Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC)

Important:

The Attribute-Based Access Control (ABAC) Phase 1: Foundations feature is under Public Preview. Please contact OneTrust Support to request early access.

Attribute-Based Access Control (ABAC) is being introduced across OneTrust in a phased rollout designed to support foundational objects first, with additional objects and functionality added over time. While ABAC provides more flexible and scalable access control capabilities, not all OneTrust objects and functionality are included in ABAC Phase 1: Foundations. This article outlines the objects currently supported by ABAC, identifies major exclusions, and highlights planned future coverage.

Key Differences with Supported Objects & Timelines

ABAC Phase 1: Foundations, available in Public Preview as part of the OneTrust 202608.1.0, focuses on supporting core platform objects first, with additional objects and functionality being introduced over time.

Key differences include:

  • Not all OneTrust objects will be included in the first phases of ABAC rollout.

  • Some excluded objects have a defined timeline for future support, while other object timelines are still being determined.

  • Reporting support varies by experience. Column reports, PDF reports, and report schedules for inventories (processing activities, assets, vendors, entites), risks, engagements, issues, assessments, and controls support ABAC. Dashboards and conversational analytics are not currently supported. For more information, see Reporting Considerations for Attribute-Based Access Control (ABAC).

  • The Consent & Preferences solution will continue to operate without ABAC support at this time.

What does this mean?

When planning your ABAC implementation, verify that the objects and workflows you intend to use are currently supported. Because ABAC is being introduced incrementally, access-control behavior may vary across different areas of the platform.

Customers should expect the following:

  • ABAC availability will vary by object and solution during rollout.

  • Some workflows will continue to rely on role-based access until ABAC support becomes available for remaining objects.

Objects Supported in ABAC Phase 1: Foundations

The following objects are supported in ABAC Phase 1: Foundations, available in Public Preview as part of the OneTrust 202608.1.0 Summer Seasonal Release (August 2026):

Solution area

ABAC-supported objects

AI Governance

Datasets · Models · AI Systems · Projects · AI Agents · Assessments · Risks · Controls

Privacy Automation

Vendors · Processing Activities · Assets · Entities · Assessments · Issues · Controls · Projects · Risks · Privacy Notice

Tech Risk & Compliance

Vendors · Assets · Policy · Procedure · Standard · Exceptions · Initiatives · Assessments · Risks · Controls · Evidence Tasks · Issues

Third-Party Management

Vendors · Risks · Entities · Assessments · Issues · Controls · Assets · Contracts · Engagements

Objects Planned for Future ABAC Adoption

The following objects and experiences are not currently supported by ABAC and are planned for future coverage:

Solution area

Object / experience

Planned ABAC adoption timeline

Privacy

Data Subject Rights Requests and Incidents

Under consideration

Tech Risk & Compliance

Business Objectives

Fall 2026

Audits, Workpapers, and Findings

First half of 2027

Third-Party Management

Nth Parties

Early 2027

Screening Results

Winter 2026

Reporting

Conversational Analytics and Dashboards

Under consideration
Note:

Future support is subject to change. Refer to this article for the most current information about ABAC-supported objects and experiences.

OneTrust's Recommendations

OneTrust recommends evaluating and implementing ABAC based on the objects available in the current release scope while planning for broader adoption over time. Focus initial implementations on currently supported objects and continue using existing access controls where ABAC is not yet available. Future releases will expand ABAC support to additional objects and capabilities, enabling organizations to extend record-level access controls over time.

Continue Your ABAC Journey

Recommended Next Article

➡️ Assessment Considerations for Attribute-Based Access Control (ABAC)

Review assessment-specific ABAC behavior, supported functionality, limitations, and implementation considerations that may differ from standard object behavior.

ABAC Learning Path

  1. Attribute-Based Access Control (ABAC) Overview ✅

  2. Understanding Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) ✅

  3. Using the Basic Role for Attribute-Based Access Control (ABAC) ✅

  4. Before Enabling Attribute-Based Access Control (ABAC) in Your Tenant ✅

  5. Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC) ✅

  6. Assessment Considerations for Attribute-Based Access Control (ABAC)

  7. Reporting Considerations for Attribute-Based Access Control (ABAC)

  8. Attribute-Based Access Control (ABAC) FAQ

  9. Implementation Playbooks: Attribute-Based Access Control (ABAC)