> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex-labs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant privileged authority and audit scope

> Separate clearance and declassification from erasure grants, content access and permitted audit inspection.

Use Console with the appropriate administrative role. Identify the exact responsibility and affected scope before assigning authority.

## Assign Security Officer responsibility

An Admin or Operator can grant or remove the Security Officer role, including on their own account. Inspect the person and role change before saving.

The officer sets clearances up to their own clearance and lowers supported resource security levels. The role itself grants no content access.

An Admin role assignment can require the platform's configured privileged-role clearance. Set the required clearance through an officer before granting the role. Do not interpret a refused assignment as a missing seat.

## Lower a resource level deliberately

1. Identify the dataset, workspace, project or personal chat and its current level.
2. Confirm the officer's current clearance and applicable edit authority.
3. Inspect the new audience and every conformance blocker.
4. Make the authorised level change through its secure control.
5. Verify the audit record's actor, old level and new level.

Processing, copying and summarising do not independently authorise a lower level. For a workspace change, inspect the chats that inherit its level.

## Assign and exercise erasure authority

An Admin assigns a separate erasure grant. Nobody grants erasure authority to themselves.

Use the granted scope and the authorised erasure procedure. Identify protected references, legal holds, affected derivatives and the reproducibility impact before execution.

Erasure removes the targeted bytes through its defined scope and leaves classified tombstones. It does not silently delete publication history. A legal hold blocks erasure until properly lifted.

Afterward, inspect the operation record, affected derivatives and retained provenance. Follow [Retention, deletion and legal holds](/administration/configuration-and-usage/retention-deletion-holds).

## Grant audit scope separately

Assign the person an explicit audit scope through the permitted administration route. Check subject scope, time bounds where supported and clearance.

Audit access permits inspection of the authorised records. It grants no ordinary read or edit access to the underlying chat, dataset or artefact.

Compliance subject inspection also uses its own review-access path. It remains read-only; export is a protected read, while editing or deciding another person's pass needs separate authority.

Verify the assigned scope with [Inspect audit events within a granted scope](/audit-and-compliance/inspect-audit-events). Preserve the grant and removal records for later inspection.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.