---
title: RBAC Considerations for AI SOC
slug: solutions/r8k2-rbac-considerations-for-ai-soc
docTags: 
createdAt: 2026-04-27T12:00:00.000Z
---

AI SOC relies on **Hero AI**, **orchestration components**, and the **AI Alert Analysis** panel on **Case Management** records. Access depends both on **widget-level options** (who can see **Generate Plan**, automation, and so on) and on **platform role-based access control (RBAC)** for Turbine components and orchestration. Administrators should align account RBAC mode with the permissions below so analysts can generate plans, use **Re-investigate**, and use automation (for example **Create a Triage Rule**, **AI SOC - CASE Hero AI Analysis**) as intended.

## At a Glance

| RBAC mode         | What analysts typically need for full AI SOC usage                                                                                                        |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Enhanced RBAC** | **Read** and **Execute** permissions on **components** required for plan steps and automation (grant per component or role as your organization defines). |
| **Legacy RBAC**   | **Orchestrator**-level permissions are required for users to use AI SOC features that depend on components and orchestration.                             |

## Enhanced RBAC

In **enhanced RBAC**, grant analysts (and other roles that generate or run plans) **Read** and **Execute** access to the **components** Hero AI selects when building or running investigation steps. Without execute permission on the relevant components, tools may not appear or populate in the plan workflow (for example in the automation area after **Generate Plan**), and users may be unable to complete actions that depend on those components.

**Administrator actions:**

1. Identify which components your organization uses for AI SOC (installed connectors, Hero AI analysis components, marketplace items).
2. Assign **Read** and **Execute** on those components to the roles that should run plans and automation.
3. Keep **Case Management** widget permissions aligned so the same roles can use the **AI Analysis** / **AI Alert Analysis** features you expect. See [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp).

## Legacy RBAC

In **legacy RBAC**, **Orchestrator**-level permissions are required for users to use AI SOC in line with component-backed plan and automation behavior. Analyst or viewer roles that do not include orchestration rights at that level may see incomplete behavior (for example plans that do not surface the **AI SOC - CASE Hero AI Analysis** tool or options to create triage rules from a generated plan) even when **Case Management** widget options look correct.

**Administrator actions:**

1. Confirm whether your account uses **legacy** or **enhanced** RBAC.
2. For **legacy RBAC**, ensure users who need full AI SOC analyst workflows have the appropriate **Orchestrator** access, or migrate to **enhanced RBAC** and apply **Read** / **Execute** on components as described above.

## Widget RBAC (Case Management)

The **AI Analysis** widget on the **Case Management** form layout controls which roles can see each section of **AI Alert Analysis** (summary, plan, automation, marketplace, and so on). This is separate from component permissions but must be configured together: users need both **widget** access and **component** / **orchestration** permissions for end-to-end flows. See [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) and [Case Management (CASE)](docId\:sDpESfT6Lsyz0zfrn_hok).

## Trigger Analysis Agent and Routing Rules

When **Signal Routing Rules** run **AI SOC - Trigger Analysis Agent via Routing Rule**, investigation executes as a **playbook run** using a **PAT token** stored in an asset—not as the analyst who later opens the record.

**One-time administrator setup:**

1. Configure a **PAT token** (personal access token) in an **asset** referenced by **AI SOC - Trigger Analysis Agent via Routing Rule**.
2. The platform calls the **AI SOC - Trigger Analysis Agent** over HTTP using that token.
3. **Component execute permissions** for the PAT user apply while the agent runs.

**Reviewer vs runner:**

| Role                                    | Permissions                                                                                                                   |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| **Agent run** (routing rule / PAT user) | Determines which components **AI SOC - Trigger Analysis Agent** can execute                                                   |
| **Analyst reviewing the signal**        | May differ from the PAT user; can review verdict, progress, and stored inputs/outputs on the record                           |
| **Create a Playbook**                   | Uses the **reviewing user's** component access—playbook creation can fail if that user cannot access components the agent ran |

Component inputs and outputs from Trigger Analysis Agent runs are stored as **attachments** on the record so analysts can inspect results even when they lack permission to open the underlying playbook run.

Only components with **Visible to Hero AI** enabled are available to the **AI SOC - Trigger Analysis Agent**. Review which components are Hero-visible before using **Re-investigate** or routing-rule analysis in production. See [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi) and [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp).