Hi @ang3la42 - If you're looking for the right out-of-the-box permissions for a user who'll primarily be building playbooks (but not necessarily responding to incidents), then 'Automation Engineer' is the way to go. From the docs, its described thusly: Automation Engineers are responsible for building the playbooks required to automate security operations. Responsible for: - Creating and Managing PLAYBOOKS" However, as you point out, the Automation Engineer role does include the ability to view and edit events (but not cases) - which is useful for testing when building playbooks. Further lock-down could be accomplished by creating a custom role if necessary. ... View more