Sharing, Requesting, and Managing Access with Attribute-Based Access Control (ABAC)

Important:

The Attribute-Based Access Control (ABAC) Phase 1: Foundations feature is under Public Preview. Please contact OneTrust Support to request early access.

Attribute-Based Access Control (ABAC) provides multiple ways to grant users access to records while supporting least-privileged access principles. Depending on the object's configuration, users may receive access through sharing, ownership, user attributes, workflows, or approved access requests.

When access is granted, assignments determine what actions users can perform on the record. This article explains how to share records, request access, and manage access permissions for users.

Note:

The procedures in this article follow the same process for all supported objects, but the available options may vary based on the object, assignments, and access option configurations. For more information, see Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC).

To share a record

You can share a record with another user and assign a set of permissions that determines what actions they can perform on the record. When a record is shared, the recipient receives an email notification with a link to the record.

  1. Open the record you want to share.
  2. Click the Context Menu icon in the screen header and select Share. The Share modal appears.


  3. In the People field, select the users that you want to share the record with. If the record was previously shared with other users, those user icons will appear at the bottom of the modal.
  4. Select the assignment that corresponds to the access level you want to grant the user(s). The predefined system assignments will appear first in the Assignments drop-down, followed by any custom assignments that were created with the Sharing access option configuration for the object type on the Global Settings > Assignments screen.
  5. (Optional) In the Message field, enter a message to include when sharing the record.
  6. (Optional) Click the Copy link button to copy the record's direct link to your clipboard.
  7. Click the Share button. The Shared modal appears with the record name, users, and access they were granted.


To request access to a record

To manage access requests

You can review access requests submitted by users and determine whether access should be granted. Record admins and Site admins are the only users authorized to review, approve, or deny access requests.

Note:

For more information, see Managing Record Admins & Ownership with Attribute-Based Access Control (ABAC).

  1. Navigate to the Access requests screen using one of the following methods:

    • Click the User icon in the Global Header. On the menu that appears, select Access requests.

    • Click the gear icon in the upper right-hand corner to access Global Settings. On the Global Settings menu, select Access Management > Access requests.

    On the Access requests screen, the list of pending access requests will appear by default. You can also view access requests that were previously approved or denied by adjusting the filters above the table.



  2. In the Action column, click the Review link. The Request details pane appears. On this pane, you will find the Request details section that contains the name of the record, object type, and the reason provided by the user when they submitted the access request.


  3. In the Access details section of this pane, you can select whether to approve or deny the access request.

    • Approve: If you are approving the access request, select the assignment that corresponds to the access level that you want to grant the user. The predefined system assignments will appear first in the Assignments drop-down, followed by any custom assignments that were created with the Sharing access option for the object type on the Global Settings > Assignments screen. Once selected, click the Approve button. An Access request approved confirmation message will appear at the bottom of the screen.



    • Deny: If you are denying the access request, click the Deny button. The Deny access request modal appears confirming that the user will not be granted access to the record. Click the Deny request button to complete this action.



To modify a user's access

You can update the permissions a user has on a record by changing the assignment associated with their access.

  1. Open the record for which you want to manage access.
  2. Click the Context Menu icon in the screen header and select Share. The Share modal appears.


  3. Click the Manage access link. The Manage access modal appears with the list of users with whom the record was shared.


  4. Click the arrow next to the user whose access you want to modify. The Access summary for that user appears with the Way this person has access section that indicates the access option used to grant the user access. The appearance of the Manage access modal and the available actions may vary based on the access option (sharing, user attributes, workflows).




    The following actions can be taken to modify the user's access (if available):

    • Assign record admin: Click the Assign record admin button to set the selected user as the record admin who can edit, delete, and reassign the record. Users assigned as the record admin will have access to the record and will be able to approve access requests for the record.

    • Select assignment: In the Sharing > Available assignments section, select the option button corresponding to the new assignment that you want to grant the user. Then click the Save button.

    • Remove access: Click the Remove access button to remove the user's ability to share the record. The Remove sharing access modal appears. Click the Remove sharing access button to complete this action.

      Note:

      The user may still have access to the record through other means, such as if they were assigned as the record admin. The Remove access button will not appear if the user was granted access through other access options, such as user attributes or workflows.



Additional Resources

For a complete list of ABAC resources, see the Attribute-Based Access Control (ABAC) User Guide, which includes foundational concepts, implementation guidance, and solution-specific documentation.

To continue configuring and managing ABAC, reference the following procedural configuration articles: