Roles & Permissions (RBAC)

Veriproof uses role-based access control (RBAC) to restrict portal features to the users who need them. Every user in your tenant has exactly one primary role set at invitation time.

The Six Customer Roles

CustomerAdmin

Full administrative access to the tenant. The CustomerAdmin can:

• Invite, deactivate, and manage all users
• Assign and revoke roles for any user
• Create, update, and delete applications
• Configure SSO, webhooks, notification channels, and API keys
• Set cost budgets and spend alerts
• Initiate data deletion and purge workflows
• View all audit logs and compliance reports
• Generate evidence packages and sign off on session reviews

CustomerDeveloper

Focused on SDK integration, trace tooling, and AI application development. A Developer can:

• Register and manage AI applications
• Generate and rotate application API keys
• Configure SDK adapters and trace settings
• View full session traces and use the Time Machine
• Run experiments in the Prompt Playground
• Create and manage evaluation datasets
• View SDK Health and adapter diagnostics
• View and configure alert rules for their applications

Restrictions: read-only access on Production applications — cannot activate rule changes or configuration updates in Production without an Admin or Compliance Officer approval. Cannot manage users, billing, or compliance engagements.

CustomerGovernanceEngineer

Focused on governance model configuration and rule authoring. A Governance Engineer can:

• Draft and test metric rules and Rego policy rules across all environments
• Submit Production rule or configuration changes for Admin / Compliance Officer approval
• View and compare rule template versions
• View all session traces, dashboard analytics, and governance trends
• Access SDK Health and adapter diagnostics
• View vocabulary browser and evaluation datasets

Production write restriction: A Governance Engineer can author and activate rules in Sandbox and Development environments without approval. Production changes require an explicit approval from a CustomerAdmin or CustomerComplianceOfficer via the change-control workflow. This role was previously labelled Platform Engineer in early access; documentation and support tickets may still use that name.

CustomerComplianceOfficer

Focused on governance and evidential operations. A Compliance Officer can:

• Review and approve/reject session annotations
• Generate governance reports and evidence packages
• Manage GDPR erasure requests and legal holds
• View compliance scores, policy configurations, and audit trails
• Schedule automated compliance report exports
• Access AI Act, NIST AI RMF, and HIPAA/SOC 2 dashboards

Cannot invite users, change billing settings, or modify SSO configuration.

CustomerBusinessOwner

Focused on business metrics and cost oversight. A Business Owner can:

• View dashboards, analytics, and ROI reports
• Create and manage cost budgets and spend alerts
• View session volume trends and plan usage
• Access Business Outcome and DVR portfolio summaries

Cannot view session-level evidence, governance details, or manage users.

CustomerAuditor

Read-only access plus participation in formal audit engagements. An Auditor can:

• Browse sessions, applications, dashboards, and compliance scores (read-only)
• Access active audit engagements assigned to them
• Submit attestations against compliance controls
• Sign evidence packages during an engagement period
• Access auditor-specific evidence views

This role is typically assigned to external auditors or internal audit staff. It was previously labelled CustomerViewer — the legacy alias is still accepted in the API and SSO claim mappers for backward-compatibility, but all new assignments should use CustomerAuditor.

Role Permissions Matrix

⁺ Production draft requires approval. Governance Engineers can submit Production rule and configuration changes, but those changes enter a pending state until approved by a CustomerAdmin or CustomerComplianceOfficer.

Assigning a Role

API

GET    /v1/users/{userId}/role-assignments
POST   /v1/users/{userId}/role-assignments
DELETE /v1/users/{userId}/role-assignments/{id}

To grant a role via the API:

POST /v1/users/{userId}/role-assignments
Content-Type: application/json
 
{
  "role": "CustomerComplianceOfficer"
}

To list all role assignments across the entire tenant (CustomerAdmin only):

GET /v1/users/role-assignments

Revoking a Role

1. Open the user’s profile in Settings → Members.
2. Click the Roles tab.
3. Click the × next to the role you want to remove.
4. Confirm the revocation.

Role revocation takes effect on the user’s next request. Any active browser session they have open will enforce the updated permissions without requiring them to log out.

Default Role for New Invitations

When inviting a new user, the system defaults to CustomerAuditor — the least-privilege role. Elevate the role during invitation (or afterwards) only when the user’s responsibilities require it.

Multiple Roles

A user can hold more than one role simultaneously. Role grants are additive — the effective permission set is the union of all granted roles. For example, a user with both CustomerViewer and CustomerAuditor has auditor-level access in addition to standard read access.