# Per-Feature Access Control Details

## ASM (Assets)

- Assets are bound to 0 (global assets) or many (project assets) projects.
- To create, edit, or delete an asset, the user must have the "Edit Assets" permission on the project(s) the asset is bound to.
- To edit the projects an asset is bound to, the user must have a global "Admin" permission as this operation alters the access control of the asset.

## Tags

- Tags are global and can be attached to assets.
- To attach a tag to a resource, the user must have the relevant resource-edit permission on the project the resource is bound to (for example, "Edit Assets" for an asset).
- To create, edit, or delete a tag itself, the user must have the "Tag Edition" permission.

> [!WARNING]
>
> Tags organize resources. Access permissions come from role bindings and project membership, independently of tags.

## Business Logic Aware DAST (Profiles, Scans, Custom Rules)

- Profiles are bound to the projects the assets they are linked to are bound to.
- To create or edit an individual profile, the user must have "Edit Profiles" or "Edit Assets" on its scope.
- Bulk updates to profile tags or schedules require "Edit Assets" on the profiles' scope.
- Deleting profiles requires "Admin" on the profiles' scope.
- To create, edit, or delete a custom rule, the user must have the "Edit Custom Rules" permission.
- To edit the projects a profile is bound to, the user must have "Admin" scoped to the destination projects or a global "Admin" binding. Clearing the project list requires global "Admin".

## Issues

- Changing issue status, severity, or tags requires "Edit Assets" on the issues' scope.

## Scans

- Running a scan requires "Edit Profiles" on the profile's scope.

## Private Locations

- Creating or deleting a Private Location requires global "Admin".

## Saved Views

- Managing saved integration views requires "Edit Integrations". Other saved views require "Edit Assets".

## Vault Variables

- Creating, editing, or deleting vault variables and linking vaults requires "Manage Vault Variables" or "Admin" through a global role binding. See [Variables](<https://docs.escape.tech/documentation/platform/variables-vault/index.md>).

## Reporting

- Reporting is global and can be viewed by any user.
- The data we gather to generate the report depends on the projects the user has access to.
- To manage reporting settings, the user must have a global "Manage Reporting" permission.
- Creating a report export requires a role in the organization; the report respects the user's resource access.

## Workflows

- Workflows are global and can be viewed by any user.
- To create, edit, or delete a workflow, the user must have the "Edit Workflows" permission on the project(s) the workflow is bound to.
- To edit the projects a workflow is bound to, the user must hold "Edit Workflows" or "Admin" through a global role binding.

> [!WARNING]
>
> Attaching a workflow to a project will impact the resources against which the workflow will be executed. Workflows in a project will only apply to resources located in the project.

## Integrations

- Integrations are bound to 0 (global integrations) or many (project integrations) projects.
- To create, edit, or delete an integration, the user must have the "Edit Integrations" permission on the project(s) the integration is bound to.
- To edit the projects an integration is bound to, the user must hold "Edit Integrations" or "Admin" through a global role binding.

> [!WARNING]
>
> Attaching an integration to a project will impact the resources that will be discovered by the integration. Resources discovered by an integration in a project will automatically be bound to the project. Integrations in a project can only be used by workflows in the same project.