The Operator Who Can Ask Everything but Deploy Nothing
A new security operator can run questions against all 25,000 endpoints but cannot deploy a package to remove a vulnerable service. The role assigned is Question Only plus a custom role with Action Write on content set Security Content. The package is in content set Desktop Engineering. The target computer group is All Windows Servers. When the operator clicks Deploy, the package is not listed. A second operator with Administrator can deploy it. The action group Server Patching requires approval by the Change Advisory group; the security operator is not a member.
1. Diagnose why the package is not listed.
Read the worked answer
The operator has Action Write only on Security Content, but the package lives in Desktop Engineering. In Tanium, visibility and use of content are scoped by content set and role; action permission on one content set does not grant access to a package in another. The package not appearing is therefore a content-set permission symptom, not a targeting symptom. Also check whether the operator has read/execute on the package and whether the package is assigned to a content set the role can see. The Administrator can see it because the role is broader. The approval group membership is a separate gate that would block execution after the package is visible, not hide it from the list.
2. How would you grant the minimum access needed without making the operator an administrator?
Read the worked answer
Prefer moving or copying the package into Security Content if security owns it, then grant Action Write there. If Desktop Engineering must own the package, grant read/execute on that specific package or content set, not blanket action rights. Ensure the operator can target All Windows Servers but cannot deploy elsewhere; use an action group scoped to that computer group. For approvals, add the operator to a delegated approval path or have Change Advisory approve the action; do not grant admin to bypass approval. Document the role, content set, computer group, and action group as one permission set.
3. What would you check after the change to confirm it is both usable and safe?
Read the worked answer
Confirm the package appears for the operator and that Deploy is limited to the intended computer group. Run a pilot action on 5-10 servers and verify status, exit code, and approval behavior. Check audit logs for who changed roles and content sets. Verify the operator cannot deploy the same package to workstations or other content sets. Confirm approval is still required and that the operator cannot self-approve. Re-review the role after 30 days to remove any temporary grant.