Managing Attribute-Based Access Control (ABAC) for Privacy Automation

Overview

In ABAC Phase 1: Foundations, Attribute-Based Access Control (ABAC) for Privacy Automation enables organizations to provide record-level access to privacy records without granting broad access across the entire solution. By combining role-based access with assignments and sharing, organizations can support secure collaboration across privacy assessments, inventory records, risks, and related workflows while maintaining least-privilege access.

ABAC is particularly valuable for organizations with dynamic and less predictable access patterns, where different users may need to participate in the same assessment with different levels of visibility, responsibility, and access throughout the assessment lifecycle.

Privacy programs often involve privacy managers, respondents, approvers, risk owners, legal counsel, auditors, and business stakeholders who require access to specific records, but not every assessment or privacy record in the system. ABAC helps organizations provide targeted access while reducing reliance on broader permissions and custom roles.

How ABAC Works in Privacy Automation

In Privacy Automation, ABAC is primarily centered around assessments and combines field-level system assignments and sharing-based access. Assignments determine what users can access and what actions they can perform on a specific assessment or related record.

Field-level assignments are used for core responsibilities on the assessment itself. These assignments are system-defined and locked, and cannot be modified, so their meaning stays consistent across the tenant. Users cannot create new field-level assignments at this time.

Some assignments are associated with fields on the assessment itself, such as Assessment Respondent or Assessment Approver, while others are applied through sharing and access management. This allows multiple users to participate in the same assessment while receiving access tailored to their responsibilities.

For example:

A user assigned through the locked Assessment Respondent system assignment can answer questions and submit evidence, but the assignment does not grant approval permissions.
A user assigned through the locked Assessment Approver system assignment can review and approve or reject an assessment but the assignment does not grant permission to perform unrelated actions.
A subject matter expert can contribute comments or supporting information without being designated as a respondent or approver.
An auditor can be granted view-only access to review completed assessments and supporting evidence.

ABAC shifts assessment collaboration from a model of broad permissions and fixed access patterns to one that is record-specific, configurable, and aligned to the user's role in the workflow.

Common Use Cases

Use cases describe the most common business scenarios where ABAC helps teams collaborate on records while maintaining least-privilege access. The examples below highlight how organizations can use ABAC to provide the right users with access to the right records at the right time.


Use Case	How ABAC Helps
Assessment Sharing and Collaboration	Allows privacy managers to share a specific assessment with reviewers and stakeholders without granting broader access to all assessments within an organization, sub-organziation, or tenant. This helps organizations reduce the risk of accidental data breaches or leaks. Example personas include: Privacy team members, business owners, legal reviewers, security reviewers, assessment coordinators, program stakeholders.
Restricted External Respondent Access	Enables organizations to give external respondents access only to the specific assessments they need to complete and submit evidence for, while restricting visibility into comments, risks, activity history, and other assessment information outside their role. This helps organizations reduce the risk of accidental data breaches or leaks. Example personas include: Vendor contacts, supplier security contacts, external partners, external consultants.
Approval Workflows	Allows organizations to grant approvers access to specific assessments for review and approval while limiting access to the permissions required for that workflow, rather than granting broader access across the privacy program. Example personas include: Privacy reviewers, legal reviewers, security reviewers, risk reviewers, business reviewers.
Audit and Compliance Reviews	Provides auditors, regulators, and stakeholders with read-only access to completed assessments and supporting documentation. Example personas include: Internal auditors, external auditors, regulators, compliance reviewers, stakeholders.
Subject Matter Expert Contributions	Enables legal, security, privacy, and business stakeholders to contribute to assessments without requiring respondent or approval permissions. Example personas include: Legal SMEs, security SMEs, privacy SMEs, business SMEs, technical SMEs.

Key Workflows Impacted by ABAC

ABAC introduces record-level access controls within existing solution workflows. The following workflows are commonly impacted by ABAC and may change how users access, review, and collaborate on records.


Workflow	How ABAC Changes the Experience
Assessment Launch and Assignment	Users can be assigned to assessments through record fields and receive access appropriate to their role in the assessment process.
Assessment Collaboration	Stakeholders can be granted access through assignments and sharing rather than requiring broad solution-level permissions, reducing the risk of potential data leaks.
Questionnaire Completion	Respondents can complete questionnaires and submit evidence while ABAC limits their visibility to just the assessment information required for their role.
Review and Approval	Approvers can review, approve, reject, or request information on assigned assessments using the permissions defined for the Assessment Approver assignment, including assessments outside their role-based organization access.
Risk Evaluation	IT Risk Owners can evaluate and manage risks associated with specific assessments without requiring broader access across the privacy program.
Audit and Compliance Reviews	Auditors and regulators can review completed assessments using read-only access configured through assignments.
Access Management	Record owners can grant and manage access to individual records without requiring changes to tenant-wide roles.

Privacy Automation-Specific Considerations

Privacy Automation includes user attribute assignments and sharing-based assignments that map to common assessment responsibilities and collaboration scenarios. User attribute assignments are tied to assessment attributes and represent common workflow responsibilities, while sharing-based assignments support broader collaboration scenarios beyond those assignment-driven relationships.
System assignments tied to assessment attributes are not customizable, to preserve consistency across the tenant. Organizations that require different operational, audit, review, or stakeholder access models should use sharing-based assignments rather than creating alternative assignment models for those assessment responsibilities.
Assessment Creator, Assessment Respondent, and Assessment Approver are locked system assignments with predefined behavior intended to remain consistent across assessment workflows. These assignments are associated with assessment attributes and are automatically managed through assessment participation and workflow activities.
Other assignments, such as Risk owner, Viewer, Collaborator, Record admin, and Custom assignments provide greater flexibility and can support different collaboration models depending on organizational requirements.
A key benefit of ABAC in Privacy Automation is the ability to provide multiple users with different access experiences on the same assessment record through a combination of system assignments and sharing-based access. For example, a Viewer or Collaborator may receive access through sharing, a Risk owner may receive risk-related access through an assessment attribute, and an Assessment Respondent may complete the questionnaire through the locked system assignment. Each user has visibility and functionality appropriate to their assignment.
Assessments have unique access-control considerations compared to other ABAC-supported objects. For more information about assessment-specific behaviors, supported assignment models, and current limitations, see Assessment Considerations for Attribute-Based Access Control (ABAC).

Supported Objects, Attributes & System Assignments

This section provides a reference for the objects that support ABAC within this solution and the system assignments that can be used to grant record-level access. Supported objects and assignments can be found by navigating to the Assignments screen in Global Settings. For more information, see Managing Assignments with Attribute-Based Access Control (ABAC).

Supported Objects

The following objects support ABAC within Privacy Automation and can be configured using supported ABAC capabilities: Assessments, Assets, Entities, Processing activities, Vendors.

Note:

Data Subject Rights Requests and Incidents are not currently supported. For more information, see Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC).

Supported Attributes

The following attributes support assignment-based access and can be used to automatically grant record-level permissions based on ownership, responsibility, participation, or other user relationships. Attributes are organized by object and divided into standard and advanced attribute categories.


Object	Standard	Advanced
Assessments	Comments, Deadline, Description, Name, Organization.Template, RecordAdmin, Reminder, Respondents, Send Email to, Tags, Workflow	Approval Stage, Approver, Assessment Delete Status, Assessment Result, Creator, Date Completed, Date Created, Date Deleted, Date Submitted, Deleted By, ID, Inherent Risk Level, Inherent Risk Score, Open Info Request Count, Open Issue Count, Open Risk Count, Pending Reviews, Residual Risk Level, Residual Risk Score, Stage, Target Risk Level, Target Risk Score, Template Version, Updated Date
Assets	Created By, Created Date, Hosting Location, IT Owner, Last Updated By, Last Updated Date, Managing Organization, Name, Status, Type	All system and custom attributes.
Entities	Created By, Created Date, Last Updated By, Last Updated Date, Legal Entity Owner, Name, Organization, Primary Operating Location, Status, Type	All system and custom attributes
Processing activities	Business Process Owner, Created By, Created Date, Last Updated By, Last Updated Date, Managing Organization, Name, Status	All system and custom attributes.
Vendors	Business Owner, Created By, Created Date, Last Updated By, Last Updated Date, Name, Organization, Primary Vendor Contact, Status, Type, Vendor Workflow, Vendor Workflow Stage	All system and custom attributes.

System Assignments

The following system assignments are available out of the box and can be used to grant access based on common ownership, collaboration, review, approval, and access-management responsibilities.


System Assignment	Assignment Description	Access Options	Applicable Objects
Assessment approver	Allows user to approve/reject an assessment.	User attributes	Assessments
Assessment creator	Creator of the assessment.	User attributes	Assessments
Assessment respondent	Allows user to respond to the assessments.	Allows user to respond to the assessments	Assessments
Business owner	Permits user to edit, delete, and reassign a record.	User attributes	Processing activities, Vendors
Collaborator	Allows the user to view the assessment and leave a comment on it.	Sharing	Assessments
Editor	Grants permission to edit and view a record.	Sharing	Assets, Entities, Processing activities, Vendors
Legal entity owner	Permits user to edit, delete, and reassign a record.	User attributes	Entities
Record admin	Allows user to edit, delete, and reassign a record. For more information, see Managing Record Admins & Ownership with Attribute-Based Access Control (ABAC).	Sharing	Assessments, Assets, Entities, Processing activities, Vendors
Risk owner	A risk owner manages a specific risk, implements treatment plans, and ensures that necessary actions are taken to mitigate the risk.	User attributes	Assessments
Technical owner	Permits the user to edit, delete, and reassign a record.	User attributes	Assets
Viewer	Gives ability to view a record.	Sharing	Assessments, Assets, Entities, Processing activities, Vendors

Additional Resources

For a complete list of ABAC resources, see the Attribute-Based Access Control (ABAC) User Guide, which includes foundational concepts, implementation guidance, and procedural configuration articles.

To learn how ABAC is implemented across other OneTrust solutions, explore the following solution-specific articles:

Settings & Administration