Roles and permissions
Governance uses the platform's standard role hierarchy — see Users and roles for how roles are assigned.
super_admin > org_admin > manager > analyst > viewer
Every action below is also scoped to your organisation. A document, version, mapping, exception or proposal belonging to another organisation is not visible, not editable, and returns not found rather than forbidden — the existence of another organisation's records is not disclosed.
Who can do what
| Action | Minimum role |
|---|---|
| View documents, versions, mappings, exceptions, proposals | viewer |
| Download a document file | viewer |
| Export a document as PDF | viewer |
| Acknowledge a policy assigned to you | any (your own row only) |
| Edit a document's metadata | analyst |
| Edit document content | analyst |
| Upload a new file version | analyst |
| Move a document or version through the lifecycle | analyst (pulling an approved document back to draft, and retiring anything past draft, need a manager) |
| Add or remove control mappings | analyst |
| Assign reviewers to a version | analyst |
| Edit an exception, move it into review | analyst |
| Approve or reject an exception | manager (and not the person who requested it) |
| Withdraw an exception | the requester, or a manager |
| Run any AI agent | analyst |
| Comment on a proposal | analyst |
| Dismiss (withdraw) a proposal | analyst |
| Create a document | manager |
| Record an approval or return | manager (and only if you are an assigned reviewer who did not write it) |
| Assign or remove reviewers | analyst |
| Create or renew an exception | manager |
| Launch an attestation campaign | manager |
| Accept or reject an AI proposal | manager |
| Delete a draft document | org_admin |
| Turn AI on for the governance module | org_admin |
The line that matters
Analysts generate. Managers ratify.
Role is the floor, not the whole rule. Recording an approval also requires that you are an assigned reviewer for that document, and that you are neither its author nor the person who last edited its text — see Approvals. A manager who is not on the roster cannot approve; nor can the person who wrote it, whatever their role.
An analyst can run every agent in the module — suggest mappings, draft a document, propose a redline, run a readiness scan. None of it reaches the record. Accepting a proposal, approving a document and launching an attestation campaign all need a manager, because each of those is the moment something becomes true of the organisation rather than merely suggested.
Everything is audited
Every create, update, status change, approval, acknowledgment, upload, download, export, agent run and proposal decision is written to the audit log with the user, the organisation, the entity and the change.
That includes reads of the artefact: downloading a policy file is logged against that version, so "who read the Acceptable Use Policy v2.1, and when?" has an answer.