UI user roles

This section describes the predefined user roles that Administrators can assign to UI user accounts. Each role grants permissions that allow users to access Veracode products and features, and perform tasks.

Before creating and assigning user roles, we recommend reviewing User roles assignment planning.

Administrators assign roles when creating users or editing users in the Veracode Platform, or with the Identity API. If your organization uses SAML and just-in-time (JIT) provisioning, you can assign roles, including Administrator, automatically through SAML assertions. Users that are members of a team are limited to team-assigned resources, such as the application profile and scan results for a specific application.

Use the following sections when deciding which UI roles to assign to users:

• UI roles by job
• UI roles by task

You can create custom roles with the Identity API.

note

In the tables in the section, the Scope column indicates the breadth of access granted by each role:

• Organization-wide — Grants access to organizational settings and resources across all teams.
• Team-level — Grants access only to resources assigned to the user's teams. For most roles, visibility is limited to applications assigned to the user's teams. To grant a user visibility across all applications without team assignments, you must assign the Security Lead or Executive role.
• Workspace-level — Grants access only to resources within a specific Software Composition Analysis (SCA) workspace.
• Individual — Grants access to user-specific features or settings.

Administrator

Permissions	Use case	Scope	Licensing	Important notes
Create user accounts Edit user accounts Delete user accounts Manage teams Create teams Delete teams Edit teams Manage SAML settings Edit organization Manage account level eLearning Access the Package Firewall UI and copy access tokens, but can't create or delete firewalls or modify exceptions or policies	Full organizational account management, including user and team administration.	Organization-wide	Base Veracode Platform subscription Veracode eLearning subscription (if managing eLearning settings)	Can be granted by Veracode Technical Support or with SAML assertion with JIT provisioning. Can't be combined with the Team Admin role. A user with both the Administrator and eLearning roles is considered an eLearning administrator and can manage Veracode eLearning tasks.

Analytics Creator

Permissions	Use case	Scope	Licensing	Important notes
Access Veracode Analytics View scan metrics of applications in the user's team portfolio Create or edit custom reports	Create and manage custom analytics reports and dashboards.	Team-level	Veracode Analytics subscription	None

Creator

Permissions	Use case	Scope	Licensing	Important notes
Create, edit, and delete application profiles Create application profiles for assigned teams only Create workspaces Edit workspaces Delete workspaces Assign application profiles to teams Assign workspaces to teams Request and delete scans for applications Create sandbox scans Create policy scans Promote sandbox scans to policy scans Delete sandbox scans Edit scan configurations Delete analyses Create and edit development sandboxes Request Manual Penetration Testing, Static Analysis, or Pipeline Scan Allow next-day consultations for an application Schedule consultation calls Submit Container scan and view results Submit IaC scan and view results Create and delete SCA agents Edit SCA agents Manage rules in a workspace View workspace reports Create and comment on issues Manage project settings Manage integrations	Create application profiles, workspaces, and request SCA scans across team applications.	Team-level	Veracode Static Analysis, Veracode SCA, or Veracode DAST subscription	Optional restrictions: Can use all scan types or be restricted to only specific scan types. This restriction limits the scope of policy and scan management for that user. Visibility and actions (like creating or requesting scans) are limited to the user's teams.

Delete Scans

Permissions	Use case	Scope	Licensing	Important notes
Delete scans from application profiles	Remove completed or unnecessary scan results.	Team-level	Base Veracode Platform subscription	For some operations, this role might need to be combined with other roles.

eLearning

Permissions	Use case	Scope	Licensing	Important notes
Access Veracode eLearning courses, assessments, and the Knowledge Base	Enable users to take security training courses.	Individual	Veracode eLearning subscription	Assigning this role consumes a purchased seat only after the user launches a course. If a learner doesn't launch a course, you can assign the role to another user. You can only assign as many roles as you have purchased seats.

Executive

Permissions	Use case	Scope	Licensing	Important notes
View Veracode Analytics and reports for all application profiles View all application profiles Schedule consultation calls for policy scan results Access Veracode eLearning summary reports (requires eLearning role) View all workspaces	View comprehensive security metrics and reports across all application profiles.	Organization-wide	Base Veracode Platform subscription Veracode Analytics subscription Veracode eLearning subscription	Requires the eLearning role to access eLearning summary reports.

Free Trial Admin

Permissions	Use case	Scope	Licensing	Important notes
Edit users and teams Create up to nine additional users Create up to four additional teams Submit support requests Access and use DAST	Administer free trial organization with limited user or team creation.	Organization (free trial)	14-day free trial for DAST.	One per free trial organization.

Free Trial User

Permissions	Use case	Scope	Licensing	Important notes
Edit own user account Submit support requests Access and use DAST	Access and test DAST in free trial.	Individual	14-day free trial for DAST.	None

Greenlight IDE User

Permissions	Use case	Scope	Licensing	Important notes
Access the Veracode Greenlight plugin in IDE Perform Greenlight scans Review Greenlight scan results	Perform real-time security scans in IDE during development.	Individual	Veracode Greenlight subscription	Veracode Greenlight is deprecated. We recommend using the Veracode Scan IDE plugins with the required roles.

Mitigation Approver

Permissions	Use case	Scope	Licensing	Important notes
Approve mitigations for flaws View the list of accessible application profiles Modify exceptions for a Package Firewall Ignore and unignore SCA findings	Review and approve proposed flaw mitigations from security teams.	Team-level	Base Veracode Platform subscription Mitigation Proposal Reviews (MPR) subscription	None

Policy Administrator

Permissions	Use case	Scope	Licensing	Important notes
Create and edit security policies Set default policies and notification rules Assign policies to applications Create a Package Firewall and manage its policies Change policy assignments for individual application profiles	Define and manage organization security policies and Package Firewalls.	Organization-wide	Base Veracode Platform subscription	Requires Creator or Security Lead role to change policy assignments for specific applications.

Reviewer

Permissions	Use case	Scope	Licensing	Important notes
Access reports and finding details for application profiles assigned to teams Propose mitigations Review scan results and scan reports for sandboxes View the list of accessible application profiles, but can't access the Review Modules page in the Veracode Platform Schedule consultation calls for policy scan results Access EASM and view results, but can't start EASM scans Navigate the Package Firewall UI and copy access tokens, but can't manage firewalls, exceptions, or policies for Package Firewall View status of DAST scans View vulnerability summary of DAST scans View specific application profiles in Software Composition Analysis View specific workspaces in Software Composition Analysis View workspace reports	Review scan results and propose mitigations.	Team-level	External Attack Management (EASM) subscription (to access EASM)	None

Sandbox Administrator

Permissions	Use case	Scope	Licensing	Important notes
Create development sandboxes for scanning code in development Edit or delete development sandboxes Create policy scans Submit policy scans Propose mitigation comments	Manage development sandboxes for team members.	Team-level	Veracode Static Analysis subscription	Can only manage sandboxes and policy scans. To create applications or submit scans, combine with the Creator, Submitter, Reviewer, or Security Lead role.

Sandbox User

Permissions	Use case	Scope	Licensing	Important notes
Create and edit development sandboxes Scan code within a development sandbox Delete their own scans Review results of a sandbox scan Add comments on sandbox scans Propose mitigations Schedule consultation calls for sandbox scan results Promote sandbox scans to policy scans	Developers scanning code in development before production submission.	Team-level	Veracode Static Analysis subscription	Requires the Creator or Submitter role to promote sandbox scans to policy scans. Promoting sandbox scans to a policy scan counts toward your policy compliance score.

Security Insights

Permissions	Use case	Scope	Licensing	Important notes
Access Veracode Analytics and Reporting API View scan metrics of applications in the user's team portfolio View custom reports Team-restricted access to Analytics data	View analytics and reporting data for assigned applications.	Team-level	Veracode Analytics subscription	Requires Security Lead or Executive role for organization-wide access. Creating or editing Analytics dashboards also requires the Analytics Creator role.

Security Labs Administrator

Permissions	Use case	Scope	Licensing	Important notes
Manage all learning activities for Security Labs users	Manage Security Labs training for all users.	Organization-wide	Veracode Security Labs subscription	Combine with the Administrator role to grant user and team management.

Security Labs Manager

Permissions	Use case	Scope	Licensing	Important notes
Manage learning activities for users on their teams, but can't add or remove users or teams	Manage Security Labs training for team members.	Team-level	Veracode Security Labs subscription	User and team management requires the Administrator role.

Security Labs User

Permissions	Use case	Scope	Licensing	Important notes
Access Veracode Security Labs interactive training labs	Take interactive security training labs and courses.	Individual	Veracode Security Labs subscription	Assigning this role immediately consumes a purchased seat. To see the number of remaining seats in the Veracode Platform, select the Security Labs User help icon when assigning roles on the Admin page.

Security Lead

Permissions	Use case	Scope	Licensing	Important notes
Create, edit, and delete application profiles View Veracode Analytics, reports, and finding details for all application profiles Submit scans and approve scan requests Assign application profiles to teams Review all application profiles and scans Receive all related notifications without team assignment limitations Approve next-day consultations for an application Schedule consultation calls Promote sandbox scans to policy scans Create or delete a Package Firewall Modify Package Firewall exceptions and policies Start an EASM scan Request and delete scans Create development sandboxes Delete development sandboxes Create policy scans Create development sandbox scans Submit development sandbox scans Comment on Static Analysis results Request Manual Penetration Testing, Static Analysis, or Pipeline Scan Manage security policies Submit Container scans and view results Submit IaC scans and view results View Veracode Analytics and reports Access Reporting API View reports View results Download build and scan results data, and summary and detailed reports Access Results API Export custom data View the list of development sandboxes Update results Propose mitigations, but can't approve or reject proposed mitigations Create and delete application profiles in Software Composition Analysis Edit application profiles in Software Composition Analysis Add teams to application profiles in Software Composition Analysis View all application profiles in Software Composition Analysis Request SCA and Static Analysis scans Create workspaces in Software Composition Analysis Edit workspaces in Software Composition Analysis Delete workspaces in Software Composition Analysis Add teams to workspaces in Software Composition Analysis View all workspaces in Software Composition Analysis Manage projects Link projects to applications Manage agent-based scan rules Manage integrations Request, create, or submit a DAST scan Upload or enter URLs Import URLs or API endpoints Auto-link results to application profiles Manually link results to application profiles Assign teams Edit analyses and schedules Edit scan configurations Add or delete scans from an analysis View status View analysis configuration Delete analyses View vulnerability summary	Lead security scanning and policy management organization-wide with no team restrictions.	Organization-wide	Base Veracode Platform subscription Veracode Static Analysis, Veracode SCA, or Veracode DAST subscription Veracode EASM subscription	Can use all scan types or be restricted to only specific scan types. This restriction limits the scope of policy and scan management for that user.

Submitter

Permissions	Use case	Scope	Licensing	Important notes
Request scans for application profiles in user's teams Access the Review Modules page in the Veracode Platform Upload binaries View the list of accessible application profiles, but can't create, edit, or delete application profiles, or delete scans (except policy scans created by the Submitter) Promote sandbox scans to policy scans Create, rename, and delete SCA agents Regenerate SCA agent tokens Schedule consultation calls for scan configurations Navigate the Package Firewall UI and copy access tokens Submit policy scans Create and edit development sandboxes Request Manual Penetration Testing, Static Analysis, or Pipeline Scan View specific application profiles in Software Composition Analysis View specific workspaces in Software Composition Analysis Manage agents in Software Composition Analysis Submit Container scan and view results Submit IaC scan and view results Request, create, or submit a DAST scan Upload or enter URLs Manually link results to application profiles Assign teams Edit analyses and schedules Edit scan configurations Add or delete scans from an analysis View status View analysis configuration Delete analyses View vulnerability summary Use Veracode Fix	Submit scans and upload binaries for team applications.	Team-level	Veracode Static Analysis, Veracode SCA, or Veracode DAST subscription	Optional restrictions: Can use all scan types or be restricted to only specific scan types. This restriction limits the scope of policy and scan management for that user. Visibility and actions (like creating or requesting scans) are limited to the teams to which they belong. Vendors receiving a third-party scan request must accept it before submitting a scan.

Team Admin

Permissions	Use case	Scope	Licensing	Important notes
Create and manage users on one or more assigned teams only Reset user passwords Update user roles on assigned teams Add or remove team memberships View or manage users in managed teams only Manage Security Labs learners on their teams	Manage users and team membership for assigned teams only.	Team-level	Base Veracode Platform subscription	Can't create teams, business units, or add users to teams they don't manage. Can't edit roles for Administrator, Executive, Policy Administrator, Security Lead, Team Admin, or Workspace Administrator users. Can't be combined with the Administrator role.

Vendor Manager

Permissions	Use case	Scope	Licensing	Important notes
View the list of all third-party vendors for the organization	View vendor information for third-party scans.	Organization-wide	Veracode Vendor Application Security Testing (VAST) subscription	Might not be available for all organizations.

VRM Admin

Permissions	Use case	Scope	Licensing	Important notes
Create, read, update, and delete VRM dashboards Create, read, update, and delete VRM connectors Create tickets in VRM View all data without team restrictions	Manage Veracode Risk Manager dashboards, connectors, and tickets organization-wide.	Organization-wide	Veracode Risk Manager subscription	The user doesn't need to be a member of a team.

VRM Guest

Permissions	Use case	Scope	Licensing	Important notes
Read VRM dashboards Read VRM connectors Create tickets from the Issues and Solutions pages View data only for applications assigned to their teams	View VRM dashboards and create tickets for team applications.	Team-level	Veracode Risk Manager subscription	None

VRM Supervisor

Permissions	Use case	Scope	Licensing	Important notes
Read VRM dashboards Read VRM connectors Create tickets from the Issues and Solutions pages View all data without team restrictions	View VRM dashboards and create tickets organization-wide.	Organization-wide	Veracode Risk Manager subscription	The user doesn't need to be a member of a team.

VRM Team Admin

Permissions	Use case	Scope	Licensing	Important notes
Create, read, update, and delete VRM dashboards Create, read, update, and delete VRM connectors Create tickets in VRM View data only for applications assigned to their teams	Manage VRM dashboards, connectors, and tickets for team applications.	Team-level	Veracode Risk Manager subscription	The user must be a member of a team.

Workspace Administrator

Permissions	Use case	Scope	Licensing	Important notes
Edit and delete SCA workspaces Create, edit, and delete SCA agents in a workspace Add and remove teams in a workspace Manage rules in a workspace View workspace reports Create and comment on issues Manage project settings	Manage SCA workspaces and agents.	Workspace-level	Veracode Software Composition Analysis (SCA) subscription	None

Workspace Editor

Permissions	Use case	Scope	Licensing	Important notes
Create, edit, and delete SCA agents in a workspace Manage rules in a workspace View workspace reports Create and comment on issues Manage project settings	Manage SCA agents and rules within workspaces.	Workspace-level	Veracode Software Composition Analysis (SCA) subscription	None