# Granular Permission for Configuring Object and Property Security Policies

**URL:** <https://community.palantir.com/t/granular-permission-for-configuring-object-and-property-security-policies/7424>\
**Category:** Ask the Community\
**Tags:** ontology-management, security\
**Created:** [October 30, 2026, 7:36am UTC](https://community.palantir.com/t/granular-permission-for-configuring-object-and-property-security-policies/7424 "2026-10-30T07:36:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshOntologize](https://yyz1.discourse-cdn.com/palantir/user_avatar/community.palantir.com/joshontologize/32/4460_2.png) [@joshOntologize](https://community.palantir.com/u/joshOntologize)\
**Post date:** [October 30, 2026, 7:36am UTC](https://community.palantir.com/t/granular-permission-for-configuring-object-and-property-security-policies/7424/1 "2026-10-30T07:36:55Z")

</div>

Hi! We utilize a lot of custom role sets to control access within Projects. We want to allow users to configure both Object Security Policies and Property Security Policies on Object Types in a Project, but we don’t want to grant them the Owner role on the entire Project. What’s the exact granular permission that controls this?

---

<div class="post-metadata">

**Author:** ![asekhsaria](https://avatars.discourse-cdn.com/v4/letter/a/7993a0/32.png) [@asekhsaria](https://community.palantir.com/u/asekhsaria)\
**Post date:** [October 30, 2026, 3:19pm UTC](https://community.palantir.com/t/granular-permission-for-configuring-object-and-property-security-policies/7424/2 "2026-10-30T15:19:09Z")

</div>

Hi! Object Security Policies and Property Security Policies are both “property security groups” under the hood, so the same operations cover both. These are the granular permissions that gate changes to Object/Property Security Policies

- `ontology:create-property-security-group`
- `ontology:edit-property-security-group`
- `ontology:delete-property-security-group`

You will need these set of permissions to change object/property security policies on a branch:

- `ontology:propose-create-property-security-group`
- `ontology:propose-edit-property-security-group`
- `ontology:propose-delete-property-security-group`