Roles & Permissions

Roles control what users can do within a Channel Partner client account. RiskOS™ provides system-defined roles as starting points and lets you create custom roles with granular permissions tailored to your organization's needs.

Access the Roles tab from Settings > Users in the Channel Partner sidebar.

Why it matters

Roles are the building blocks of your access control model. A poorly designed role can either block users from doing their work or grant more access than intended. Understanding the permission categories and designing roles around job functions keeps your client accounts secure and functional.

Before you begin

Roles table

The Roles tab displays all roles available in the current account.

Search roles

Use the search field above the table to filter roles by name.

System-defined vs. custom roles

System-defined roles

Channel Partner client accounts include the same system-defined roles as every other RiskOS™ account. These roles are identical across all accounts, and you cannot edit or delete them. The following tables list the permissions each system-defined role grants in Production and Sandbox.

Compliance Case Management

The following section lists the system-defined roles available for Compliance Case Management.

Compliance roles receive cases based on the Case Management workflow your organization configures:

• One-step workflow (Step 1): Cases are auto-assigned to the Compliance Officer. See Watchlist One-Step Workflow.
• Two-step workflow (Step 2): Cases are auto-assigned round-robin to the Compliance Analyst, then escalated to the Compliance Supervisor for approval. See Watchlist Two-Step Workflow.

Permission categories

Each role is configured with permissions across several categories. Most categories use a single access level — you pick one option, such as No Access, Can View, or Can Edit (the highest level, which grants every permission in that category). Workflows and Fraud Case Management are multi-select: instead of one access level, you choose any combination of granular actions. The following diagram shows how permissions flow from role to user:

graph LR
    R["Role"] --> PC["Permission categories"]
    PC --> SS["Single access level
    (most categories)"]
    PC --> MS["Multi-select actions
    (Workflows, Fraud Case Management)"]
    SS --> NA["No Access"]
    SS --> CV["Can View"]
    SS --> CE["Can Edit"]
    MS --> A["Any combination of
    granular actions"]

Create a custom role

1. On the Roles tab, click Add Role.
2. Enter a Role Name (required). Use a descriptive name based on the job function (for example, "Case Reviewer", "Workflow Admin").
3. Set the permissions for each category. For single access level categories, select one option (No Access, Can View, or Can Edit). For Workflows and Fraud Case Management, select any combination of granular actions from the multi-select dropdown.
4. Click Save to create the role.

What happens after saving

Global custom roles

A custom role you create in the Management account is a Global role: it becomes available in every client account automatically, so you don't re-create it in each one. This lets you centrally manage roles for all your clients from a single account.

Delete a custom role

1. On the Roles tab, locate the custom role you want to remove.
2. Click the Delete button in the Actions column.
3. Confirm the deletion in the dialog.

Role design best practices

For a comprehensive access review process, see Access Governance Best Practices.

Troubleshooting

Related articles