Reporting Considerations for Attribute-Based Access Control (ABAC)

ABAC reporting extends record-level access controls into supported reporting experiences. Rather than granting access to all records included in a report, ABAC applies the same access controls used elsewhere in the platform to determine which report data each user can see.

For supported objects, column reports, PDF reports, and report schedules respect ABAC assignments and record-level access controls. As a result, two users viewing the same report may see different results based on the records they are authorized to access. A user's ability to view data in a report is determined by their underlying record access through assignments, attributes, workflows, sharing relationships, and existing access controls. For example:

• A user assigned as a Risk Owner through ABAC may see only the risk records associated with their assignments. Those risk records (the primary object in the report) will be displayed, while other risk records outside the user's access scope will not appear.

• A user assigned the Vendor Manager role through RBAC may see vendor records in a report. Vendor data (the primary object) can be displayed when access is granted through either roles or ABAC assignments. However, if a user can access a related engagement or risk record only because it was assigned through ABAC, data from that related record will not appear in column or PDF reports.

  Note:

  Related object data that is accessible through ABAC assignments is not currently included in column or PDF reports. Support for this behavior is planned for a future release.

• A user who has been granted access to specific records through sharing may see only those shared records reflected in supported reports. Records that have not been explicitly shared with the user will not appear, even if they are included in the underlying reporting dataset.

This approach helps create a consistent access model across operational workflows and reporting experiences by ensuring users see only the data they are authorized to access.

During Public Preview, ABAC support is available only for specific reporting experiences and supported objects.

Key differences include:

• Column reports, PDF reports, and schedules will respect ABAC assignments for a limited set of supported objects.

• Conversational analytics and dashboards are not yet responsive to ABAC assignments.

• For the remaining objects supported in Public Preview: Column reports, PDF reports, and schedules will be ABAC-compatible by General Availability. Additional reporting services and objects are expected to become ABAC-compatible over time.

ABAC-responsive reporting will be available in select experiences rather than across the entire reporting suite during Public Preview.

Customers should expect the following:

• ABAC behavior will only apply to supported objects within column reports, PDF reports, and schedules.

• Conversational analytics and dashboards will continue functioning as they do today until ABAC support is introduced.

• Additional reporting experiences and supported objects will be introduced over time as ABAC reporting capabilities continue to expand.

Because ABAC support is being introduced in phases, customers should expect access-control behavior to vary across reporting experiences until broader reporting support becomes available.

The following table lists the set of objects that are supported in Public Preview and the set of objects that are planned to be supported in General Availability.

ABAC will not be implemented for Legacy Dashboards or Insights Dashboards. These experiences already have restricted visibility and are typically limited to administrative and management users. ABAC capabilities are planned for the next-generation dashboard experience and are expected to become available when the new dashboard solution enters Public Preview.

Customers interested in learning more about this initiative should contact their Customer Success Manager (CSM) or the OneTrust Reporting Product team for additional information.

Given the limited scope of ABAC support in Reporting during Public Preview, organizations should view Public Preview as an opportunity to evaluate emerging ABAC-enabled reporting capabilities while maintaining their existing reporting workflows until broader support becomes available with General Availability.

Special Considerations for Third-Party Management Customers

Third-Party Management customers are encouraged to explore ABAC-enabled reporting and evaluate how record-level access controls affect reporting experiences across vendors, engagements, assessments, risks, and controls. Because many commonly used Third-Party Management objects are included in the current reporting scope, these customers are well positioned to assess how ABAC can help align report visibility with operational access controls.

Note:

At this time, a known limitation affects some reporting scenarios involving related objects. Primary reporting objects will respect ABAC assignments; however, ABAC filtering is not consistently applied to certain secondary or related objects. OneTrust is actively working to address this behavior. Customers are encouraged to test ABAC-enabled reporting, evaluate the current experience, and provide feedback as part of their Public Preview adoption activities.

Recommended Next Article

➡️ Attribute-Based Access Control (ABAC) FAQ

Find answers to common questions, edge cases, and clarifications to better understand ABAC behavior and limitations.

ABAC Learning Path

1. Attribute-Based Access Control (ABAC) Overview ✅

2. Understanding Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) ✅

3. Using the Basic Role for Attribute-Based Access Control (ABAC) ✅

4. Before Enabling Attribute-Based Access Control (ABAC) in Your Tenant ✅

5. Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC) ✅

6. Assessment Considerations for Attribute-Based Access Control (ABAC) ✅

7. Reporting Considerations for Attribute-Based Access Control (ABAC) ✅

8. Attribute-Based Access Control (ABAC) FAQ

9. Implementation Playbooks: Attribute-Based Access Control (ABAC)