View and manage inventory items and metadata, including bulk actions like tagging, assigning group owners, and updating descriptions.

View, export, and manage code changes.

View, export, refresh, and manage vulnerability monitoring, including deactivating and reopening vulnerabilities.

View security alerts and manage alert monitoring state, including deactivating and reactivating monitoring.

Assigning someone as an owner or group owner on an inventory item doesn't grant them access to Assets: To give someone access, assign them a role that includes Assets permissions, like Editor or a custom role with the relevant Assets permission sets enabled.

View and manage all frameworks, controls, tests, documents, and policies across the organization.

Create, edit, and delete controls, tests, and documents.

Modify control, test, and document mappings.

Create, edit, and manage policies, including managing approval chains.

Create custom tests.

Reassign owners across controls, tests, and documents.

Upload documents marked as sensitive and mark or unmark custom documents as sensitive.

Configure the global document approval workflow in Compliance settings.

Give someone access to specific controls, tests, or documents only: Assign the Collaborator role and add them as a control owner, test owner, or document owner on the relevant items. Control owners also inherit access to all mapped tests, documents, and policies.

Let someone participate in a policy approval without broader Compliance access: Assign the Collaborator role and add them to the policy's approval chain. They don't need any object ownership or broader Compliance permissions to be a policy approver.

Restrict access to sensitive documents to specific people: Mark the document as sensitive. Only document owners, Admins, and auditors can access sensitive documents—Editors cannot view or upload sensitive documents.

View the knowledge base across all resources and answer library entries.

View all trust center content and manage external access to your organization's trust center.

View and edit all questionnaires and use the browser extension, but cannot be assigned as a questionnaire approver.

View and edit the knowledge base across all resources and answer library entries.

View, edit, comment on, and approve all questionnaires, including approving and editing approved answers, marking them complete, and deleting questionnaires.

Be assigned as a questionnaire approver.

Edit the trust center and its settings, including questionnaire settings and integrations.

Fulfill trust center data deletion requests.

View and edit customer commitments and view citations within commitments.

Import contracts and connect CLM integrations.

View and manage underlying contracts.

Give someone access to specific questionnaires only: Assign the Collaborator role and add them as a questionnaire owner on the relevant questionnaires. Or assign the Trust Collaborator role instead. They'll have default access to view and edit all questionnaires.

Maintain specific knowledge base items only: Assign the Collaborator role and add them as a knowledge base resource owner or answer library owner on the specific items they need to maintain.

Give someone access to approve questionnaires: Assign the Trust Admin role. Questionnaire approval can't be granted to a Collaborator or Trust Collaborator through object assignment.

Give someone access to manage contracts and commitments: create a custom role with the Customer Contracts permissioned enabled.

View and manage all integrations—except identity provider (IdP) integrations.

Connect or manage identity provider (IdP) integrations.

Give someone access to manage integrations without full Admin access: Assign the Editor role or create a custom role with Integrations set to view and edit. Admin access is only required for identity provider (IdP) integrations.

Give a Collaborator access to a specific integration: Integrations don't support object assignments. To give someone access, assign the Editor role or a custom role with Integrations enabled.

View limited personnel details within access reviews, requests, and deprovisioning tasks.

Approve and complete access requests across all systems.

Deprovision accounts across integrated systems.

View and manage the People page, including the People, Groups, and Background Checks tabs.

View and manage the Computers page.

Create and manage onboarding and offboarding workflows.

Create, edit, complete, and delete access reviews, including changing reviewers, uploading or deleting access data, and managing schedules and reminders.

Create and manage access request systems, including setting system approvers and system admins.

Reassign deprovisioning task owners and delete tasks.

Configure Personnel settings.

Let someone manage access requests without broader Personnel access: Assign the Collaborator role and add them as a system approver or system admin for the relevant systems. Use Access Admin instead if you want them to manage access requests across all systems as needed.

Let someone start and manage offboarding without full Editor access: Create a custom role with People Management set to view and edit. Add Deprovision Accounts if they also need to deprovision accounts across integrated systems.

Create, edit, search, filter, and archive processing activities in data inventory, including linking processing vendors and processors to processing activities.

Create and manage privacy assessments, including impact assessments, and link them to processing activities.

View and export your organization's ROPA.

Manage privacy settings, including custom processing activity fields.

Give someone access to privacy assessments only: Create a custom role with Data Inventory set to view and edit and Privacy Settings set to no access.

View and edit all reports.

Duplicate and customize reports to create custom reports.

Manage access and share reports.

Create, edit, and delete report schedules.

Delete custom reports.

Give someone access to one report only: Share the report directly with any user Collaborator or higher. They'll get view-only access to that specific report and can view its schedules, but can't edit the report or share it with other users. Note that reports can't be shared with Employees or Trust Collaborators.

Give someone access to a report schedule: Users must already have access to the report before they can be added to a schedule. Share the report with them first, then add them to the schedule.

View all risk registers, scenarios, and tasks across the organization.

Create, rename, delete, and manage access to registers.

Reassign scenario and task owners across the organization.

Archive or delete scenarios across the organization.

Create and manage risk snapshots and reports, including auditor sharing on snapshots.

Configure risk settings, including custom categories, custom fields, likelihood and impact scoring scales, risk levels, and auditor view.

Give someone access to a task and its parent risk: Assign them as a task owner and a register viewer on the relevant register.

Give someone access to one specific risk scenario: Assign them as the risk scenario owner on that scenario so they can complete the risk assessment without visibility into other risks.

Delegate user management without full Admin access: This isn't currently possible—managing users, roles, and user provisioning are Admin-only actions.

Give Employees access to account settings: Employee roles can only access the following My Account pages: Language and Interface.

View and manage all vendors, including vendor details, assessments, findings and evidence, and owner assignments.

View and manage vendor settings.

Give someone access to a specific vendor only: This isn't possible since Vendors doesn't support object assignments. To give someone Vendors access, assign the Editor role or create a custom role with Vendors set to view and edit.