Assign Roles
Assign, modify, and review role assignments for users across Sandbox and Production environments in RiskOS™.
Role assignment connects users to their permissions. In RiskOS™, you assign roles to users on a per-environment basis — each user can have different roles in Sandbox and Production. This article covers how to assign roles during user creation and how to modify role assignments for existing users.
Why it matters
Roles determine what a user can see and do in a client account. Assigning the wrong role can block a user from completing their work or grant access to features they should not have. Environment-specific assignment lets you give users broader access in Sandbox for testing while keeping Production tightly controlled.
Before you begin
| Requirement | Details |
|---|---|
| Permission | You must have the UAM Users View tier permission. |
| Account context | If assigning roles for a client, switch into the client's account first. |
| Prerequisites | The roles you want to assign must already exist. If you need a new role, create a custom role first. |
| Environment awareness | Decide in advance which environment (Sandbox, Production, or both) the user needs access to. |
| Estimated time | 5 minutes per user. |
| Production impact | Role changes take effect immediately. The user gains or loses access on their next page load or action. |
Assign roles to a new user
Role assignment is Step 3 of the add user wizard. When you reach this step:
- The wizard displays a role assignment table with:
- Rows listing each available role, grouped into System-Defined Roles and Custom Roles.
- Columns for each environment: Sandbox and Production.
- A checkbox in each cell.
- Select the checkbox to grant a role in that environment. For example, select the "Workflow Admin" checkbox under Production to give the user workflow admin permissions in Production.
- At least one role must be enabled in either Sandbox or Production.
- Click Next to proceed to the Review step.
Note:
A role enabled only in Sandbox does not grant any Production access, and vice versa. Enable a role in both columns if the user needs the same permissions in both environments.
Change roles for an existing user
- On the Users page, click the edit button for the user you want to modify.
- The add user wizard opens pre-filled with the user's current details. Since all steps are already completed, you can jump directly to Step 3: Select Roles.
- Modify the checkboxes in the role assignment table:
- To add a role: Select the checkbox for the role in the desired environment.
- To remove a role: Deselect the checkbox.
- To change environments: Deselect in one environment and select in the other.
- Click Next to review, then Save to apply the changes.
What happens after saving
| Effect | Timing |
|---|---|
| The user's permissions update based on the new role assignments. | Immediate (on next page load or action) |
| The user list refreshes to reflect the changes. | Immediate (page refresh) |
| The user does not receive a notification about role changes. | — |
| If the user is currently logged in, they see updated permissions on their next navigation or page refresh. | Within seconds |
Important:
Removing a role from a user in Production takes effect immediately. If the user is actively working in the system, they may encounter permission errors on their next action. Coordinate role changes with the affected user when possible.
Environment-specific assignment strategies
| Strategy | When to use | How to implement |
|---|---|---|
| Broad Sandbox, narrow Production | During onboarding or testing phases. | Assign full-access roles in Sandbox and view-only roles in Production. |
| Mirror Sandbox and Production | For established users who need identical access. | Enable the same roles in both Sandbox and Production columns. |
| Sandbox only | For users who are testing or integrating but should not touch Production. | Enable roles in Sandbox only. Leave all Production checkboxes empty. |
| Production only | For users who only need Production access (rare). | Enable roles in Production only. Leave all Sandbox checkboxes empty. |
Review a user's current roles
To see what roles a user currently has:
- On the Users page, click the edit button for the user.
- Navigate to Step 3: Select Roles in the wizard.
- The role assignment table shows which roles are currently enabled (checkboxes selected) in each environment.
- Navigate to Step 4: Review for a summary view with colored tags:
- Blue tags = Sandbox roles
- Green tags = Production roles
Troubleshooting
| Issue | Cause | Resolution |
|---|---|---|
| A role is not visible in the assignment table | The role may not exist yet, or the roles list has not refreshed. | Refresh the page. If the role is missing, create it first. |
| User still has access after removing a role | The user may have another role that grants the same permission. | Review all assigned roles in the role assignment table. Roles are additive — permissions from multiple roles combine. |
| Cannot save because no role is selected | At least one role must be enabled in either Sandbox or Production. | Select at least one checkbox in the role assignment table. |
| User reports different access in Sandbox vs. Production | Different roles are assigned in each environment. | This is expected behavior. Review the role assignment table to confirm the assignments match your intent. |
| Role changes do not appear in the user list | The user list may not have refreshed. | Refresh the page or navigate away and return to the Users tab. |
Related articles
| Topic | Guide |
|---|---|
| Understand the UAM model | Users & Roles Overview |
| Create and manage user accounts | Manage Users |
| Create custom roles | Roles & Permissions |
| Access governance and audit guidelines | Access Governance Best Practices |
Updated 1 day ago