# Configure application permissions

Query current-principal roles and the permission schema, validate an application permission policy, then apply it. This page does not configure data-resource or object grants.

## Prerequisites

Prepare credentials that can access the target workspace and the permission policy to apply. For service endpoints, authentication, and general request formats, see [Prepare to call an API](../../api-call-basics.md).

Before applying the policy, confirm the current-principal roles and available permission schema, then validate the policy content.

## Call sequence

1. [Get current-principal roles](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/get-current-principal-roles.md) to confirm the calling identity.
2. [Get the permission schema](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/get-permission-schema.md) and prepare a policy that matches it.
3. Use [Validate application permission policy](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/validate-application-policy.md) to check the policy.
4. After validation, apply the policy and query current-principal roles again to confirm observable role results.

## API operations

### Query, validate, and apply policies

| What you need to do | API operation | Use it when |
| --- | --- | --- |
| Query current-principal roles | [Get current-principal roles](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/get-current-principal-roles.md) | Confirm roles for the current calling identity before or after applying a policy. |
| Query the permission schema | [Get the permission schema](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/get-permission-schema.md) | Learn the available schema before preparing a policy. |
| Validate an application permission policy | [Validate application permission policy](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/validate-application-policy.md) | Check a policy to submit before applying it. |
| Apply a permission policy | [Apply application permission policy](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/apply-application-policy.md) | Submit an application permission policy after validation. |

## Confirm the result

After applying the policy, use [Get current-principal roles](../../../../reference/api/ai-studio/users-and-permissions/application-permissions/get-current-principal-roles.md) to confirm observable role information for the current calling identity.

## Next steps

- [Configure data privileges](data-privileges.md)
- [Configure object permissions](object-permissions.md)