ClearGRC uses role-based access control (RBAC) to determine which modules a user can access and which actions they can perform. Each role grants a combination of seven permission types across modules:
| Permission | What it allows |
|---|---|
| Read | View records |
| Execute | Run operations (e.g. submit, trigger) |
| Add | Create new records |
| Edit | Modify existing records |
| Delete | Remove records |
| Review | Submit a review decision |
| Approve | Grant final approval |
Built-In Roles #
ClearGRC includes the following built-in roles. A user’s effective permissions are the union of all roles assigned to them.
| Role | Description | Typical Assignment |
|---|---|---|
| Admin | Full access (Read, Execute, Add, Edit, Delete, Review, Approve) across all GRC modules. | System administrators |
| Owner | Full access to modules for records the user owns, including create, read, edit, delete, review, and approve. | Policy owners, control owners, risk owners |
| Approver | Read and approve access across modules. Cannot create, edit, or delete records. | Compliance managers, risk managers acting as final sign-off |
| Reviewer | Read and review access across modules. Cannot modify, delete, or approve records. | Internal reviewers, subject matter experts |
| Custodian | Read, add, and edit access across modules. Cannot review or approve records. | Data or asset custodians |
| User | Read-only access across modules. | General department or business users |
| TPUser | Read, execute, add, and edit access limited to the Assessment module. Cannot delete or approve. | External vendors and third parties responding to assessments |
Additional specialized roles – such as Auditor, Data Owner, Information Security Manager, and Privacy roles – may also be available depending on your organization’s ClearGRC configuration.
Assigning Roles #
Administrators assign roles to users from Admin ? Users. When creating or editing a user record, one or more roles can be applied. A user’s effective permissions are the combined union of all assigned roles.
[Screenshot: User record showing role assignment]
Viewing Your Own Permissions #
Any signed-in user can inspect their own effective permissions from My Profile ? Permissions. This screen displays a matrix of every module against the seven permission types, grouped by each assigned role, with green checkmarks indicating granted permissions. A search bar and column filter allow you to narrow the matrix to specific modules.
[Screenshot: My Profile ? Permissions matrix]
Note: Administrators can view the permission matrix for any role in the tenant from Admin ? Permission Inventory.
