Permissions Release Notes: Third-Party Risk Exchange

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

OneTrust is implementing new permission controls for Invited Users and Project Respondents to align front-end access controls with back-end API behaviors. This update ensures that low-privilege users cannot access metadata or assessment content outside their assigned scope. A new permission will be available for customers who need to restore the broader access level previously granted to their Invited Users.

No action is required unless you want Invited Users to retain their previous access. If you want Invited Users to retain their previous access, you can assign the newly introduced Advanced assessment metadata permission manually to a custom copy of the Invited User role after the change goes live in OneTrust 202601.2.0. Those users with the Invited User role will then need to be reassigned to the custom invited user role with the new permission.

For more information, see Assessments – Invited User Security Enhancements, Invited Users FAQ, and Project Respondents FAQ. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

The following permissions have been removed from the platform or removed from select system roles as defined below:

The following system roles have been updated as defined below: