Roles & Permissions

Porcia uses role-based access control. What a person can see or do depends on their assigned role, workspace scope, enabled features, and the permission granted for that action.

​

Built-in roles

Every workspace includes four built-in roles: Built-in roles can’t be edited. If none of them fits, an Administrator can create a custom role in Settings → Members → Roles.

​

Department defaults

In Settings → Members → Departments, Administrators can map directory departments to a default role. When someone from a mapped department signs in for the first time, they get that role automatically.

​

Permission areas

An approval or governance decision in Porcia does not automatically grant access in an external application unless a separate, explicitly enabled provisioning workflow exists.

​

Changing a member’s role

Only an authorized administrator can change another member’s role. To change several members at once, select them with the checkboxes, choose a role, and click Apply.

​

Good access practices

• Keep administrative access limited to people who need it.
• Review workspace membership and access scope regularly.
• Remove or reduce access when responsibilities change.
• Use the narrowest role and data scope that supports the person’s work.
• Review provider and governance permissions before enabling optional actions.

​

Audit and review

Membership changes, such as invitations and removals, are recorded in the Audit Trail for roles that can view it.

​

Next steps