Roles and permissions

Use Roles and permissions to see what each role can do and who has it. Before changing a shared role, review everyone assigned to it. Editing a role and changing one member’s assignment have different effects.

When role customization is unavailable, Role permissions are read-only. Assign the standard role that grants only the access each person needs.

Choose a view

• Per role shows permissions and assigned members for one role at a time.
• Role templates provides starting permissions for a specialized role. Review them before creating the role.
• Compare roles shows differences side by side. Filter by category or role, or show only modified permissions.

Assign a role safely

Use the Decision Reviewer template

Use Decision Reviewer for a subject-matter expert who records assigned business decisions for selected applications. Use Business Owner when the person also needs business outcome and portfolio views. Use Compliance Officer for regulatory oversight and compliance administration.

Create one Decision Reviewer role and reuse it for reviewers across your organization. Give each person only the applications they review. Every assignment requires at least one selected application. The reviewer sees only current assigned work within that scope. Removing the role, a required permission, or an application removes review access immediately.

Assign the role through Settings → Team → Members and select the person’s application access. Do not assume membership in an identity-provider group grants the required VeriProof role or application scope. Check the saved assignment in VeriProof. Separation-of-duties rules still apply. A requester cannot review their own action when the workflow prohibits it.

The template does not grant policy, application, integration, user, export, routing, continuation, or technical recovery access. Sensitive or technical evidence requires a separate explicit permission.

Use Members to assign applications. Review and respond explains how reviewers record a decision and confirm it was saved.

Assign policy responsibilities

Use these templates for Rego policy work:

• Policy author describes, validates, and tests policy behavior.
• Policy author and publisher also activates tested policy in Shadow. A small organization can assign this template to one authorized Governance Engineer.
• Policy approver reviews and approves an exact deployment request.

Governance Engineers can activate tested rules in Shadow by default. They do not receive direct Enforced deployment authority by default. Administrators and Compliance Officers can approve policy enforcement by default.

Choose the organization change-control profile in Organization controls:

• Streamlined permits an authorized publisher to deploy directly.
• Controlled requires one independent approval for Enforced deployment.
• Regulated requires approval for Shadow and two independent approvals for Enforced deployment.

The requester cannot approve their own deployment when independent approval is required. The production-write lock remains a stronger control.