¶ What they may open: restricted roles
Restricted roles decide how much of what a user can see they may actually open. A user with a restricted role still sees the organisations their role covers, but opens only:
- records they have created themselves,
- records where they have a role, such as owner, responsible or participant,
- records linked to something they can open, for example the IT systems and assets in a risk assessment they take part in, and
- records that are shared with them.
Restriction is available for User Risk, User Privacy and User Compliance. It applies when every role the user holds in the organisation they are working in is one of these three; a user who also holds Admin or Auditor there is not restricted. For the overall picture, see How access works.
Restricted roles and role reach work together. Role reach decides how far a user sees; restriction decides what they may open there. A restricted user with role reach on sees the organisations below too, and opens only their own records and what is shared with them, across all of them.
Use restricted roles where people should work on their own assessments without seeing everyone else's, for example many system owners each assessing their own IT systems. We recommend telling the affected users before you switch it on.
¶ Restricting a role in one organisation
You can set it in either of two places; they change the same setting.
In Access Control:
- Go to Users & Access > Access Control.
- Select User Risk, User Privacy or User Compliance.
- Switch on Restricted role.
On the organisation:
- Go to Users & Access > Organisation, click the settings icon on the organisation and open the Access and sharing tab.
- Under What they may open, tick the roles under Restricted roles here.
- Click Confirm.
The Effect now line says which roles are restricted in that organisation.
¶ Restricting a role in the organisations below
To use the same restriction throughout a part of the tree, set it on the organisation at the top of that part, on the Access and sharing tab under What they may open:
- Pass the restricted settings to the organisations below – the organisations below get the same restricted settings for their roles. Nothing else is passed down by this switch.
- Let them change it – whether the organisations below may set their own restricted settings instead.
When the settings are passed down, the role in Access Control in an organisation below shows that its restricted setting comes from above, and whether it can be changed there.
¶ Exceptions for individual users
You can decide for one user whether the restriction applies, whatever the role's setting is:
- Go to Users & Access > Access Control and select the role.
- In the list of users with the role, switch Restricted role on or off for the user.
The individual setting overrides the role's setting for that user until you set it back to the same value as the role. Example: the role is restricted, but User B is set to not restricted. User B keeps full access whatever later happens to the role, until you set User B back to restricted. If the restricted settings are passed down from above without Let them change it, individual exceptions cannot be changed in the organisation below.
¶ What a restricted user can open
A restricted user opens a record when one of these is true:
¶ Risk assessments, DPIAs and incidents
Visible if the user created it, or is the owner, responsible or a participant. The causes, consequences and risks in these assessments are visible too.
¶ Treatments
Visible if the user created it, is the owner or responsible, or if the treatment is linked to a risk assessment the user can see.
¶ IT systems
Visible if the user created it, is the system owner or responsible, or if it is part of a risk assessment the user can see.
¶ Vendors
Visible if the user created it, or if it is linked to an IT system the user can see. If a vendor is linked to several IT systems, only the systems the user can access are shown.
¶ Assets
Visible if the user created it or is the owner, or if it is linked to a risk assessment or IT system the user can see. If an asset is linked to several IT systems, only the systems the user can access are shown.
¶ Processing activities
Visible if the user created it, is the owner, or if it is linked to an assessment the user can see.
¶ Customers
Visible only to the customer's owner.
¶ Threats and vulnerabilities
Visible if the user created them.
¶ Tasks
Visible if the user created the task or is assigned to it. Task boards are not restricted.
¶ Shared items
Anything shared directly with the user is visible to them, with the access given in the share. See Sharing and collaboration.