App Control: How to limit console access for powerusers

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to limit the user in the App Control console to approve files locally.

Environment

• App Control Console: 8.1 P2 and above

Resolution

1. Create role with below access.

• Computers View computers 
• Files View files and applications 
• Files Change local state 
• Devices View devices 
• Reports View events 

2. Assign all or specific policy as per requirement.
3. Create user and select newly created role.
4. Login to newly created user.
5. Try to approve files locally from the events page. Access should be blocked 

Additional Information

Make sure the file the user is trying to approve is from the computer under selected policy.