Hi, I was hoping someone would be able to let me know the correct role to choose for a user whose responsibility will be to create playbooks. Automation Engineer: Automation Engineers can author rules to automate security actions. Incident Commander: Incident Commanders are allowed to view/edit Events and are allowed to create new Actions. The Automation Engineer and the Incident Commander both have these permissions: Apps: can view Assets: can view Events: can edit, can view Custom Lists: can view Playbooks: can edit, can view, can execute, can edit code System Settings: can view User & Roles: can view The Incident Commander has a few additional permissions: Cases: can delete, can edit, can view Playbooks: can delete System Settings: can edit Thank you! ... View more