User Management

User Management

The SCF Controls Platform uses role-based access control to manage what users can do within the application. This guide covers user roles, permissions, and management tasks.

Prerequisites

Before managing users:

• Google OAuth authentication must be available (see Authentication)
• You must have Admin role to manage users
• Users must sign in at least once to appear in the system

---

Roles and Permissions

The platform supports three roles with different permission levels:

RBAC Status

Role-based access control is currently informational only. All authenticated users have access to all features regardless of role. Permission enforcement is planned for a future release. Roles are tracked now so permissions can be enabled without reconfiguration.

Admin

Full access to all features

Permission	Description
Manage users and roles	Invite users, assign roles, remove access
Invite new users	Add users to the organisation
Remove users	Remove users from the organisation
Create, edit, delete controls	Full control management
Create, edit, delete evidence	Full evidence management
Manage tasks and assignments	Task and assignment management
View all data and reports	Access all dashboards and exports
Configure organisation settings	System configuration

Admin Access

Grant Admin access sparingly. When RBAC is enforced, Admins will be the only users able to modify user roles and remove users.

Editor

Can edit content but not manage users

Permission	Description
Create, edit, delete controls	Full control management
Create, edit, delete evidence	Full evidence management
Manage tasks and assignments	Task and assignment management
Add comments and mentions	Participate in discussions
View all data and reports	Access dashboards and exports

Editors are ideal for GRC analysts who need to manage compliance content but should not administer users.

Viewer

Read-only access

Permission	Description
View controls and evidence	Browse all content
View tasks and assignments	See task status
View reports and dashboards	Access reports
Add comments	Participate in discussions

Viewers can see everything but cannot modify content. Suitable for stakeholders who need visibility without editing capabilities.

---

Managing Users

Accessing User Management

1. Sign in with an Admin account
2. Click the Users icon in the sidebar (person icon)
3. The User Management page displays all organisation members

User List

The user list shows:

Column	Description
User	Avatar, name, and email from Google profile
Role	Current assigned role (dropdown selector)
Joined	Date the user joined the organisation
Actions	Remove button

Inviting Users

Users can join in two ways:

Option 1: Invite by Email

1. Click the Invite User button
2. Enter the user’s email address
3. Select a role for the new user
4. Click Send Invite
5. User receives an email invitation to join

Option 2: Self-Registration

1. Share your platform URL with the new user
2. User clicks Sign in with Google
3. User automatically joins with default role (viewer)
4. Admin can change role as needed

User Registration

Users must have a Google account to sign in.

Changing User Roles

1. Find the user in the list
2. Click the role dropdown next to their name
3. Select the new role (Admin, Editor, or Viewer)
4. The change is saved automatically

The role change takes effect immediately on the user’s next action.

Removing Users

To remove a user from the organisation:

1. Find the user in the list
2. Click the Remove button (trash icon)
3. Confirm the deletion when prompted

Data Retention

Removing a user removes them from the organisation but preserves their historical actions (comments, assignments, etc.) attributed to their email.

---

Role Selection Guide

Choose roles based on user responsibilities:

User Type	Recommended Role	Rationale
GRC Program Manager	Admin	Needs to manage team and all features
GRC Analyst	Editor	Day-to-day compliance work
IT Security Staff	Editor	Implements and updates controls
Department Manager	Viewer	Reviews compliance status
Auditor (internal)	Viewer	Reviews evidence and reports
Executive Stakeholder	Viewer	Dashboard access only

---

Role Permissions Reference

The User Management page includes an expandable Role Permissions Reference panel:

1. Click Role Permissions Reference to expand
2. View detailed permissions for each role
3. Use this as a quick reference when assigning roles

---

Assignments and Ownership

Control Assignments

Admins and Editors can assign controls to users:

1. Navigate to Control Scoping
2. Select a control
3. Click Assign in the detail panel
4. Select a user from the dropdown
5. Click Save

Assigned users receive visibility into their responsibilities but assignments don’t restrict editing.

Evidence Assignments

Similar to controls, evidence items can be assigned:

1. Navigate to Evidence Scoping
2. Select an evidence item
3. Set the Owner field
4. Click Save

Task Assignments

Tasks support explicit assignment:

1. Create or edit a task
2. Set Assigned To field
3. User sees task in My Tasks view

---

Best Practices

Role Assignment

1. Start with Viewer — Assign Viewer initially, upgrade as needed
2. Limit Admins — Keep Admin count minimal (2-3 per organisation)
3. Match responsibilities — Align roles with job functions
4. Review periodically — Audit user roles quarterly

User Lifecycle

1. Onboarding — Provide new users with role-appropriate training
2. Role changes — Document when and why roles change
3. Offboarding — Remove users promptly when they leave

Security

1. Assign appropriate roles — Prepare for when RBAC is enforced
2. Audit trail — All actions are logged with user attribution
3. Least privilege — Give users minimum access they’ll need

---

Troubleshooting

User Cannot Sign In

1. Verify Google OAuth is working correctly
2. Have user clear browser cache and try again
3. Check if user is using the correct Google account

User Has Wrong Role

1. Navigate to User Management
2. Find the user in the list
3. Use the role dropdown to change their role
4. Change takes effect immediately

User Not Appearing in List

Users must sign in at least once to appear in User Management. If a user has signed in but doesn’t appear:

1. Check browser console for authentication errors
2. Have the user sign out and sign in again
3. Ensure the user signed into the correct organisation

Invite Email Not Received

1. Check spam/junk folder
2. Verify email address was entered correctly
3. Try re-sending the invitation
4. Contact support if issues persist

---

Multi-User Collaboration

The platform supports multiple users working simultaneously with automatic data synchronisation.

How Synchronisation Works

Three sync mechanisms:

Mechanism	Behaviour
Automatic Polling	Fetches fresh data every 30 seconds
Focus Refetch	Instantly refreshes when switching back to the tab
Manual Refresh	Click the refresh button in the header

Sync Status Indicator

The header shows real-time sync status:

• “Synced Xm ago” — Data is current
• “Syncing…” — Currently fetching updates

Collaboration Best Practices

For Real-Time Collaboration:

1. Keep tabs focused — Switch away and back to trigger instant refresh
2. Use refresh button — Click refresh before making critical changes
3. Check sync indicator — Ensure data is current before editing
4. Wait for sync — If “Syncing…” is shown, wait before making edits

For Team Workflows:

1. Coordinate with team — Use Slack/Teams to communicate who’s editing what
2. Work in different domains — Multiple users can edit different control domains simultaneously
3. Refresh before bulk operations — Click refresh, then select all/deselect all

Conflict Resolution

The platform uses last-write-wins strategy:

• Simple and works well for most GRC workflows
• If two users edit the same control simultaneously, the last save wins
• 30-second sync interval is fast enough to avoid most conflicts

For a compliance tool, this approach is typically sufficient since:

• Controls are usually edited by different teams
• Changes are incremental rather than wholesale replacements
• Users can coordinate through comments and assignments

---

Related Guides

• Configuration — Platform settings
• Authentication — Google OAuth setup
• Quick Reference — Feature overview