Explore > Inventory > Kubernetes Clusters but is controlled by this permission, not the Inventory permission.
Settings - Audit	View — See the Console audit event log.
JIT - Eligibility	View — See JIT eligibility configurations. Manage — Create, update, and delete JIT eligibilities.
JIT - Audit	View — See JIT access request audit events.

Permission Dependencies

Some permissions are automatically required when you select others. Selecting Dashboards, for example, automatically requires Inventory (View), Queries, Risks, and Vulnerabilities. Hover over the Required badge on any auto-selected permission to see which permissions depend on it.