Managing Assignments with Attribute-Based Access Control (ABAC)

Important:

The Attribute-Based Access Control (ABAC) Phase 1: Foundations feature is under Public Preview. Please contact OneTrust Support to request early access.

Assignments are a core component of Attribute-Based Access Control (ABAC) and help define what users can do on specific records throughout the OneTrust Platform. An assignment is an administrator-configured permission set that determines what assigned or shared users can do on a record, including viewing, editing, deleting, sharing, or managing access. Assignments can be used across sharing, attributes, and workflow-based access scenarios to support least-privileged access and collaboration.

This article explains how to create, modify, duplicate, deactivate, and delete assignments as your organization's access-control requirements evolve.

Note:

The procedures in this article follow the same process for all supported objects, but the available configuration options are object-specific. Depending on the selected object, you may see different linked objects, supporting objects, permissions, workflow actions, and sharing settings throughout the configuration process.

To view system assignments

You can view system assignments to review the out-of-the-box permission sets provided by OneTrust for a supported object. These assignments can be used directly or duplicated to create customized versions; however, the original system assignments cannot be edited or deleted.

Click the gear icon in the upper right-hand corner to access Global Settings.
On the Global Settings menu, select User management > Assignments. The Assignments screen appears.
Select the tab corresponding to the solution for which you want to view assignments. The objects supported by each solution appear on the corresponding tab. You can also find the number of system assignments predefined by OneTrust and the number of custom assignments created across your organization for each object listed within the solution.

Note:
Some objects may be shared across multiple solutions. When an object is used by multiple solutions, the same ABAC assignments and permissions apply regardless of where the object is accessed, helping create a consistent security model across the platform.
Click the object for which you want to view assignments. The corresponding object screen appears with the list of assignments configured for that object. You can then click any of the assignments to review the permissions that users will receive when that assignment is used.

To create an assignment

You can create an assignment to define the permissions users receive when access is granted to a record. Assignments can be used across sharing, attributes, and workflow-based access scenarios.

Click the gear icon in the upper right-hand corner to access Global Settings.
On the Global Settings menu, select User management > Assignments. The Assignments screen appears.
Select the tab corresponding to the solution, and click the object for which you want to create assignments. The corresponding object screen appears with the list of assignments configured for that object.

Note:
The examples in this article use the Third-Party Management > Engagements object. The available objects, permissions, and settings vary depending on the object you select.
Click the Create assignment button. The Untitled assignment screen appears.
On the Add details step, enter the following details for the assignment.
Field

Description

Name

Enter a name for the assignment.

Description

Enter a description for the assignment.

Access options
Select where the assignment will appear as an access option. Access options determine where the assignment can be used within the object.

The following options are available, but the availability of these options will vary based on the object:
- Sharing: Show this assignment as an access option when sharing control records. This option is available for all objects.
- User attributes: Allow admins to apply this assignment to a user attribute on the object's details. This option is available for all objects.
- Workflows: Show this assignment in the approver settings for a workflow stage. This automatically selects the linked permissions for the approver. This option is only available for select objects.
Note:
An assignment can only be mapped to sharing, an attribute, or a workflow, but not multiple mechanisms simultaneously. If the same permissions are needed across multiple mechanisms, the assignment must be copied and configured separately for each one.
On the Set attribute permissions step, select which attributes the assignment can access. Depending on the object, attributes may be categorized as Standard attributes or Advanced attributes. The list of available attributes that appear in this step will vary by object.
On the Choose object permissions step, select object permissions for the assignment. The Linked objects and Supporting objects sections include permissions for related records that may be accessed from the selected object. You can also click the View linked permissions button to review the permissions that will be automatically assigned based on your selected object permissions.
- Linked objects permissions control how users interact with records that are linked to the selected object. Depending on the object, permissions may include the ability to create, view, link, or unlink related records.
- Supporting objects permissions control access to records that support the selected object. Depending on the object, permissions may include the ability to create, view, edit, or delete supporting records.
On the Select additional settings step, configure additional permissions for the object, including general permissions, workflow-related permissions, and sharing access permissions for the object.
On the Review assignment step, review the assignment details, permissions, and settings to confirm they meet your access requirements.
Click the Activate assignment button. The assignment is created and appears with an Active status.

Note:
Alternatively, you can click the Save and close button to save progress on the assignment creation. The assignment will appear in Inactive status.

To edit an assignment

You can edit an assignment to update the permissions it provides. Changes are applied anywhere the assignment is currently in use.

Click the gear icon in the upper right-hand corner to access Global Settings.
On the Global Settings menu, select User management > Assignments. The Assignments screen appears.
Select the tab corresponding to the solution, and click the object for which you want to edit assignments. The corresponding object screen appears with the list of assignments configured for that object.
Click the Context Menu icon corresponding to the assignment you want to edit and select Edit.
Modify the assignment, as necessary.
Click the Save button.

To duplicate an assignment

You can duplicate an assignment when you need a similar permission set without creating a new assignment from scratch. This helps standardize access models while reducing administrative effort.

Click the gear icon in the upper right-hand corner to access Global Settings.
On the Global Settings menu, select User management > Assignments. The Assignments screen appears.
Select the tab corresponding to the solution, and click the object for which you want to duplicate assignments. The corresponding object screen appears with the list of assignments configured for that object.
Click the Context Menu icon corresponding to the assignment you want to duplicate and select Duplicate.
Configure the assignment, as necessary.
Click the Activate assignment button. The assignment is created and appears with an Active status.

Note:
Alternatively, you can click the Save and close button to save progress on the assignment creation. The assignment will appear in Inactive status.

To deactivate an assignment

You can deactivate an assignment to prevent it from being used in new access configurations while preserving its configuration for future reference.

Click the gear icon in the upper right-hand corner to access Global Settings.
On the Global Settings menu, select User management > Assignments. The Assignments screen appears.
Select the tab corresponding to the solution, and click the object for which you want to deactivate assignments. The corresponding object screen appears with the list of assignments configured for that object.
Click the Context Menu icon corresponding to the assignment you want to deactivate and select Deactivate. The Deactivate assignment modal appears.
Click the Deactivate assignment button. The assignment is updated to Inactive status. Assigned users will no longer be able to access records through the assignment.

To delete an assignment

You can delete an assignment when it is no longer needed and will not be reused. Before deleting an assignment, review any existing configurations that reference it to avoid unintended access changes.

Click the gear icon in the upper right-hand corner to access Global Settings.
On the Global Settings menu, select User management > Assignments. The Assignments screen appears.
Select the tab corresponding to the solution, and click the object for which you want to delete assignments. The corresponding object screen appears with the list of assignments configured for that object.
Click the Context Menu icon corresponding to the assignment you want to delete and select Delete. The Delete assignment modal appears.
Click the Delete assignment button. The assignment is deleted. Assigned users will no longer be able to access records through the assignment.

Additional Resources

For a complete list of ABAC resources, see the Attribute-Based Access Control (ABAC) User Guide, which includes foundational concepts, implementation guidance, and solution-specific documentation.

To continue configuring and managing ABAC, reference the following procedural configuration articles:

Settings & Administration