>
    Strata Copilot
    Scopes and Built-in Account Permissions
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Built-in Accounts Overview
    6. Create a Workload Identity Federation Built-in Account
    7. Scopes and Built-in Account Permissions
    Next‑Gen Trust Security

    Scopes and Built-in Account Permissions

    Table of Contents

    Scopes and Built-in Account Permissions

    Scopes define the permissions and access levels for built-in accounts, determining what actions a built-in account can take and which resources it can access. In Next-Gen Trust Security, built-in accounts are also referred to as use cases.
    The following table lists the scopes available for each built-in account.
    Scope NameScope IDPurposeBuilt-in Accounts (Use Cases)
    cert-manager Enterprise Issuercert-manager-enterprise-issuerAllows cert-manager to request certificates from Control Plane using Workload Identity Federation.cert-manager Enterprise Issuer
    Certificate Issuancecertificate-issuanceEnables issuing of new certificates using CyberArk APIs.Custom API Integration
    Certificates Discovered on Kubernetes Clustersvenafi-tlspdcEnables your CyberArk Certificate Manager - Self-Hosted instance to connect to CyberArk Certificate Manager for Kubernetes and retrieve certificates discovered on Kubernetes clusters.Certificate Manager - Self-Hosted
    cert-manager Componentsoci-registry-cmGrants access to manage enterprise-level components within cert-manager.OCI Registry
    Distributed Issuancedistributed-issuanceAllows issuing of certificates with Distributed IssuerDistributed Issuer, Discovery Agent
    Enterprise Approver Policy Component for cert-manageroci-registry-cm-apeEnables management of approval policies within cert-manager.OCI Registry
    Enterprise Issuer Component for cert-manageroci-registry-cm-veiAllows management of the Enterprise Issuer for CyberArk Certificate Manager components within cert-manager.OCI Registry
    Kubernetes Discoverykubernetes-discoveryEnables discovery and identification of Kubernetes resources.Workload Identity Management, Discovery Agent
    OpenShift Routes Component for cert-manageropenshift-routesGrants access to the OpenShift Routes for cert-manager component.OCI Registry
    Built-in Account Writesvcaccount-writeAllows creation of built-in accounts for the other use cases listed here. You can use the API or CLI to create a built-in account with this scope.Discovery Agent
    Workload Identity Manager LTS and FIPSoci-registry-firefly-entGrants access to the LTS and FIPS versions of the Workload Identity Manager.OCI Registry

    Who Can Create and Manage Built-in Accounts?

    Built-in Accounts are tenant-wide, meaning they are accessible and manageable across the entire tenant, subject to the permissions associated with your assigned role. Permissions vary significantly among roles, particularly regarding the ability to create, view, change, or delete built-in accounts.
    Note: The following table shows permissions for managing Built-in Accounts specifically. Permissions are determined by the combination of your assigned role and TSG membership.
    Role & TSG ContextPermissions
    Superuser (parent TSG)Can create, view, modify, and delete all built-in accounts across the entire TSG hierarchy.
    Superuser (child TSG)Can create, view, modify, and delete built-in accounts within their assigned child TSG only.
    View Only AdminCannot create, modify, or delete built-in accounts (read-only access only).

    © 2026 Palo Alto Networks, Inc. All rights reserved.