Access Control & RBAC
Permissions at the level of individual actions
Not viewer, editor, admin. Permission bundles operate on specific lifecycle transitions, which is what makes segregation of duties demonstrable to an auditor.
- Role bundles composed from individual permission codenames
- Module-level access granted per company and per user
- Per-user permission overrides where a bundle does not fit
- Segregation-of-duties conflict rules with recorded exceptions
| Action | asset-viewer | asset-coordinator | asset-approver | asset-admin |
|---|---|---|---|---|
| View | Allowed | Allowed | Allowed | Allowed |
| Create and edit | Not allowed | Allowed | Not allowed | Allowed |
| Submit for intake | Not allowed | Allowed | Not allowed | Allowed |
| Send to review | Not allowed | Allowed | Not allowed | Allowed |
| Send back | Not allowed | Allowed | Allowed | Allowed |
| Approve | Not allowed | Not allowed | Allowed | Allowed |
| Activate | Not allowed | Not allowed | Allowed | Allowed |
| Module settings | Not allowed | Not allowed | Not allowed | Allowed |
Every module ships bundles at this granularity. Segregation-of-duties conflicts are declared as rules, with logged exceptions.
Enforcement
Checked centrally, every time
Authorisation runs through a single permission service rather than scattered checks, so what a role can do is answerable from one place.
- Permission checks resolved centrally against user, company, and codename
- Company module access separate from user module access
- Configurable password policy
- Company-level overrides on system conflict rules
Draft·asset-coordinator creates
Evidence
An audit log that cannot be edited
Platform activity is written to an append-only log, which is the difference between saying changes are tracked and being able to prove it.
- Immutable platform audit log
- Module-specific audit trails alongside it
- Segregation-of-duties exceptions recorded rather than silently granted
- Notification rules on the events that warrant attention
Treatment decision
- 1Treatment planActions with owners, priority, and due dates
- 2Action trackingStatus per action, SLA where defined
- 3ReassessmentResidual score recalculated after closure
Framework alignment
Works with your control frameworks
This module shares the platform control library. Map national frameworks and global standards alongside jurisdiction-specific authorities.
Solutions by role
Built for your team
See access control in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.