diff --git a/scope/role-aa/permissions.yaml b/scope/role-aa/permissions.yaml
new file mode 100644
index 0000000..a465a66
--- /dev/null
+++ b/scope/role-aa/permissions.yaml
@@ -0,0 +1,29 @@
+role_id: AA
+permissions:
+  - id: P-001
+    name: READ
+    type: READ
+    resource: "*"
+    conditions:
+      - type: masking
+        enabled: true
+      - type: audit
+        enabled: true
+        
+  - id: P-002
+    name: QUERY
+    type: READ
+    resource: "query/*"
+    conditions:
+      - type: audit
+        enabled: true
+        
+  - id: P-003
+    name: EXPORT
+    type: READ
+    resource: "export/*"
+    conditions:
+      - type: approval_required
+        enabled: true
+      - type: audit
+        enabled: true