IDV Platform RBAC Roles
IDV Platform provides default roles for common access needs and allows you to create custom roles. This article describes the default roles and provides a link to a guide for creating and managing custom roles.
Default Roles
Admin
The Admin role is intended for administrators responsible for managing all aspects of IDV Platform, including business operations, users, groups, roles, system configuration, and technical resources.
Note
During the initial IDV Platform setup, the default Admin account is automatically created and added to both the All Users group and the Admin role group.
The Admin role has access to all scopes and operations defined for this role, with wildcard (*) access to all entities. For the complete list of supported scopes and operations, see All Scopes and Operations.
Admin role restrictions
- Users with the built-in Admin role cannot add themselves to or remove themselves from groups.
- The platform must always have at least one active user with the built-in Admin role.
- You cannot delete or deactivate the last active user with the Admin role.
- You cannot remove the Admin role from the last active user who holds it.
Super User
The Super User role is intended for senior customer-side users who manage day-to-day platform operations, business data, users, groups, roles, and other operational resources. It provides broad access to business and team management functions, including certain platform administration capabilities.
The Super User role has the same permissions as the Admin role, except that it does not grant access to the following scopes:
featuresstatus_pagelicense_usage_fileconfigadmin_password_reset
The Super User role has create, list, read, update, and delete permissions for the secret and apikey scopes.
Note
The Super User role has access to all groups, regardless of group-level organizational boundaries.
Tech Admin
The Tech Admin role is intended for technical administrators responsible for configuring, maintaining, and troubleshooting IDV Platform. It provides access to technical resources, including system configuration, API keys, secrets, feature flags, and resource transfer, as well as read-only access to groups and roles.
It grants the following permissions. For all operations listed in the table below, the role grants access to all entities (*) within the listed scopes.
| Scope | Operations |
|---|---|
secret |
create, list, read, update, delete |
docreader |
read |
faceapi |
read |
apikey |
create, list, read, update, delete |
transfer_resources |
create, read |
features |
update |
status_page |
read |
license_usage_file |
read |
config |
create, list, read, update, delete |
group |
list, read |
roles |
list, read |
Business Flow Admin
The Business Flow Admin role is intended for users who configure, manage, and operate business processes in IDV Platform. It provides broad access to operational data and resources, including sessions, profiles, pools, workflows, views, cases, devices, and analytics.
The role grants the following permissions. For all operations listed in the table below, the role grants access to all entities (*) within the listed scopes.
| Scope | Operations |
|---|---|
secret |
list, read |
session |
create, list, read, change_status, download |
pool |
create, list, read |
person |
create, list, read, change_status, download |
pool_job |
create, list, read, update, delete, subscribe |
workflow |
create, list, read, update, delete |
view |
create, list, read, update, delete |
banlist |
create, list, read, update, delete, download |
device |
list, read |
analytics |
read |
device_log |
read |
deeplink |
create, read |
docreader |
read |
faceapi |
read |
translations |
create, list, read, update, delete |
assets |
create, list, read, update, delete |
iam_application |
create, list, read, update, delete |
iam_person_application |
create, list, read, update, delete |
case |
list, read |
virtual_session |
create, read, update |
wf_shard |
create, list, read, update, delete |
risk_predictor |
create, list, read, update, delete |
Demo
The Demo role is intended for product demonstrations, evaluations, sandbox environments, and guided platform exploration. It provides a deliberately limited set of permissions that allows a user to interact with selected parts of the platform without receiving broad operational, administrative, or sensitive data access.
The following permissions are assigned to the Demo role by default. For all operations listed in the table below, the role grants access to all entities (*) within the listed scopes, except for the read operation on workflows, which is restricted to five predefined workflows.
| Scope | Operations | Permission |
|---|---|---|
session |
create, list |
session:create:*session:list:* |
view |
create, list |
view:create:*view:list:* |
deeplink |
read, create |
deeplink:read:*deeplink:create:* |
workflow |
list, read |
workflow:list:*workflow:r:3d0f31c1-63a1-41bd-a19c-563f54475cf7workflow:r:8b6f716c-7e8e-11f0-83ab-4f01ba342b5eworkflow:r:edda0192-b890-11ef-a348-17da751a6a22workflow:r:9720c855-e694-4975-93d8-16067398b793workflow:r:7e03bc6a-3fb6-4e1d-af3f-2b9c75e8b1d4 |
Auditor
The Auditor is a role for users responsible for oversight, control, compliance review, and investigation across the platform. It provides broad visibility into operational data, workflows, profiles, cases, groups, devices, audit records, and related configuration while keeping modification capabilities highly restricted.
The role allows users to review platform activity without participating in routine business processing or access administration.
It grants the following permissions. For all operations listed in the table below, the role grants access to all entities (*) within the listed scopes.
| Scope | Operations |
|---|---|
session |
list, read, download |
pool |
list, read |
person |
list, read, download |
pool_job |
list, read |
workflow |
list, read |
view |
list, read, create |
group |
list, read |
banlist |
list, read |
device |
list, read |
analytics |
read |
audit |
list, read |
device_log |
read |
iam_application |
list, read |
iam_person_application |
list, read |
case |
list, read |
risk_predictor |
list, read |
Operator
The Operator is a role for users responsible for day-to-day operational processing on the platform. It provides the permissions required to review sessions and profiles, make status decisions, access relevant profile information, work with available workflows and pools, use operational views, and initiate cases.
This role has the following permissions. For all operations listed in the table below, the role grants access to all entities (*) within the listed scopes.
| Scope | Operations |
|---|---|
session |
list, read, download, change_status |
pool |
list |
person |
list, read, change_status, download |
workflow |
list |
view |
create, list |
case |
create, list |
Note
The Operator role only has workflow:list:* and pool:list:* permissions for workflows and pools.
Compliance Manager
The Compliance Manager role is intended for senior compliance users responsible for overseeing verification outcomes, reviewing customer and session data, investigating risk-related information, and managing compliance cases.
It provides broad read access to operational, organizational, and risk-related resources, along with selected permissions to change session and profile statuses and manage cases.
The role grants the following permissions. For all operations listed in the table below, the role grants access to all entities (*) within the listed scopes.
| Scope | Operations |
|---|---|
session |
list, create, read, change_status, download |
pool |
list, read |
user |
list, read |
person |
list, read, change_status, download |
workflow |
list, read |
view |
list, create, update, read |
group |
list, read |
banlist |
list, read, create, update, download |
device |
list, read |
analytics |
read |
case |
create, list, read, update, change_status |
risk_predictor |
list, read |
General Rules and Constraints for Default Roles
- You cannot delete or rename default roles or modify their permissions.
- All default roles use wildcard access (
*), which grants access to all existing and future entities within their permitted scopes. - Users inherit permissions from all roles assigned to their groups. When multiple roles apply, their permissions are combined.
- Default roles can be duplicated. The resulting role is a custom role that can be edited independently.
- Having the same permissions as a default role does not make a custom role a default role.
- You cannot delete the last active user with the built-in Admin role.
For general rules governing group membership, role assignments, and permission inheritance, see RBAC General Rules and Constraints.
For related restrictions on default groups, see Default Groups.
Custom Roles
For instructions on creating and managing custom roles, see Manage Roles.
Next Step
Learn how groups are used to organize users and manage access in IDV Platform in Manage Groups.