Assessment Considerations for Attribute-Based Access Control (ABAC)

Important:

The Attribute-Based Access Control (ABAC) Phase 1: Foundations feature is under Public Preview. Please contact OneTrust Support to request early access.

Assessments have unique access-control requirements compared to other ABAC-supported objects because access is often driven by assessment participation, responses, and approval activities. As a result, assessments use a specialized ABAC model that preserves the workflows and participant-based access patterns organizations rely on today while introducing stronger governance and access controls.

This approach is intentional and focuses on delivering the right controls for assessments while establishing a foundation for future enhancements.

Key Differences with Assessments

Since assessments are structurally different from other OneTrust objects, some aspects of the ABAC experience are intentionally tailored to assessment workflows and participant-based access models.

Key differences include:

Assessments have unique access-control considerations because access is often driven by assessment participation and assessment responsibilities rather than record ownership alone.
Drop-down lists within assessments (excluding Third-Party Management assessments) will not reflect least-privileged visibility or assignment-based visibility when selecting inventory records, pick-list values, or related objects.
Customers cannot create custom ABAC assignments or policies for assessment participant attributes such as Respondent and Approver. Instead, assessments use seeded assignment models tied to the Respondent and Approver attributes. These seeded assignments are automatically managed through assessment participation and workflow activities and cannot be manually granted through the Manage Access modal alongside standard ABAC assignments.
Users assigned as assessment Approvers automatically receive access through the seeded Approver assignment when participating in assessment approval activities. Customers can use this built-in approval experience but cannot replace it with custom approver assignments or alternative approval-related access models at this time.

What does this mean?

Customers should expect assessment access to work differently from many other ABAC-supported objects at this time. Rather than relying on custom user attribute assignments, assessment access is primarily managed through seeded Respondent and Approver assignment models.

Customers should expect the following:

Respondent and Approver access is managed through the seeded assessment experience and automatically assigned through assessment participation and workflow activities. These assignments cannot be manually granted through the Manage Access modal like standard ABAC assignments.
Custom assignments can still be created and used with assessments; however, they are supported through sharing-based access rather than custom user attribute assignments. Customers cannot attach custom assignments to assessment participant attributes such as Respondent and Approver.
Users may see assessment participant assignments behave differently from standard ABAC assignments because they are tied to assessment-specific workflows and participation models.
Assessment access controls are designed to preserve existing assessment processes while introducing more consistent record-level governance and access management.

Assignment and Access Support in ABAC Phase 1: Foundations

Unlike many ABAC-supported objects, assessments use a more prescriptive access model centered around assessment participation roles. The following table summarizes which assignment and access models are available at this time and how they affect assessment access.


Capability	ABAC Phase 1 Behavior
Assessment Respondent access	Supported through the seeded Respondent assignment model.
Assessment Approver access	Supported through seeded Approver assignments and workflow approvals.
Sharing-based access	Supported. Users can be granted access through sharing assignments.
Custom user attribute assignments for Respondents	Not supported. Customers cannot create custom ABAC assignments or policies tied to Respondent attributes.
Custom user attribute assignments for Approvers	Not supported. Customers cannot create custom ABAC assignments or policies tied to Approver attributes.
Assignment-based filtering in assessment drop-down lists*	Not supported.
Custom assessment participant assignment models	Not supported. Assessment participant access is limited to the seeded Respondent and Approver experiences provided by OneTrust.

* Applies to assessment drop-down selections outside of Third-Party Management (TPM) assessments.

OneTrust's Recommendations

When planning your ABAC rollout for assessments, focus on understanding which capabilities are attribute-driven today and which continue to rely on seeded assignments or sharing-based access. Organizations should:

Recognize that assessments are unique and therefore require a specialized ABAC implementation.
Review supported ABAC behaviors before designing access models for assessment workflows.
Continue using sharing mechanisms where custom assignment scenarios are required.
Ensure users understand how assessment access controls differ from other ABAC-enabled objects.

Assessments are designed to balance stronger governance and record-level access controls with compatibility for existing assessment workflows. Organizations should plan to use seeded Respondent and Approver assignment models for assessment participation and leverage sharing-based assignments when additional access scenarios are required.

Settings & Administration

Assessment Considerations for Attribute-Based Access Control (ABAC)

Key Differences with Assessments

What does this mean?

Assignment and Access Support in ABAC Phase 1: Foundations

OneTrust's Recommendations

Continue Your ABAC Journey

Recommended Next Article

ABAC Learning Path

In this Topic