Configuring Attribute-Based Access Control (ABAC) Assignments for User Attributes

Important:

The Attribute-Based Access Control (ABAC) Phase 1: Foundations feature is under Public Preview. Please contact OneTrust Support to request early access.

User attribute assignments automatically grant record-level access based on the value of a user attribute field on a record. Rather than manually sharing records with individual users, organizations can use user attributes to dynamically assign access based on ownership, responsibility, or other business relationships.

Common examples include granting access to record owners, business owners, privacy owners, risk owners, and other designated stakeholders. When the value of a supported user attribute changes, access is automatically updated to reflect the new assignment. This article explains how to associate assignments with user attribute fields and manage user attribute-based access at scale.

To assign an assignment to a user attribute

You can associate an assignment with a user attribute field to automatically grant the permissions defined by that assignment to users assigned to the attribute.

  1. Verify that the required assignment has already been created, configured with the User attributes access option, and activated.
    Note:

    The examples in this procedure use a custom Contract Owner assignment configured for the engagements object.



  2. Navigate to the Attribute manager screen that has the user attribute for which you want to assign an assignment. Then click the View button for the attribute type you want to configure.


  3. Select the user attribute for which you want to assign an assignment. You can create a new attribute for the assignment or assign it to an existing attribute with the System list > System users configuration.
    New attribute

    Click theAdd attributebutton to create a new attribute to assign the assignment. TheAdd attributemodal appears, where you can configure the following details:



    Field
    Description
    Name

    Enter a name of the attribute.

    Description

    Enter a brief description of the attribute.

    Response type

    Select Single Select as the type of response which should be associated with the attribute.

    Allow other

    Select this check box to allow users to select Other as an option for the attribute value.

    Required

    Select this check box to make the attribute a required field.

    System list

    Select the System list option to access the System list field and select Users.

    Select assignment

    Select the assignment that you want to assign to the user attribute.

    Existing attribute

    Select the existing attribute, and click theEditbutton on theAttribute detailsscreen. Then select the assignment that you want to assign to the user attribute in theSelect assignmentfield on theEdit attribute detailsmodal.



  4. Click the Save button. The assignment is assigned to the attribute. Users assigned to that attribute will automatically receive the permissions defined by the assignment.

To update user attribute assignments on a record

You can update user attribute assignments on a record when ownership, responsibility, or access requirements change. Updating the user assigned to an attribute automatically updates the record-level permissions associated with that assignment.

  1. Open the record you want to update.
  2. Locate the attribute you created with the associated assignment.
  3. In the respective attribute field, select the user who should be assigned the assignment.
    Note:

    In this example, we will update the Contract Owner attribute to Clara Braden.



  4. Click the Save button. Access is automatically updated for that user based on the assignment.
    Note:

    In this example, Clara Braden's access is automatically updated with the permissions defined by the Contract Owner assignment.

To bulk update user attribute assignments across multiple records

You can bulk update user attribute assignments when changes need to be applied across multiple records. This approach helps administrators update assignment-based access at scale rather than modifying records individually.

  1. Export the list screen for the object records you want to update.
  2. Click the Notifications icon in the upper right-hand corner, and click the export to download the file to your local system. Then open the exported file.
    Note:

    In this example, we will export the Engagements list screen.



  3. Click the gear icon in the upper right-hand corner to access Global Settings.
  4. On the Global Settings menu, select Data import > Import templates. The Import templates screen appears.


  5. Click the Download template button for the import template corresponding to the records you want to update.
    Note:

    In this example, we will download the Update engagements import template.

  6. Open the import template and complete the update template spreadsheet. Reference the data from the exported file to populate the template.
  7. Update the email address in the assignment-related column associated with the user attribute.
    Note:

    In this example, if we wanted to assign Clara Braden with the Internal owner assignment for these engagement records, we would enter her email address in the Internal owner column within the Update engagements import template spreadsheet.



  8. Save the import template file and navigate back to Global Settings in the OneTrust Platform.
  9. On the Global Settings menu, select Data import > Bulk import. The Bulk import screen appears.

  10. Click the New import button. The New import modal appears where you will complete the following fields:


    Field
    Description
    Import name

    Enter a name for the import.

    Import description

    Enter a brief description for the import.

    Import type

    Select the type of import which corresponds to the template you are using.

    File

    Click the Upload file button. Use the file explorer to select the spreadsheet you want to upload.

  11. Click the Submit button. Once the import successfully completes, access is automatically updated based on the new user attribute values across all affected records. You can navigate back to the respective object list screen to view those changes.

Additional Resources

For a complete list of ABAC resources, see the Attribute-Based Access Control (ABAC) User Guide, which includes foundational concepts, implementation guidance, and solution-specific documentation.

To continue configuring and managing ABAC, reference the following procedural configuration articles: