Configuring Attribute-Based Access Control (ABAC) Assignments for Workflows

Important:

The Attribute-Based Access Control (ABAC) Phase 1: Foundations feature is under Public Preview. Please contact OneTrust Support to request early access.

Workflows can influence assignment-based access in two ways. A workflow stage can directly grant an assignment while a record is in a specific stage, or it can automatically update user attributes that are associated with assignments. Together, these capabilities help ensure the appropriate users receive access and ownership responsibilities at the right point in a business process.

This article explains how to configure workflow assignments and automate assignment-related activities through workflow rules.

To assign an assignment to a workflow stage

You can associate an assignment with a workflow stage to automatically grant access when a record enters that stage. Unlike user attribute assignments, which grant access through ownership or responsibility relationships, workflow assignments grant access only while a record remains in the configured workflow stage. When the record progresses to another stage, the workflow assignment is automatically removed.

  1. Verify that the required assignment has already been created, configured with the Workflows access option, and activated. Only assignments configured with the Workflows access option can be used within workflow stages.
    Note:

    The following objects support workflow-based access: AI Agents, AI Models, AI Systems, Controls, Exceptions, Issues, Policies, Privacy Notices, Procedures, Projects, Risks, Standards.

    The examples in this procedure use a custom Risk Treatment assignment configured for the risks object.



  2. Navigate to the workflow that you want to configure.
  3. Click the stage of the workflow for which you want to assign an assignment.
  4. On the Stage details tab, scroll down to the Select assignment section and complete the following fields:


    Field
    Description
    Assignment

    Select the assignment that you want to assign to the workflow stage. When an assignment is selected, the configured approver(s) will automatically receive the permissions defined by the assignment.

    Approvers

    Select between whether a specific user/user group will be added as an approver of the stage or whether a specific user attribute will dynamically determine who is added as an approver.

    • If User/user group is selected, select the appropriate user or user group.

    • If User attribute is selected, select the appropriate attribute.

  5. Click the Save button. When a record enters the configured workflow stage, the defined users automatically receive the permissions associated with the assignment. Access will not be granted before the record progresses to the specific stage. Access is removed when the record progresses to another stage of the workflow.
    Note:

    The workflow must be activated and applied to the record for the assignment to take effect. Workflow assignments are not applied retroactively. For example, if an assignment is added to stage C, records already in stage C will not receive the assignment; only records that subsequently progress into stage C will receive it.

To create a workflow stage rule for user attribute assignment

You can create workflow stage rules that automatically update user attributes based on record data. This allows organizations to automate ownership and responsibility assignments rather than requiring users to manually update attributes on each record.

For example, a vendor with High AI Use may require additional business review. Rather than manually assigning a Business Owner to each vendor record, a workflow rule can automatically populate the Business Owner attribute when the specified conditions are met.

Note:

The examples in this procedure demonstrate the High AI Use use case.

  1. Verify that the assignment is created, configured with the User attributes access option, and activated.


  2. Verify that a corresponding attribute exists within the Attribute manager for that object and is associated with that assignment.


  3. Navigate to the workflow that you want to configure.
  4. Click the stage of the workflow for which you want to configure a workflow stage rule for an assignment.


  5. Click the Stage rules tab, and click the Add rule button. The stage rule block appears for you to define rules with conditions and actions to assign user attributes.


  6. Complete the following fields to configure the stage rule:


    Field
    Description
    Rule name

    Enter a name for the stage rule.

    Conditions Block

    Trigger

    Value

    Select the attribute that will trigger the rule.

    Operator

    Select the relationship that must be met between the trigger and the value.

    Value

    Select the attribute value that will trigger the rule.

    Action

    Select Update attribute.

    Attribute(s)

    Select the attribute associated with the assignment and the user who should be assigned the assignment when the condition is met.

  7. Click the Save button. When a record reaches the workflow stage and the configured conditions are met, the workflow automatically updates the specified attribute. The assignment associated with that attribute is then applied automatically to the designated user whenever the attribute is populated by the workflow stage rule.

Additional Resources

For a complete list of ABAC resources, see the Attribute-Based Access Control (ABAC) User Guide, which includes foundational concepts, implementation guidance, and solution-specific documentation.

To continue configuring and managing ABAC, reference the following procedural configuration articles: