Create and manage access profiles

Custom access profiles combine GRC and TIEM operational permissions into a set suited to a person's work. Each profile belongs to one organization and does not grant administrative authority.

What you will do

You will select an organization, define the access level for each function, review sensitive actions, and save a profile that can be assigned to users in that organization.

Who can do this

A Group Administrator can manage profiles in organizations linked to their group. An Organization Administrator can manage profiles in their own organization. The displayed organizations, modules, and actions respect the current profile's reach.

Before you start

• Confirm the active workspace or organization in the platform selector.
• Define the responsibilities the new profile must support.
• Check which modules are enabled for the organization. A module that is not contracted or is disabled does not appear in the editor.
• Prefer the smallest permission set required for the work.

Menu path

In the main menu, select Admin → Access profiles.

Steps

Select the organization

1. Find the organization in the table. On a small screen, each organization appears as a card.
2. Use Find an organization when necessary. Search and pagination query the server and show only organizations you can administer.
3. The list starts with 10 organizations per page. You can select 50 or 100.
4. Check the enabled modules and select the organization's pencil icon.

If the organization has no enabled modules, existing profiles can still be viewed, but profile creation is unavailable.

Create or edit a profile

1. On the organization page, select Create profile. To change an existing custom profile, open its details and select Edit.

2. Enter a clear name and a description that explains the profile's purpose.

3. Expand the module you want to configure. Each row represents a business function.

4. Choose one level for each function:

   • No access removes the function's permissions when no other selected permission requires them.
   • Read only allows the user to view available information.
   • Manage includes reading and the available maintenance actions.

   For Assessments, managing also requires reading responses and maturity. The editor adds these permissions automatically and does not let you remove them while management remains selected.

5. Review sensitive actions. When you choose Manage, eligible sensitive actions are selected automatically, but you can clear one to create an explicit exception. If a lower level is disabled, another selected permission requires that access. Reduce or remove the dependent permission first; the editor will not remove it automatically.

6. Repeat the configuration for the required modules. Modules start collapsed to simplify navigation.

7. Select Review changes. Check the profile, organization, added or removed permissions, exceptions, and required adjustments.

8. If the summary is correct, select Confirm and save. This is the single confirmation for the complete set.

The summary uses descriptive names, such as Edit vendors. You do not need to know technical identifiers.

Understand standard and custom profiles

• The Standard label identifies profiles supplied by the platform. They can be viewed but not edited.
• An active custom profile can be edited and assigned while it remains available in the organization.
• An Archived profile is view-only and cannot receive new assignments.
• Permissions added to the platform in the future do not automatically expand an already saved custom profile.

Copy, archive, or delete

• Use Copy profile to create an independent profile with the same permissions. The destination organization needs at least one enabled module and every module used by the original profile's permissions. If any is missing, the copy is rejected without dropping permissions. Review the new name; copying does not change already assigned users.
• Before archiving, remove or replace every active, invited, or suspended assignment. Archiving prevents new assignments.
• Delete profile is available only for a custom profile that is already archived and has no assignments. Deletion is permanent; check the summary before confirming.

Assign the profile to a user

After saving the profile, go to Admin → Users, open the person, and add or edit access for the corresponding organization. Select the custom profile and save. See Manage users and access for the full workflow.

Expected result

The profile appears on the organization's page with its corresponding state. Assigned users receive only the saved permissions, limited to the enabled modules and that organization's context.

Common problems

Related tasks

• Administration overview
• Manage users and access
• Manage organizations
• View modules and licenses