UI user roles by task

This section identifies the required UI user roles for performing certain tasks with Veracode products or features.

We also provide the typical UI user roles based on jobs.

Veracode Platform

The following tables list the roles for general Veracode Platform tasks.

Administer the organization

Task	Administrator	Team Admin
Create users	Yes	Yes
Edit users	Yes	Yes
Delete users	Yes	No
Reset user passwords	Yes	Yes
Update user roles	Yes	Yes
Add or remove team membership	Yes	Yes
Create teams	Yes	No
Edit teams	Yes	No
Delete teams	Yes	No
Create business units	Yes	No
Edit business units	Yes	No
Delete business units	Yes	No
Manage SAML settings	Yes	No
Edit organization settings	Yes	No

note

Team Admins can only manage users on their assigned teams and cannot edit roles for Administrator, Executive, Policy Administrator, Security Lead, Team Admin, or Workspace Administrator users. For more information, see Team Admin role details.

Manage application profiles

Task	Administrator	Creator	Delete Scans	Security Lead	Submitter
Create application profiles	No	Yes	No	Yes	No
Bulk add application profiles	No	No	No	Yes	No
Assign application profiles to teams	Yes	Yes	No	Yes	No
Delete any scans for an application profile	No	Yes	Yes	Yes	No

Manage scan results, reports, and analytics

Task	Executive	Reviewer	Security Lead	Security Insights	Analytics Creator
Publish results	No	No	Yes	No	No
View results and reports	Yes	Yes	Yes	No	No
Comment on results on the Triage Flaws page	No	No	Yes	No	No
Download XML results	Yes	Yes	Yes	No	No
View analytics	Yes	No	Yes	Yes	Yes
Edit analytics	No	No	No	No	Yes
Access Reporting API	Yes	No	Yes	Yes	No

note

Members of a team assigned to an application profile can accept third-party terms or scan requests. Users with both the Reviewer and Security Insights role can view analytics only for the teams for which they have access.

Manage security policies

Task	Policy Administrator
Manage security policies	Yes

Manage support consultations

Task	Creator	Submitter	Security Lead
Enable applications for next-day consultations	Yes	No	Yes
Schedule consultations for policy scan results	Yes	Yes	Yes
Schedule remediation consultations	Yes	No	Yes
Schedule upload consultations	Yes	No	Yes

Mitigate findings

Task	Mitigation Approver	Reviewer	Security Lead
Propose mitigations	No	Yes	Yes
Approve mitigations	Yes	No	No

Use File Exchange

Task	Administrator	Security Lead	Vendor Manager
Manage File Exchange files	Yes	Yes	No

Veracode Container Security

Task	Submitter	Creator	Security Lead
Submit a container scan and view results	Yes	Yes	Yes
Submit an IaC scan and view results	Yes	Yes	Yes

Veracode DAST

Task	Administrator	Creator	Submitter	Reviewer	Security Lead
Request, create, or submit an analysis	Yes	Yes	Yes	No	Yes
Upload or enter URLs	Yes	Yes	Yes	No	Yes
Import URLs or API endpoints	Yes	Yes	Yes	No	Yes
Auto-link results to application profiles	Yes	No	No	No	Yes
Manually link results to application profiles	Yes	Yes	Yes	No	Yes
Assign teams	Yes	Yes	Yes	No	Yes
Edit and schedule an analysis	Yes	Yes	Yes	No	Yes
Edit scan configurations	No	Yes	Yes	No	Yes
Add or delete scans	No	Yes	Yes	No	Yes
View analysis status	No	Yes	Yes	Yes	Yes
View analysis configuration	No	Yes	Yes	No	Yes
Delete an analysis	No	Yes	Yes	No	Yes
View vulnerability summary	No	Yes	Yes	Yes	Yes
Generate WAF rules	No	Yes	Yes	No	Yes

Veracode eLearning

Task	Administrator	Executive	eLearning
Manage learners	Yes	No	No
Access eLearning	No	No	Yes
View all eLearning courses	No	Yes	Yes

note

To view all eLearning courses, both the Executive and eLearning roles are required.

Veracode Package Firewall

Task	Administrator	Reviewer	Submitter	Mitigation Approver	Policy Administrator	Security Lead
Create firewalls	No	No	No	No	Yes	Yes
Delete firewalls	No	No	No	No	No	Yes
Modify policies	No	No	No	No	Yes	Yes
Modify exceptions	No	No	No	Yes	No	Yes
View results	Yes	Yes	Yes	Yes	Yes	Yes

Veracode SAST

Task	Creator	Reviewer	Submitter	Sandbox Administrator	Sandbox User	Security Lead
Request Manual Penetration Testing (MPT), Static Analysis, or Pipeline Scan	Yes	No	Yes	No	No	Yes
Create sandboxes	Yes	No	No	Yes	Yes	Yes
Delete sandboxes	Yes	No	No	Yes	No	Yes
Create policy scans	Yes	No	Yes	No	Yes	Yes
Submit policy scans	Yes	No	No	Yes	Yes	Yes
Create sandbox scans	Yes	Yes	No	Yes	No	Yes
Submit sandbox scans	Yes	Yes	No	Yes	No	Yes

Veracode Security Labs

Task	Administrator	Team Admin	Security Labs Administrator	Security Labs Manager	Security Labs User
View users and teams	Yes	Yes	Yes	Yes	No
Create and manage users, roles, and teams	Yes	Yes	No	No	No
Create and manage campaigns	Yes	Yes	Yes	Yes	No
Manage reporting	Yes	Yes	Yes	Yes	No
Manage settings specific to the organization	Yes	No	Yes	No	No
View labs and the leaderboard	Yes	Yes	Yes	Yes	Yes
View certificates, if enabled	Yes	Yes	Yes	Yes	Yes
View, rotate, or disable API credentials	Yes	No	Yes	No	No
Customize conclusions for lessons	Yes	No	Yes	No	No

Veracode Software Composition Analysis (SCA)

Task	Mitigation Approver	Security Lead	Executive	Creator	Reviewer	Submitter	Workspace Administrator	Workspace Editor
View the SCA Portfolio page	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Create and delete applications	No	Yes	No	Yes	No	No	No	No
Edit applications	No	Yes	No	Yes	No	No	No	No
Add teams to applications	No	Yes	No	Yes	No	No	No	No
View all applications	No	Yes	Yes	No	No	No	No	No
View specific applications	No	Yes	Yes	Yes	Yes	No	No	No
Request SCA and Static Analysis scans	No	Yes	No	Yes	No	No	No	No
View the Workspace Portfolio page	No	Yes	Yes	Yes	Yes	No	Yes	Yes
Create workspaces	No	Yes	No	Yes	No	No	No	No
Delete workspaces	No	Yes	No	Yes	No	No	Yes	No
Edit workspaces	No	Yes	No	Yes	No	No	Yes	No
Add teams to workspaces	No	Yes	No	Yes	No	No	Yes	No
View all workspaces	No	Yes	Yes	No	No	No	No	No
View specific workspaces	No	Yes	Yes	No	Yes	No	Yes	Yes
Manage projects	No	Yes	No	No	No	No	Yes	Yes
Link projects to applications	No	Yes	No	No	No	No	Yes	Yes
Manage agent-based scan rules	No	Yes	No	No	No	No	Yes	Yes
Manage integrations	No	Yes	No	No	No	No	No	No
Manage agents	No	Yes	No	No	No	Yes	Yes	Yes
Ignore and unignore issues	Yes	No	No	No	No	No	No	No

Veracode VAST

Task	Administrator	Security Lead	Vendor Manager
Manage VAST on the Vendors page in the Veracode Platform	No	No	Yes