Understanding Role Permissions

Akto uses a role-based access control system to manage user permissions. Each role has a specific set of permissions that determine what actions a user can perform within the platform.

Roles Are Assigned Per Product

Akto has four products: API Security, Atlas, Argus, and DAST. Roles are assigned per product, so a user's role in one product is independent of their role in another. For example, the same user could hold:

• Security Engineer in Argus

• Admin in API Security

• Guest in DAST

• No access at all in Atlas, if that product isn't relevant to their work

Role Types

Role	Description
Admin	Full system administrator with complete control over all features. Can manage users, settings, and perform all administrative actions.
Security Engineer	Primary role for red teaming and analysis. Has full access to scanning features and agentic Inventory.
Threat Engineer	Superset of Security Engineer with Threat Protection access added. Can edit and view Threat Protection in addition to everything a Security Engineer can access.
Threat Viewer	Superset of Security Engineer with Threat Protection read access added. Can view (but not edit) Threat Protection in addition to everything a Security Engineer can access.
Developer	Technical role focused on integration and development. Has view access to security features and can manage integration settings.
Guest	Basic viewer role with view-only access to most features. Can view but cannot modify Agentic Inventory.

Every role above, including Threat Engineer and Threat Viewer, is assigned separately within each of the four products: API Security, Atlas, Argus, and DAST.

Role Hierarchy

Admin
  └── Security Engineer
       ├── Threat Engineer   (Security Engineer + Threat Protection edit)
       ├── Threat Viewer     (Security Engineer + Threat Protection view)
       └── Developer
            └── Guest

Threat Engineer and Threat Viewer are built on top of Security Engineer: they carry every permission Security Engineer has, plus Threat Protection access, so despite sitting at the same level in this tree, they have more access than a plain Security Engineer.

Feature Access & Descriptions

Legend

✅ Edit & View 👁️ View Only

Feature	Admin	Security Engineer	Threat Engineer	Threat Viewer	Developer	Guest	Description
Agentic Inventory
Agentic Collections	✅	✅	✅	✅	👁️	👁️	Manage and organize Agentic components
Traffic Filters	✅	✅	✅	✅	👁️	👁️	Configure agentic traffic filtering rules
Sample Data	✅	✅	✅	✅	👁️	👁️	Access to agentic sample data
Tags	✅	✅	✅	✅	👁️	👁️	Organize resources with tags
Threat Protection
Threat Protection	✅		✅	👁️			Configure and review Threat Protection across API Security, Atlas, Argus, and DAST
Scanning Capabilities
Scan Run	✅	✅	✅	✅	👁️	👁️	Initialize security scans
Scan Results	✅	✅	✅	✅	👁️	👁️	View and analyze scan outcomes
Probe Editor	✅	✅	✅	✅	👁️	👁️	Create/modify probe cases
Issues	✅	✅	✅	✅	👁️	👁️	Manage security issues
Settings
Integrations	✅	👁️	👁️	👁️	✅	👁️	Manage third-party integrations
Billing	✅	👁️	👁️	👁️	👁️	👁️	Access billing and subscription
User Management	✅	👁️	👁️	👁️	👁️	👁️	Manage user accounts and roles
Monitoring & Analysis
Metrics	✅	✅	✅	✅	👁️	👁️	View system performance metrics
Logs	✅	✅	✅	✅	👁️	👁️	Access system logs
Sensitive Data	✅	✅	✅	✅	👁️	👁️	Manage sensitive data detection
Common Features
Ask Akto	✅	✅	✅	✅	👁️	👁️	AI-assisted analysis

Custom Roles

Organizations can create custom roles to meet specific business needs by combining permissions from different standard roles. To create and manage custom roles, check the Custom roles documentation.