Using the Basic Role for Attribute-Based Access Control (ABAC)

The Basic role provides baseline platform access, while ABAC determines which records users can access and what actions they can perform on those records. The following examples demonstrate how these capabilities work together to support a least-privileged access model.

During Public Preview, users assigned the Basic role can access essential account-level capabilities, including My Apps, Notifications, Organization list, Tasks, Search, Copilot, Help, Switch tenant, Assigned actions, and User preferences. Users may also see additional navigation items or solution entry points when they have assignment-based access to related work.

Key characteristics include:

• Users may see navigation options associated with assignment-based access.

• Access to records continues to be governed by assignments through sharing, attributes, or workflows.

• Users can access only the records and actions permitted by their assignments.

• Users without access may see empty tables, unavailable content, or be prompted to request access.

The Public Preview experience is designed to support assignment-based access while OneTrust continues to refine how navigation aligns with a user's specific permissions. As a result, some users may see navigation options associated with related work even though they do not have access to all records within that area of the platform. In some cases, users who already have assignments or shared access when ABAC is enabled may automatically see related navigation options as part of the new access model.

For example, a user may have access to an engagement and be able to see related risks in the platform. However, this does not automatically grant access to those risk records. If the user attempts to open a risk they do not have permission to access, they may be prompted to request access.

When evaluating the user experience during Public Preview, keep the following in mind:

• Navigation visibility should not be treated as the same thing as record access.

• Assignments through sharing, attributes, or workflows continue to determine which records users can access and what actions they can perform.

• Access validation should focus on the records and actions available to the user rather than the navigation options they can see.

• Navigation experiences may evolve as the Basic role experience continues to be refined. Review release notes and documentation for the latest Public Preview guidance and expected behavior.

By General Availability, the Basic role experience will become more dynamic and aligned to a user's assignments and access controls. Users assigned only the Basic role are expected to see only their homepage and assigned tasks. As users receive assignments and additional access, navigation will dynamically update to reflect the records, workflows, and activities available to them.

The goal is to provide a more predictable and standardized experience across supported areas of the platform while continuing to support least-privileged access principles.