Managing Record Admins & Ownership with Attribute-Based Access Control (ABAC)

Important:

The Attribute-Based Access Control (ABAC) Phase 1: Foundations feature is under Public Preview. Please contact OneTrust Support to request early access.

Record admins help ensure every record has a designated user responsible for managing access and responding to access requests. As records move between teams and responsibilities evolve, organizations can use access rules to automatically assign Record admin ownership to the appropriate users.

This article explains how Record admin assignments work and how to configure access rules that automatically assign Record admin responsibilities when records are created.

What is a record admin?

Record admin is a standard assignment available across all ABAC-supported objects. Users assigned as a Record admin are responsible for managing access to the specific records for which they have been granted the Record admin assignment, including reviewing, approving, and denying access requests from the Access Requests screen in Global Settings. Record admin responsibilities apply only to those records and do not grant administrative access across other records of the same object type.

By default, the user who creates a record becomes the Record admin for that record. This ensures every record has a designated user responsible for managing access requests and ongoing access management. Organizations can also configure access rules to automatically assign Record admin responsibilities to another user when ownership should be handled by someone other than the record creator. For example, a newly created vendor record may automatically assign Record admin responsibilities to the appropriate Vendor manager, or a newly created risk record may route access management responsibilities to a designated Risk manager.

To configure an access rule for Record admin assignment

You can create an access rule to automatically assign Record admin responsibilities to a user other than the record creator. For example, a user may create a vendor record, but the Vendor manager should be responsible for managing access requests and ongoing access administration for that record.

Note:

Access rules are currently supported for the following objects: AI Agents, AI Systems, Datasets, Issues, Models, Projects, Risks, Vendors. All objects supported by ABAC in Public Preview are planned to support Record Admin access rules by General Availability.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User management > Assignments.


    The Assignments screen appears.

  3. Select the tab corresponding to the solution, and click the object for which you want to configure access rules.


    The corresponding object screen appears.

  4. Click the Access rules tab, and click the Create rule button.


    The access rule block appears for you to define rules with conditions and actions to assign permissions and assignments.

  5. Complete the following fields to configure the access rule:


    Field
    Description
    Rule name

    Enter a name for the access rule.

    Condition Block

    Condition

    Value

    Select the attribute that will trigger the rule.

    Operator

    Select the relationship that must be met between the condition and the value.

    Value

    Select the attribute value that will trigger the rule.

    Action

    Select Update record admin attribute.

    Recipient

    Select the user that will be assigned as the Record admin when the configured conditions are met.

  6. Click the Save button. New records that meet the configured conditions will automatically assign the specified user as the Record admin.

To configure a default access rule

You can create a default rule that assigns a Record admin when no other access rule conditions are met. Default rules help ensure records always have a designated Record admin, even when no configured access rule applies.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User management > Assignments. The Assignments screen appears.

  3. Select the tab corresponding to the solution, and click the object for which you want to configure the default access rules. The corresponding object screen appears.

  4. Click the Access rules tab, and click the Create default rule button. The default rule block appears.

  5. Complete the following fields to configure the default access rule:
    Field
    Description
    Rule name

    Enter a name for the access rule.

    Action

    Select Update record admin attribute.

    Recipient

    Select the user that will be assigned as the Record admin when no other access rule conditions are met.

  6. Click the Save button. When a record is created and no other Record admin assignment rules are matched, the default rule automatically assigns the designated Record admin.

To edit an access rule

You can edit an access rule when assignment criteria, routing logic, or Record admin ownership requirements change. Changes apply to future records that meet the updated rule conditions.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User management > Assignments. The Assignments screen appears.

  3. Select the tab corresponding to the solution, and click the object for which you want to edit access rules. The corresponding object screen appears.

  4. Click the Access rules tab, click the Context Menu icon corresponding to the access rule you want to edit, and select Edit.
  5. Make changes as necessary to the access rules block to modify the conditions and actions to assign permissions and assignments.
  6. Click the Save button. Future records that meet the updated conditions will use the revised Record admin assignment configuration.

To delete an access rule

You can delete an access rule when it is no longer needed or has been replaced by a different Record admin assignment strategy. Deleting an access rule prevents it from being applied to newly created records.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select User management > Assignments. The Assignments screen appears.

  3. Select the tab corresponding to the solution, and click the object for which you want to delete an access rule. The corresponding object screen appears.

  4. Click the Access rules tab, click the Context Menu icon corresponding to the access rule you want to delete, and select Delete. The Delete rule modal appears.


  5. Click the Delete button.

Additional Resources

For a complete list of ABAC resources, see the Attribute-Based Access Control (ABAC) User Guide, which includes foundational concepts, implementation guidance, and solution-specific documentation.

To continue configuring and managing ABAC, reference the following procedural configuration articles: