Skip to main content

Role Management

Role Management

  • By SAFE Security
  • Published: May 22, 2026
  • Rating
    Average rating: 0 No reviews

Outline

Introduction

User Roles in SAFE define data access, operational permissions, and the scope of control across the platform. SAFE supports three distinct role types to address varying levels of access control and flexibility:

  • Default Roles (Admin, Viewer): Out-of-the-box roles with predefined permissions

  • Static Custom Roles: Custom roles with fixed permissions mapped to Groups/Organizations

  • Smart Custom Roles: Advanced roles with granular, action-level permissions (only for Third-Party workflows)

Default Roles (Admin & Viewer)

These are system-defined roles available by default in SAFE and cannot be modified.

  • Admin- Full access across SAFE One

  • Viewer- Read-only access to SAFE One

  • CRQ Admin - Full access to CRQ only

  • CRQ Viewer - Read-only access to CRQ only

  • TPRM Admin - Full access to TPRM only

  • TPRM Viewer - Read-only access to TPRM only

  • CTEM Admin - Full access to CTEM only

  • CTEM Viewer - Read-only access to CTEM only

Key Characteristics

  • Predefined by SAFE

  • No configuration or customization allowed

  • Ideal for standardized access control

Default Roles User Access - Admin and Viewer

SAFE Modules Features Admin Viewer
Dashboards View all Dashboards Yes Yes
Dashboards Add Dashboard Yes Yes
Dashboards Duplicate Dashboard Yes Yes
Dashboards Delete Dashboard Yes Yes
Agentic Workflow View all Workflows Yes Yes
Agentic Workflow Create Workflows Yes No
Agentic Workflow Edit Workflows Yes No
Agentic Workflow Duplicate Workflows Yes No
Agentic Workflow Delete Workflows Yes No
Agentic Workflow Execute Workflow Yes No
Risk Scenarios Create Risk Scenarios Yes No
Risk Scenarios View Risk Scenarios Yes Yes
Risk Scenarios Edit Risk Scenario Yes No
Risk Scenarios Duplicate Risk Scenario Yes No
Risk Scenarios Delete Risk Scenario Yes No
Risk Scenarios Edit Control Parameters Yes No
Risk Scenarios View Scoring Factors Yes Yes
Risk Scenarios Edit Scoring Factors Yes No
Groups Create Group Yes No
Groups View Groups List Yes Yes
Groups Edit Group Yes No
Groups Duplicate Group Yes No
Groups Delete Group Yes No
Groups View Questionnaire Yes Yes
Groups Submit Questionnaire Assessment Yes No
Groups Reuse Existing Questionnaire Assessment Yes No
Groups Controls - What If Analysis Yes No
Groups Edit Control Parameter Yes No
People View Users List Yes Yes
People Edit Users Yes No
People Delete Users Yes No
Assets View Asset List Yes Yes
Assets Delete Assets Yes No
Assets Edit Assets Yes No
Assets Bulk Delete Assets Yes No
Assets Bulk Edit Assets Yes No
Third Party Add Third Party (Individual & Bulk Upload) Yes No
Third Party View Third Parties Yes Yes
Third Party Edit Third Party Yes No
Third Party Delete Third Party Yes No
Third Party Edit Third Party Status Yes No
Third Party View Third Party Details Yes Yes
Third Party Submit Questionnaire Assessment Yes No
Third Party Edit Control Parameter Yes No
Third Party Upload Documents Yes No
Integrations View List of Supported & Configured Integrations Yes No
Integrations Configure Integrations Yes No
Control Centre View Controls List & Details Yes Yes
Control Centre Edit Control Parameter Yes No
Control Centre What If Analysis Yes Yes
Control Centre Reuse Control Maturity Assessment Yes No
Control Centre Reset Control Maturity Assessment Yes No
Questionnaire View Questionnaires Yes Yes
Questionnaire Submit Questionnaire Assessment Yes No
Settings My Profile Yes Yes
Settings Security Yes Yes
Settings API Credentials Yes No
Settings User Management Yes No
Settings Role Management Yes No
Settings Invitations Yes No
Settings Custom Fields Yes No
Settings Attack Surface Yes No
Settings Company Settings Yes No
Settings Third-party Tiering Yes No
Settings Advanced Yes No
Settings About Yes Yes

Default Roles User Access - CRQ

SAFE Modules Features CRQ Admin CRQ Viewer
Dashboards View all Dashboards Yes Yes
Dashboards Add Dashboard Yes Yes
Dashboards Duplicate Dashboard Yes Yes
Dashboards Delete Dashboard Yes Yes
Risk Scenarios Create Risk Scenarios Yes No
Risk Scenarios View Risk Scenarios Yes Yes
Risk Scenarios Edit Risk Scenario Yes No
Risk Scenarios Duplicate Risk Scenario Yes No
Risk Scenarios Delete Risk Scenario Yes No
Risk Scenarios Edit Control Parameters Yes No
Risk Scenarios View Scoring Factors Yes Yes
Risk Scenarios Edit Scoring Factors Yes No
Groups Create Group Yes No
Groups View Groups List Yes Yes
Groups Edit Group Yes No
Groups Duplicate Group Yes No
Groups Delete Group Yes No
Groups View Questionnaire Yes Yes
Groups Submit Questionnaire Assessment Yes No
Groups Reuse Existing Questionnaire Assessment Yes No
Groups Controls - What If Analysis Yes No
Groups Edit Control Parameter Yes No
People View Users List Yes Yes
People Edit Users Yes No
People Delete Users Yes No
Assets View Asset List Yes Yes
Assets Delete Assets Yes No
Assets Edit Assets Yes No
Assets Bulk Delete Assets Yes No
Assets Bulk Edit Assets Yes No
Integrations View List of Supported & Configured Integrations Yes No
Integrations Configure Integrations No (Future) No
Control Centre View Controls List & Details Yes Yes
Control Centre Edit Control Parameter Yes No
Control Centre What If Analysis Yes Yes
Control Centre Reuse Control Maturity Assessment Yes No
Control Centre Reset Control Maturity Assessment Yes No
Questionnaire View Questionnaires Yes Yes
Questionnaire Submit Questionnaire Assessment Yes No
Settings My Profile Yes Yes
Settings Security Yes Yes
Settings API Credentials Yes No
Settings User Management Yes No
Settings Role Management Yes No
Settings Invitations Yes No
Settings Custom Fields Yes No
Settings Attack Surface Yes No
Settings Company Settings Yes No
Settings Advanced Yes No
Settings About Yes Yes
Agentic Workflow Access No No

Default Roles User Access - TPRM

SAFE Modules Features TPRM Admin TPRM Viewer
Dashboards View all Dashboards Yes Yes
Dashboards Add Dashboard Yes Yes
Dashboards Duplicate Dashboard Yes Yes
Dashboards Delete Dashboard Yes Yes
Agentic Workflow View all Workflows Yes Yes
Agentic Workflow Create Workflows Yes No
Agentic Workflow Edit Workflows Yes No
Agentic Workflow Duplicate Workflows Yes No
Agentic Workflow Delete Workflows Yes No
Agentic Workflow Execute Workflow Yes No
Third-Party Add Third Party (Individual & Bulk Upload) Yes No
Third-Party View Third Parties Yes Yes
Third-Party Edit Third Party Yes No
Third-Party Delete Third Party Yes No
Third-Party Edit Third Party Status Yes No
Third-Party View Third Party Details Yes Yes
Third-Party Submit Questionnaire Assessment Yes No
Third-Party Edit Control Parameter Yes No
Third-Party Upload Documents Yes No
Integrations View List of Supported & Configured Integrations Yes No
Integrations Configure Integrations Yes No
Settings My Profile Yes Yes
Settings API Credentials Yes No
Settings User Management Yes No
Settings Role Management Yes No
Settings Invitations Yes No
Settings Custom Fields Yes No
Settings Company Settings Yes No
Settings Third-party Tiering Yes No
Settings Advanced Yes No
Settings About Yes Yes
Settings Automation Settings Yes No
Settings Default Notifications Yes No

Default Roles User Access - CTEM

SAFE Modules Features CTEM Admin CTEM Viewer
Dashboards View all Dashboards Yes Yes
Dashboards Add Dashboard Yes Yes
Dashboards Duplicate Dashboard Yes Yes
Dashboards Delete Dashboard Yes Yes
Agentic Workflow View all Workflows Yes Yes
Agentic Workflow Create Workflows Yes No
Agentic Workflow Edit Workflows Yes No
Agentic Workflow Duplicate Workflows Yes No
Agentic Workflow Delete Workflows Yes No
Agentic Workflow Execute Workflow Yes No
Groups Create Group Yes No
Groups View Groups List Yes Yes
Groups Edit Group Yes No
Groups Duplicate Group Yes No
Groups Delete Group Yes No
Assets View Asset List Yes Yes
Integrations View List of Supported & Configured Integrations Yes No
Integrations Configure Integrations No (Future) No
Findings View Findings TBD TBD
Findings Export Findings TBD TBD
Findings Create Ticket from Findings TBD TBD
Findings Create Exception from Findings TBD TBD
Findings Remove Findings from Existing Ticket TBD TBD
Findings Remove Findings from Existing Exception TBD TBD
Tickets View Tickets TBD TBD
Tickets Create Ticket TBD TBD
Tickets Edit / Unlink Ticket TBD TBD
Tickets Delete Ticket TBD TBD
Settings Create Ticketing Rule TBD TBD
Settings My Profile Yes Yes
Settings Security Yes Yes
Settings API Credentials Yes No
Settings User Management Yes No
Settings Role Management Yes No
Settings Company Settings Yes No
Settings Advanced Yes No
Settings About Yes Yes
Threat Center View Threat Center TBD TBD

Static Custom Roles

Static Custom Roles allow administrators to define fixed read/write permissions and assign them to specific Groups or Organizations.

  • Assign permissions at the Group or Organization level

  • Control access using Read / Write checkboxes

  • Create multiple roles aligned to the organizational structure

  • Maximum limit: 20 Custom Roles. If there is a requirement for additional Custom Roles beyond this limit, kindly reach out to SAFE Support or submit a Service Request for further assistance.

Key Characteristics

  • Permission Model: Read/Write access
  • Scope Control: Group-level or Third-Party level
  • Flexibility: Fixed (does not change dynamically)
  • Use Case: Department-based or business-unit-based access control

Creating a Static Custom Role

Follow these steps to create a Custom Role in SAFE:

  1. Navigate to Settings > Access Management  > Roles

  2. Click on the blue plus sign to add a new role

  3. Select the Static option.

  4. Enter a name and description for the Role.

  5. Specify read and write permissions for each group or third party

  6. Utilize the filter option to streamline the display of relevant groups.

  7. Click the Save button. The system will create the Static Custom Role, making it accessible within the role selection when inviting a user to SAFE.

Once a custom role is created, you can assign the role to existing users and select this role while inviting a new user. Refer to User Management for more details.

Smart Custom Role

Smart Custom Roles provide granular, action-level permissions, enabling fine control over what users can do within specific modules.

  • Define permissions at action level (e.g., Create Org, Add Questionnaire, Edit Third Party)

  • Restrict access specifically to the Third-Party module

  • Enable the least privilege access model

  • Automatically adapts based on selected actions

Key Characteristics

  • Permission Model: Action-level (Create, Edit, Delete, Submit)
  • Scope Control: Group-level or Third-Party level
  • Flexibility: Dynamic and granular
  • Use Case: TPRM workflows, vendor access control, and least-privilege enforcement

Creating a Smart Custom Role

Follow these steps to create a Custom Role in SAFE:

  1. Navigate to Settings > Access Management > Roles

  2. Click on the blue plus sign to add a new role

  3. Select the Smart option.

  4. Enter a name and description for the Role.

  5. Click the Add Permission button.

  6. Expand the permissions section and add the actions by selecting the checkboxes.

  7. Use the filter option to include third parties.

  8. Click the Save button. The system will create the Smart Custom Role, making it accessible within the role selection when inviting a user to SAFE.

Editing or Deleting Custom Roles

  1. Navigate to Settings > Access Management > Roles

  2. Click on the three-dot options menu for the custom role you wish to edit or delete.

  3. From the menu, select the Edit or Delete option.

  4. Modify the role name or adjust read/write permissions for the associated groups as needed.

  5. Click the Save button.

Before deletion, make sure that the user role is not currently assigned to any user.

Limitations

  • Custom Roles cannot access Agentic Workflows. Agentic Workflow stays on the list of options a Custom Role cannot reach from the left navigation. Custom Role support is a later phase.
  • CRQ Admin has no Agentic Workflow access. It also cannot assign Agentic Workflow permissions to a role it creates.
  • Viewers cannot execute a workflow. Running counts as an update, so TPRM Viewer, CTEM Viewer, and Viewer can open a workflow and read its run history but cannot create, edit, publish, execute, or delete one.
  • Workflows created before this release have no Scope and stay visible to both products until they are next edited, at which point a Scope must be chosen.
  • Operator actions stay Admin-only — disable all, enable, provision out-of-the-box workflows, and the workflow metrics endpoints are not available to product roles.

Did this article help?

Let us know by leaving a star rating at the top of this article.