Permissions
Overview
Asenion uses role-based access control with fine-grained capability overrides. Every action in the platform is governed by a named capability. Each role carries a default set of capabilities. Org Admins can grant or revoke individual capabilities per user on top of their role — without changing the role itself.
This means:
- A Member can be given a specific capability (e.g.
report:view) without being promoted to Org Admin. - An Org Admin can have a specific capability removed without changing their role.
- The effective permission set for any user is: role defaults + individual grants − individual revokes.
Capability scopes
Capabilities are organized by scope, from broadest to narrowest:
Platform-level
Reserved for System Admins.
| Capability | What it allows |
|---|---|
platform:manage_system_admins | Grant and revoke System Admin access |
platform:manage_organizations | Create and manage organizations |
platform:manage_system_policies | Manage platform-wide report templates |
Organization-level
Assigned to organization roles.
| Capability | What it allows |
|---|---|
org:manage_members | Invite, remove, and edit member roles and capability overrides |
org:manage_policies | Create, edit, import, and archive policies in the org library |
org:manage_settings | Edit org name, 2FA enforcement, SSO, organization units |
org:create_project | Create new AI systems |
org:view_all_projects | See all AI systems in the org (not just ones you are added to) |
org:view_governance | View the governance policy library dashboard |
org:view_assurance | View the Assurance Hub |
org:view_activity_log | View the organization-level activity log |
Project-level
Scoped to a specific AI system; assigned via project role.
| Capability | What it allows |
|---|---|
project:manage_members | Add, remove, and change roles for project members |
project:manage_assessments | Create, configure, and manage assessments on the project |
project:archive | Archive the AI system record |
project:view_activity_log | View the activity log for this specific project |
Assessment-level
Scoped to assessment actions within a project.
| Capability | What it allows |
|---|---|
assessment:answer | Answer controls in an assessment |
assessment:submit_for_review | Submit a completed assessment into the review queue |
assessment:review | Review a submitted assessment |
assessment:submit_for_approval | Forward a reviewed assessment to an Approver |
assessment:approve | Approve a reviewed assessment |
assessment:reject | Reject an assessment back to the submitter |
Report-level
| Capability | What it allows |
|---|---|
report:view | View reports generated for AI systems |
report:download | Download reports as PDF or other formats |
report:manage_org | Upload and manage report templates at the org level |
Test-level
| Capability | What it allows |
|---|---|
test:configure | Set up assurance connections and target configurations |
test:run | Trigger assurance test runs |
Per-user capability overrides
Org Admins can grant or revoke specific capabilities for individual members from Organization Settings → Members → [member] → Permissions:
- Grant — adds a capability the user’s role does not have by default
- Revoke — removes a capability the user’s role normally carries
Role-capability matrix
System Admins can view and edit the full matrix of which capabilities each role carries by default from Admin → Role Capability Matrix. The matrix can be reset to platform defaults at any time.
Capability refresh
The platform re-fetches a user’s effective capabilities every 2 minutes automatically. When an admin changes a user’s capabilities, the change is reflected in their active session within that window — no logout required.
Related
- User Roles — the role definitions that carry default capability sets
- Admin — System Admin access to the role-capability matrix
- Global Project Roles — org-level assignment of project role slots