Roles and permissions
A role is a named set of permissions. Roles are global and reusable.
A role does not carry a scope. Scope is on the grant, not the role — which is why you need one “Risk manager” role rather than one per division. This is the most common misconception when people first meet the model.
Built-in roles
| Role | Can |
|---|---|
| Administrator | Everything, including granting access. |
| Workspace administrator | Full control of one workspace’s registers and defaults. Cannot grant access, cannot reach another workspace. |
| Risk manager | Manage risks and assessments across their scope. |
| Risk owner | Raise, score, assign treatment and close their own risks. |
| Contributor | Do assigned work. Not accountable for it. |
| Reporter | Raise a risk and see their own. |
| Viewer | Read only. |
| Auditor | A ceiling, not a role — read-only everywhere, and it caps whatever else the holder has. |
The reach ladder
Rather than a permission being simply on or off, each one answers how far:
| Reach | Means |
|---|---|
| Nothing | Not permitted. |
| Only mine | Records matching the role’s definition of “mine”. |
| The holder’s own unit | Their home unit only. |
| That unit and below | Their unit and everything under it. |
| Everything in scope | The full reach of the grant. |
Defining “mine”
“Mine” is defined once per role, not per permission. Choose any combination of:
- I created it
- I am the named owner
- It is assigned to me
- A group I am in owns it
- I lead the unit that owns it
- I am the named reviewer (read-only, always)
This is the answer to “CRUD, plus if I’m the owner, creator, assignee or in the group” — and it is what keeps the whole permission set on one screen instead of three hundred checkboxes.
Building a custom role
- Basics — name, description, and the “mine” definition.
- Permissions — grouped and searchable, each with its reach ladder. Prerequisites are enforced automatically.
- Checks — blocking errors and warnings, including segregation-of-duties conflicts, with one-click fixes and a diff against the template you started from.
- Review — a preview of how the role appears in the grant dialog, a simulation against a real person, and the audit entry that will be written.
Segregation of duties
The role builder checks for conflicts inside a single role. A separate check runs across every grant a person holds, because two clean roles can add up to a dirty combination — and that is the finding a role builder can never see on its own.