Skip to content

Configure RBAC in IDV Platform

If you have the Admin role, you are responsible for the initial configuration of role-based access in IDV Platform for your organization.

This guide walks you through the access configuration process, from reviewing initial access and defining requirements to assigning roles, organizing users into groups, and verifying access.

Before proceeding, make sure you are familiar with the basic RBAC concepts described in Role-Based Access Control.

Follow Configuration Flow

Use the following flow to configure role-based access based on your organization's requirements and existing roles and groups.

Click a block in the flow diagram to jump to the corresponding step below.

The flow is a guide, not a mandatory sequence. You can create groups and roles in any order.

flowchart TD
    A["Review Initial Access"]
    B["Identify Users and Define Access Requirements"]
    C["Review Existing Roles"]
    D{"Does a suitable role exist?"}
    E["Reuse Existing Role"]
    F["Create or Duplicate a Role"]
    G["Configure Role Permissions"]
    H["Review Existing Groups"]
    I{"Does a suitable group exist?"}
    J["Reuse Existing Group"]
    K["Create a Group"]
    L{"Does the group have the required roles?"}
    M["Assign Roles to the Group"]
    N["Create Users and Add Them to the Group"]
    O["Verify Access"]

    A --> B --> C --> D

    D -->|Yes| E
    D -->|No| F
    F --> G
    E --> H
    G --> H

    H --> I
    I -->|Yes| J
    I -->|No| K

    J --> L
    K --> L

    L -->|Yes| N
    L -->|No| M
    M --> N

    N --> O

    click A "#step-1-review-initial-access"
    click B "#step-2-define-access-requirements"
    click C "#step-3-configure-roles-and-permissions"
    click E "#step-3-configure-roles-and-permissions"
    click F "#step-3-configure-roles-and-permissions"
    click G "#step-3-configure-roles-and-permissions"
    click H "#step-4-create-groups-and-assign-roles"
    click J "#step-4-create-groups-and-assign-roles"
    click K "step-4-create-groups-and-assign-roles"
    click M "step-4-create-groups-and-assign-roles"
    click N "#step-5-create-users-and-add-them-to-groups"
    click O "#step-6-verify-access"

For a practical example of the initial configuration, see Set Up User Access for the First Time.

Step 1. Review initial access

During the initial IDV Platform setup, the first Platform Administrator account is automatically created and added to two groups:

  • All Users — a system group with no assigned roles that grants no role-based permissions.
  • Admin role group — a default role group that provides administrative access through the built-in Admin role.

You as the initial administrator can then manage other users, groups, roles, and permissions.

All other new users are automatically added to the All Users group. Users cannot be removed from this group, and membership alone does not grant role-based access to Platform features or resources.

To grant administrative access to additional users, create their accounts and add them to the Admin role group.

The Platform also provides built-in groups and roles that can be used when configuring access.

For more information about initial access and Creator Ownership, see How Access Is Granted.

Step 2. Define access requirements

Identify the types of users who will work with the Platform and determine their responsibilities.

For each type of user, define:

  • Required resources—which sessions, workflows, profiles, or other resources they need to access.
  • Required operations—what they need to do with those resources.
  • Organizational structure—whether access should be organized by department, team, or responsibility.

Review the available built-in groups and roles to determine whether they meet these requirements.

Step 3. Configure roles and permissions

Review the existing roles before creating new ones.

If a built-in or existing custom role provides the required permissions, it can be reused.

Otherwise:

  1. Create a role or duplicate an existing role.
  2. Configure its permissions by selecting the required scopes, operations, and entities.
  3. Save the role.

Create separate roles where different responsibilities or resource restrictions require different permission sets.

Step 4. Create groups and assign roles

Organize users into groups based on their responsibilities, teams, or departments.

  1. Review the existing groups.
  2. Create custom groups where needed.
  3. Assign the appropriate roles to each group.
  4. Save the changes.

A group can have multiple roles, and a role can be assigned to multiple groups.

Groups can also be created without members or roles and configured later.

Step 5. Create users and add them to groups

After configuring roles and groups:

  1. Create user accounts for employees who need access.
  2. Open the appropriate group.
  3. Add users to the group.
  4. Save the changes.

Users inherit the permissions granted by the roles assigned to their groups.

A user can belong to multiple groups if their responsibilities require access to different resources or functions.

Step 6. Verify access

After configuring access, verify that users:

  • Can access the required Platform features and resources.
  • Can perform the operations required for their responsibilities.
  • Do not receive unintended access through other groups or roles.

Remember that permissions from all inherited roles are combined. A role with restricted access cannot override broader permissions granted by another role.

API

To manage access programmatically, see the OpenAPI Documentation.

Next Steps

  • RBAC Use Cases—explore practical scenarios for managing access for different teams and responsibilities.