My Roles and Groups — RBAC in IDV Platform

Your access to the IDV Platform depends on the groups you belong to and the roles assigned to those groups.

This page explains how you receive permissions, how group membership affects your access, where to view your roles, and what to do if you need additional access.

Make sure you understand the key concepts explained in Getting Started.

How You Receive Access and What Defines Your Permissions

When your account is created, you are automatically added to the All Users group.

The All Users group has no assigned roles and does not grant any permissions. Being a member of this group does not, by itself, give you access to the Platform features or resources.

The Platform also provides a set of default role groups you can be assigned to by your Platform Administrator.

To receive the permissions required for your work, a Platform Administrator or another authorized user must add you to groups with appropriate roles.

Roles are assigned to groups, not directly to individual users. When you join a group, you automatically inherit all roles assigned to that group.

You can belong to multiple groups. In this case, your permissions from all groups are combined. One role cannot restrict access granted by another role.

You also retain full access to individual resources you create, such as a specific session or workflow, regardless of the permissions assigned through your groups. This access remains even if you leave the group through which you previously received permissions.

When you are removed from a group, you immediately lose the permissions received only through that group. Permissions inherited through other groups and access to resources you created remain unchanged.

Some actions are restricted for all users, regardless of your permissions. For example, you cannot deactivate your own account or remove yourself from a group.

For more information about how permissions are combined and access is determined, see Role-Based Access Control.

View Your Assigned Roles and Groups

You can view your assigned roles and group memberships on your User Details page if you have the required permissions. Your roles determine which Platform features and resources you can access and which operations you can perform. You may receive the same role through more than one group.

To view your assigned roles and groups:

Navigate to Users.
Find your account in the Users list.
Click your row to open User Details.
Open the Assigned Groups section to view your group memberships and the roles assigned through those groups.

Consider the following rules and restrictions:

Access to the Users page and viewing users' details requires permission. If you cannot access your account details or need additional permissions, contact your Platform Administrator.
The Assigned Groups section displays the groups you belong to and the roles assigned to each group.
You cannot change your roles or group memberships from User Details.

If you cannot access your account details or need additional permissions, contact your Platform Administrator.

View Other Users, Groups, and Roles

You can view Platform users, groups, and roles according to your assigned access permissions, including groups and roles you created yourself.

For instructions on viewing and managing these resources, see:

If you cannot access or find a resource you need, contact your Platform Administrator.

Understand Your Group Membership

You can belong to multiple groups at the same time.

For example, if you work as an operator in Branch 1, you may belong to:

All Users—the group you joined automatically when your account was created. It has no assigned roles or permissions.
Operators—a group with a role that provides permissions required to perform verification tasks.
Branch 1—a group with a role that provides access to specific Branch 1 resources.

You receive the permissions granted by the roles assigned to both the Operators and Branch 1 groups.

Group membership is managed by a Platform Administrator or another authorized user.

You cannot add yourself to groups or remove yourself from them even you have the Admin role.

Understand Your Permissions

Each role contains permissions that define:

Scope—the type of a resource, such as sessions, workflows, or profiles.
Operations—the actions you can perform on a scope item.
Entities—specific scopes to which those operations apply, such as specific sessions and workflows.

Depending on the scope, permissions may apply to all entities or to specific entities.

For more information about how access control works, see Role-Based Access Control.

Permissions from Multiple Roles:

Permissions from all your inherited roles are combined.

For example, suppose you receive two roles:

Operator Role—allows you to read verification sessions.
Branch 1 Role—grants access to specific Branch 1 sessions.

Your effective access depends on the permissions configured in both roles.

If the Operator Role grants access to all sessions, the Branch 1 Role cannot restrict that access to Branch 1 sessions only.

Access to Entities You Create

You automatically receive full access to individual resources you create, such as a specific session or workflow, regardless of the permissions assigned through your groups.

However, to access these entities through the Platform interface, you must also have permissions.

If you cannot access a Platform feature or find a resource you created, contact your Platform Administrator.

How Changes Affect Your Access

Your permissions can change when your group memberships or the roles assigned to your groups change.

Change	Effect on your access
You are added to a group	You receive the permissions granted by all roles assigned to that group.
You are removed from a group	You lose permissions inherited through that group unless another group grants the same permissions.
A role is assigned to one of your groups	You receive the permissions granted by that role.
A role is removed from one of your groups	You lose its permissions unless you inherit the same permissions through another role.
Permissions in an assigned role are changed	Your access is updated according to the modified permissions.

Changes to group memberships and role permissions take effect immediately.

Access to entities you created yourself remains available independently of your assigned roles.

Request More Permissions

If you cannot open a required page, access a resource, or perform an operation, you may not have the necessary permissions.

In this case contact your Platform Administrator.

You cannot assign yourself to groups or assign roles to yourself.

If You Have Admin Role

During the initial Platform setup, the first administrator account is created and assigned the built-in Admin role through the Admin role group.

The Admin role provides administrative access to all Platform features and resources with some restrictions:

You cannot deactivate your own account.
You cannot remove yourself from a group.
You cannot change role assignments for groups you belong to.
You cannot make changes that would leave the Platform without at least one active user with the Admin role.

The initial administrator can then manage other users, groups, roles, and permissions. To grant administrative access to additional users, an administrator creates their accounts and adds them to the Admin role group. Other authorized administrators can also manage membership in this group.

As an administrator, your next step is to configure access for other users:

See Configure Access to understand the access configuration process, including how to create roles, organize users into groups, and assign permissions.
See Role-Based Access Control to understand how role-based access works, including the available scopes, operations, and entity-level access options.
See Role Management Use Cases for practical examples of configuring access for your organization.