Role-Based Access Control
Compliance software roles and permissions that limit who can change what
OneClickComply includes role-based access control for IT, security and compliance leads who need to decide who can view and who can change compliance data. Five system roles cover owners, admins, editors, viewers and auditors, and custom roles let you set permissions resource by resource where your plan includes them.
Why everyone having the same access becomes an audit problem
A compliance platform holds policies, evidence, risks and personnel records, so not everyone should be able to edit all of it. When everyone shares one level of access, a stray edit can change a control and an outside auditor sees more than they need. ISO 27001 and SOC 2 auditors expect access to be limited by role and given on the basis of need, so you need to be able to show how that works.
How roles and permissions work
Five system roles
Every organisation has owner, admin, editor, viewer and auditor roles. They are fixed and shown read-only in the Roles & permissions tab, so you can see what each one allows before you assign it.
An auditor role for outside reviewers
The auditor role gives read access plus report export, without the edit rights an editor has. It suits an external auditor or consultant who needs to look at your records rather than manage them.
Custom roles with a permission checklist
Where your plan includes custom RBAC roles, you can create a role and tick the permissions it needs, grouped by resource. Availability depends on plan, and the system roles stay as they are.
Invite people into a role
Invite team members by email and give them a role. Invitations stay pending until the person accepts.
Two-factor authentication
Each user can turn on two-factor authentication with an authenticator app in Settings under Security. Enforcing it across a whole organisation depends on plan and is set up with the OneClickComply team.
Changes you can trace
Activity in the platform is recorded in the Activity Log, so you can see who changed what and when. This gives you a record to pair with your role setup.
See Role-Based Access Control working on your own setup.
Book a demoWhat clear role-based access gives you
Limit edit access to the people who own the work, and give everyone else read access
Give an external auditor read access and report export without sharing a login
Show an auditor how access is assigned by role, not by habit
Build a role with only the permissions a job needs where custom roles are on your plan
Unsaved permission changes are flagged before you leave the page, so a half-finished edit is not lost
FAQ
Role-Based Access Control: common questions
Frameworks Role-Based Access Control supports
Read what each framework asks for and how OneClickComply covers it.
Related products and guides
Read more about Role-Based Access Control and the parts of the platform it works with.
- Audit logSee who changed what and when, with a before and after view.
- Approval workflowsReview and approve documents before they are published.
- Employee offboardingRecord the checks when someone leaves.
- Employee ManagementTrack your people and their records in one place.
- Reports and DashboardsExport compliance reports, including for your auditor.
See Role-Based Access Control on your own stack
Book a 30-minute demo and see how Role-Based Access Control works with the tools and frameworks you already have.