Roles & Permissions Reference

Every user action in OrviQ is governed by atomic permission identifiers enforced in code and validated against the tenant's enabled feature entitlements.

A permission is only effective if its parent entitlement is active for the tenant.

---

Standard Role Templates

OrviQ ships with canonical system role templates that can be assigned directly or cloned into custom roles:

Role Key	Name	Primary Responsibility
tenant_admin	Tenant Administrator	Full tenant administration and user provisioning (locked anti-lockout role)
compliance_manager	Compliance Manager	Compliance determination, last-mile risk promotion, policy governance, and review sign-offs
compliance_officer	Compliance Officer	Day-to-day obligation tracking, evidence review, policy drafting, and change assessments
risk_manager	Risk Manager	Enterprise risk register, RCSA methodology, KRI oversight, and risk acceptance
control_owner	Control Owner	Operation and maintenance of internal controls, evidence submission, and remediation
auditor	Internal / External Auditor	Independent read-only inspection of registers, audit trails, and fieldwork workpapers
read_only	Read Only	Tenant-wide read-only visibility

---

Policy Governance

Governs the corporate policy lifecycle, structured atomic statement authoring, and employee self-service attestations.

Requires the policy_governance entitlement.

Permission Key	Display Name	Description	Default Roles
policy.read	View policies	View the policy register, dashboard, expiry monitor, and comparisons	All roles
policy.write	Manage policies	Create and update policies, author sections and atomic statements	tenant_admin, compliance_manager, compliance_officer
policy.map	Map policies	Link policies to regulations, frameworks, and requirements	tenant_admin, compliance_manager, compliance_officer
policy.review	Review policies	Record formal policy review cadences and update review dates	tenant_admin, compliance_manager, compliance_officer
policy.operationalize	Manage operationalization	Link atomic policy statements to controls, risks, scopes, tasks, and evidence expectations	tenant_admin, compliance_manager, compliance_officer
policy.attest	Attest to policies	Acknowledge or decline policy attestations addressed to you in My Policies	All workspace roles (every employee)

---

Governance Content Library & Policy Packs

Governs browsing, previewing, and adopting certified Content 2.0 governance packs and templates into the tenant.

Requires the content_library entitlement.

Permission Key	Display Name	Description	Default Roles
policy_pack.read	Browse policy packs	Browse the Content 2.0 catalog, pack versions, and adoption state	tenant_admin, compliance_manager, compliance_officer, auditor
policy_pack.author	Author policy packs	Create and version reusable policy templates and packs	tenant_admin, compliance_manager
policy_pack.adopt	Adopt policy packs	Adopt a policy pack or template into this tenant as Draft governed policies	tenant_admin, compliance_manager, compliance_officer

Decoupled retention

Adopting a pack copies certified templates into tenant-local draft policies with immutable catalog source linkage (source_pack_id). If content_library is later revoked, existing adopted tenant policies survive and remain editable under policy.write.

---

Existing Policy Assessments

Governs the Upload & Assess workflow, extracting clauses from uploaded policies and assessing coverage against target expectations.

Requires the policy_governance entitlement.

Permission Key	Display Name	Description	Default Roles
policy_assessment.read	View policy assessments	View existing-policy coverage assessments, extracted segments, and results	tenant_admin, compliance_manager, compliance_officer, auditor
policy_assessment.run	Run policy assessments	Create an assessment, upload source policies, and run structural extraction	tenant_admin, compliance_manager, compliance_officer
policy_assessment.review	Review policy assessments	Accept/reject mappings, set authoritative coverage results, and complete assessment	tenant_admin, compliance_manager

---

Regulatory & Content Change Impact

Governs impact candidates generated by horizon regulatory change events or Content 2.0 updates.

Requires the policy_governance entitlement.

Permission Key	Display Name	Description	Default Roles
change_impact.read	View change impact	View change events, potential impact candidates, and assessments	tenant_admin, compliance_manager, compliance_officer, risk_manager, auditor
change_impact.assess	Assess change impact	Assess impact candidates, record dispositions, and link remediation	tenant_admin, compliance_manager, compliance_officer
change_impact.approve	Approve change impact	Approve high-impact change dispositions and closures (maker-checker SoD)	tenant_admin, compliance_manager

---

Security Tool Integrations

Governs scanner connections (Tenable Security Center, Nessus, Titania Nipper, Qualys), automated sync jobs, and scanner finding triage.

Requires the integrations_security_tools entitlement. Ships dark when disabled.

Permission Key	Display Name	Description	Default Roles
integration.read	View scanner integrations	View scanner connections, sync jobs, report imports, and scanner findings	tenant_admin, compliance_manager, compliance_officer, risk_manager, auditor
integration.manage	Manage scanner integrations	Create, configure, test, sync, and rotate scanner connections; triage findings	tenant_admin, compliance_manager
integration.import	Import scanner reports	Upload .nessus, Tenable CSV, or Nipper report files for governed import (maker)	tenant_admin, compliance_manager, compliance_officer
integration.confirm	Confirm scanner imports	Confirm or reject a previewed scanner import (checker — never the uploader)	tenant_admin, compliance_manager
asset.discovery_review	Review discovered assets	Approve, merge, or ignore scanner-discovered assets before inventory admission	tenant_admin, compliance_manager, compliance_officer

---

Cloud & Identity Discovery

Governs automated discovery from Microsoft Entra ID, Microsoft Azure, AWS, and Prowler.

Requires the cloud_discovery entitlement. Ships dark when disabled.

Permission Key	Display Name	Description	Default Roles
discovery.read	View discovered identities & resources	View identity populations, cloud resources, configuration checks, and sync runs	tenant_admin, compliance_manager, compliance_officer, auditor
discovery.manage	Manage discovery	Configure cloud/identity connections, trigger syncs, and project into scopes	tenant_admin, compliance_manager

---

Governed Exceptions

Governs policy, requirement, and control exceptions (EXC-YYYY-NNNN), compensating control evaluations, and renewals.

Requires the compliance_core entitlement.

Permission Key	Display Name	Description	Default Roles
exception.read	View exceptions	View the exception register, details, and compensating control links	All roles
exception.create	Create exceptions	Request a new policy, control, or requirement exception	tenant_admin, compliance_manager, compliance_officer, risk_manager, control_owner
exception.manage	Manage exceptions	Update, edit, or cancel draft exception requests	tenant_admin, compliance_manager, compliance_officer
exception.review	Review exceptions	Review exception requests and evaluate compensating controls	tenant_admin, compliance_manager, risk_manager
exception.approve	Approve exceptions	Grant or reject temporary exception approvals (maker-checker SoD)	tenant_admin, compliance_manager
exception.close	Close exceptions	Close, renew, or retire governed exceptions	tenant_admin, compliance_manager

---

Core Operational Permissions Matrix

Functional Area	Permission Key	Tenant Admin	Compliance Manager	Compliance Officer	Risk Manager	Control Owner	Auditor	Read Only
Policy	policy.read	Yes	Yes	Yes	Yes	Yes	Yes	Yes
	policy.write	Yes	Yes	Yes	No	No	No	No
	policy.operationalize	Yes	Yes	Yes	No	No	No	No
	policy.attest	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Content	policy_pack.read	Yes	Yes	Yes	Yes	No	Yes	Yes
	policy_pack.adopt	Yes	Yes	Yes	No	No	No	No
Assessments	policy_assessment.run	Yes	Yes	Yes	No	No	No	No
	policy_assessment.review	Yes	Yes	No	No	No	No	No
Change Impact	change_impact.assess	Yes	Yes	Yes	No	No	No	No
	change_impact.approve	Yes	Yes	No	No	No	No	No
Integrations	integration.read	Yes	Yes	Yes	Yes	No	Yes	Yes
	integration.import	Yes	Yes	Yes	No	No	No	No
	integration.confirm	Yes	Yes	No	No	No	No	No
Discovery	discovery.read	Yes	Yes	Yes	Yes	No	Yes	Yes
	discovery.manage	Yes	Yes	No	No	No	No	No
Exceptions	exception.create	Yes	Yes	Yes	Yes	Yes	No	No
	exception.approve	Yes	Yes	No	No	No	No	No

---

Semantic Doctrine

Permissions and determinations are distinct concepts

• policy.map does not certify compliance: Linking an internal policy to a regulation demonstrates design intent; it does not prove adherence.
• policy.operationalize does not certify effectiveness: Associating a policy statement with a control records structural linkage; effectiveness is evaluated independently by tests and evidence.
• integration.read does not certify security posture: Ingesting scanner findings collects technical observations; it does not replace risk acceptance or remediation governance.
• policy.attest does not certify effectiveness: An employee attestation confirms document awareness; it does not establish control operation.