Custom Roles

Introduction - Custom Role

Note

• Custom Roles are designed for Groups entities.

• A maximum of 20 Custom Roles is supported. If you require more than 20 Custom Roles, please contact SAFE Support or submit a Service Request for further assistance.

Custom Roles for CTEM provide granular, action-level permissions, enabling fine control over what a user can do within specific Groups (or Groups matching a tag).

• Define permissions at action level (e.g., Read Group, Create Ticket, Delete Exception, Edit Dashboard)

• Restrict access to specific Groups by name or by tag

• Combine read access to one set of Groups with write access to another (for example, read-only on critical Groups, full access elsewhere)

• Opt in to Ticket and/or Exception access on any custom role — not only Admin-level roles

• Enable the least-privilege access model

• Custom Role can be created with a combination of First-party and Third-party actions & permissions.

Creating a Custom Role

Follow these steps to create a Custom Role in SAFE:

1. Navigate to Settings > Role Management.

2. Click on the Add Role button.

3. Enter a name and description for the Role.

4. Click the Add Permission button.

5. Select the required scope:

   1. First Party: Provides access to CRQ and CTEM use cases.

   2. Third Party: Provides access to TPRM use cases.

6. For the First Party, select Groups Name or Group Tags as the entity.

7. Use filters to limit the permission to specific Groups by name, or by Group tag.
   Leave the filter empty to grant access to all Groups.

8. Select the actions you want to grant for CRQ and CTEM usecase, such as Group actions (Read, Create, Edit, Delete), Ticket, Exception, and Dashboard actions.

   1. CRQ Permissions: Control access to Risk Scenarios, Controls, Questionnaires, and Risk Treatment Plans for the selected Groups.

   2. CTEM Permissions: Control access to Exception Management and Ticket Management for findings associated with the selected Groups.

9. If needed, click Add Permission again to add another block with different actions and a different Group filter, for example, read-only on one set of Groups and full access on another.

10. Click the Save button. The system will create the Custom Role, making it accessible within the role selection when inviting a user to SAFE.

Editing or Deleting Custom Roles

Editing a Custom Role

1. Navigate to Settings > Role Management.

2. Click on the three-dot options menu for the custom role you wish to edit.

3. From the menu, select the Edit option.

4. Modify the role name or adjust read/write permissions for the associated groups as needed.

5. Click the Save button.

Deleting a Custom Role

Notes

Before deletion, make sure that the user role is not currently assigned to any user.

1. Navigate to Settings > Role Management.

2. Click on the three-dot options menu for the custom role you wish to delete.

3. From the menu, select the Delete option.

4. Click the Delete button on the confirmation screen.

Role Scope and Access

When creating a custom role, select the scope that defines the type of data and capabilities the user can access.

First Party

Users with First Party by default can access the below:

• Dashboard — Users can create, edit, duplicate, and delete dashboards.

• Assets

• Findings

Additional access to CRQ and CTEM capabilities is determined by the:

• Assigned Groups or Group Tags

• Group Permissions

• CRQ and CTEM permissions configured for the role

For example, depending on the permissions assigned, users may be able to access and manage capabilities such as Risk Scenarios, Controls, Questionnaires, Risk Treatment Plans, Exceptions, and Tickets.

Note: If filters are not configured, the permissions apply to all Groups.

Custom Roles Limitations

Users assigned a Custom Role cannot access the following options from the left navigation:

• Agentic Workflow

• Integrations

• Threat Center

• User Management

• Role Management

• Questionnaire

Tickets and Exceptions Access

Users assigned a Custom Role with Ticket Management or Exception Management permissions can access all Tickets or Exceptions permitted by their assigned role.

However, when viewing an individual Ticket or Exception, the user may not have access to the associated Findings and Assets.

Third Party

Users with Third Party access can access the Dashboard.

Access to additional Third Party capabilities and actions is determined by the permissions configured for the role.

For example, users can access and perform actions on Third Parties, Questionnaires, Controls, and Risk Scenarios based on the permissions assigned to their role.

At a Glance