Account Models and Tiers

RiskOS™ has two account models: standalone and managed. A managed account is also assigned a tier that controls its feature access. This page explains the two models first, then the tiers — they're separate ideas, and keeping them straight avoids a common point of confusion.

Why it matters

The account model decides whether a Channel Partner is involved at all. For managed accounts, the tier then decides what the client can do on their own — what features they access, whether they can create workflows, and how much of their configuration the Channel Partner controls. Knowing both lets you make informed tier assignments and explain account capabilities to your clients.

Part 1: Account models

The account model is the top-level distinction. Every RiskOS™ account is either standalone or managed — never both.

graph TD
    Root["RiskOS account models"]
    Root --> SA["Standalone (direct) account
    No Channel Partner
    Customer manages everything
    e.g. direct or self-service signups"]
    Root --> MG["Managed account
    Created and managed by a Channel Partner
    Assigned a tier (see Part 2)"]

Standalone (direct) account

A standalone account is a standard RiskOS™ account where the customer manages everything themselves. There is no Channel Partner involvement, and there is no tier — the account owner has full control over workflows, users, settings, and configurations.

This includes accounts that sign up with Socure directly and self-service signups. In all cases, the defining trait is the same: no Channel Partner manages the account.

Managed account

A managed account is a client account created and administered by a Channel Partner. The Channel Partner onboards the client, assigns a tier, and can switch into the account to perform administrative tasks. The client's feature access depends on the tier.

Examples: Channel Partner client accounts (assigned the Standalone tier or the Centrally Managed tier).

Model comparison

Part 2: Tiers within a managed account

Tiers apply only to managed accounts. A standalone (direct) account has no tier. A Channel Partner assigns one of two tiers to each managed client:

• Standalone tier — the client runs its own workflows and configurations, much like a standalone account.
• Centrally Managed tier — the client has view-only access; the Channel Partner runs workflows and configurations on the client's behalf.

graph TD
    MG["Managed account"]
    MG --> M1["Standalone tier
    Client runs its own workflows"]
    MG --> M2["Centrally Managed tier
    View-only; the Channel Partner
    runs workflows on the client's behalf"]

Your Channel Partner management account itself has full, unrestricted access and isn't subject to these tiers.

Tier capabilities

The two tiers grant different feature access within a managed client account.

Workflow capabilities

Case management capabilities

Administration capabilities

Workflow execution

How workflows run depends on the account model and, for managed accounts, the tier.

Standalone (direct) account

• The account owner has full control: create, modify, test, and deploy workflows.
• Enrichment steps reference the account's own product configuration and profiles.
• The account owner manages the entire deployment lifecycle independently.

Managed account — Standalone tier

• Clients on the Standalone tier have full workflow capabilities, much like a standalone account.
• They can create, modify, test, and deploy workflows independently.
• Enrichment steps may reference profiles configured by the Channel Partner or by the client. See Product Settings for details.

Managed account — Centrally Managed tier

• Clients on the Centrally Managed tier can only view workflows. They cannot create, modify, delete, test, or deploy them.
• The Channel Partner manages workflow configuration by switching into the client's account.
• When the Channel Partner switches into the account, they retain management-level permissions and can create and modify workflows on the client's behalf.

Choosing the right tier

Use this decision guide when assigning a tier during client onboarding:

graph TD
    Q1{"Does the client have a
    technical team that
    manages workflows?"}
    Q1 -->|Yes| Q2{"Does the client need
    configuration access?
    (tags, statuses, queues,
    allow/deny lists)"}
    Q1 -->|No| T3["Assign the Centrally Managed tier
    Channel Partner manages
    everything"]
    Q2 -->|Yes| T2["Assign the Standalone tier
    Client is self-service"]
    Q2 -->|No| T2B["Assign the Standalone tier
    with restricted roles"]

Namespace delegation

Behind the scenes, RiskOS™ uses namespace delegation to link managed accounts to their Channel Partner. Each managed account (child namespace) is linked to the Channel Partner's account (parent namespace). This relationship controls:

You do not need to manage namespace delegation directly — it is handled automatically when you onboard a client.

Governance considerations

When managing multiple client accounts, consider these operational guidelines:

Related articles