Members

Use Members to review who has portal access and what they can do. Keep the list aligned with current responsibilities, including application-specific assignments.

Invite a member

Select Add member

Enter the person’s work email and name. Select their first role. This role is their starting role, not their only role.

Review the new row

VeriProof adds a pending member and sends an invitation through the organization’s configured email service. Invitations are access messages. Optional notification schedules do not suppress them.

Confirm the email, starting role, and status shown in the member list. If delivery fails, correct the organization’s email configuration and select Resend.

Confirm first access

The member signs in with the invited address through the organization’s identity provider. The invitation contains no access credential and does not bypass sign-in checks. Review Last login after sign-in to confirm that the intended account reached the organization.

Recover account access

VeriProof does not create or store member passwords. A member who cannot sign in resets their password, multifactor method, or recovery method through the organization’s Microsoft Entra ID or Okta support process. VeriProof administrators cannot view or reset those credentials.

If the identity provider confirms the member’s access but VeriProof still denies sign-in, confirm that the invited email exactly matches the verified provider email and that the member remains active. Keep a tested administrator recovery account available before changing SSO configuration.

Change or remove access

Open Team, find the member, and select Manage roles. You can assign any combination of Administrator, Developer, Governance Engineer, Compliance Officer, Business Owner, and Auditor.

Each member has one default role for sign-in and one active role per request. Selecting another active role changes the available work and permissions. It does not combine permissions from assigned roles.

For SDK package access, assigning the Developer role starts access setup. Removing that role or deactivating the member removes package access after current credentials expire. Restoring an active Developer role restores access while the organization is active. Review the result under Tools and SDKs.

To remove a default role, first select another assigned role as the default. VeriProof also rejects a change that would leave the organization without an active built-in Administrator.

End a role on a date

Use an end date for temporary access, such as a contractor, a cover period, or a time-boxed audit.

Open the member’s roles

Find the member and select Manage roles.

Set the end date

Under the role, select Set end date. Choose a date and time in the future in Role ends, then select Save end date. The role shows Ends with the date.

Change or remove it later

Select Change end date or Remove end date. Each change is recorded in the access log.

After the end date, the role gives no access, the same as a removed role. The member keeps their other current roles. If the ended role was their default, another current role stands in until you choose a new default. Decisions already made with the role stay attributed to it.

Some roles can’t have an end date:

Built-in Administrator roles, so the organization can’t lose its administrators without anyone noticing.
Roles your identity provider assigns through group mapping. End those by changing the group mapping.

Removing a member ends that person’s VeriProof organization access. Confirm the account and transfer assigned work before you continue.

Assign all roles to one member

Small teams can assign all six roles to one member. Select Assign remaining roles in Manage roles, then review the default role.

This option supports early operation, but it does not satisfy decisions that require another person. Production promotion, risk acceptance, policy exceptions, purge approval, and required production approvals remain blocked until another eligible member participates.

Review decisions keep working. If an Administrator turns on separation of duties and the application owner is the only eligible reviewer, the owner confirms before deciding, and the decision records that another reviewer wasn’t available.

Assign a Decision Reviewer

Create the maintained Decision Reviewer template under Settings → Team → Role defaults. Reuse that role for every person who has the same decision authority.

When you assign the role, select one or more applications for that person. Search the list by application name, then check the selections before saving.

Different reviewers can use the same role with different application selections. Removing an application, the role, or a required permission removes that review access.

Set application access

Built-in roles use their defined application scope. A custom role can require selected applications. VeriProof requires at least one application when you assign that custom role.

Use Group Access & App Restrictions for direct or group-based application boundaries. The member’s active role still determines which actions are available.

Allow prompt editing

Use Settings → Team → Members → Application prompt editing to grant prompt editing for selected applications. This capability is separate from managed roles. It does not add Governance Engineer work or permissions.

Review access regularly

Check inactive accounts and unexpected last-sign-in dates.
Review assigned and default roles when responsibilities change.
Remove access promptly when a person leaves the organization or no longer needs VeriProof.
Keep administrator recovery access tested.

For the standard permission matrix, see Roles & Permissions.