Roles and permissions
This page is generated from the product’s own role catalogue, so it cannot drift from what the product enforces. OTB Works ships 14 roles built from 26 permissions. An administrator can also create custom roles in Admin → People and access; those are specific to your instance and are not listed here.
A person can hold several roles at once, roles are additive.
Scope says where a role’s permissions apply: across the whole programme, or only on the workstreams and work packages the person is named on.
| Role | Key | Scope | What it is for |
|---|---|---|---|
| Member | member |
Only for their own workstreams and work packages | Works on the plan day to day: can see and edit the workstreams and work packages they’re part of, approve changes on that same work, sign off the stages they’re named on, follow how the programme is tracking, read the published month, and, once an admin has turned Advisor on and made this role eligible, ask Advisor about their own work. |
| Admin | admin |
Programme-wide | Every capability, everywhere, with no restriction to any one part of the programme: runs all five stages, administers the programme’s people and set-up, people and their access, the Jira/Azure DevOps connection, the status vocabulary and sign-off chains, the data importer, but not the keys to the instance itself (the licence, single sign-on, email, updates, Advisor and Support settings), which belong to a System administrator; sees and edits cost figures, signs off and can sign on behalf of a customer who cannot log in, and carries risk-acceptance authority in its own right so risk can still be accepted before a dedicated Risk Owner is configured. |
| System administrator | sysadmin |
Programme-wide | Runs the instance itself: the licence, single sign-on, outbound email, updates, Advisor’s settings and Support settings. Sees none of the programme and cannot manage people or their access, that is the Admin role. Give both to someone who does both. |
| Workstream Lead | workstream_lead |
Only for their own workstreams and work packages | Leads one or more workstreams: sees and edits their plan, approves changes on them, writes and publishes their monthly report, and is who sign-off steps address by name for that workstream. |
| Work Package Owner | work_package_owner |
Only for their own workstreams and work packages | Owns one or more work packages: sees and edits their plan, approves changes on them, writes and publishes their monthly report, and signs off the stages they are named on. |
| Customer | customer |
Only for their own workstreams and work packages | Sees only their own deliverables, what “done” looks like, the evidence, the dates, and how sign-off is going, and can sign them off or send them back. Nothing else in the programme. |
| Delivery Lead | delivery_lead |
Programme-wide | Oversees the whole programme, not just one workstream: creates workstreams, changes how status is judged, rules on findings and scopes the response into work, writes and publishes the month, and can sign off, including on behalf of a customer who cannot log in. Reads Assess, because the remediation programme they run answers the findings assurance raises. Does not see cost figures unless also given Finance. |
| Finance | finance |
Programme-wide | Sees and manages money across the whole programme, budgets, actuals and forecasts, without editing the plan itself. Also authors and maintains benefit records programme-wide, since a benefit’s value case is the same kind of thing Finance already tracks, and follows how the programme is tracking against what it promised. |
| Reviewer | reviewer |
Programme-wide | Can approve or reject proposed changes anywhere in the programme, without proposing or editing the plan. |
| Board Reader | board_reader |
Programme-wide, read-only | The board’s view, read-only and programme-wide: how the programme is tracking, the published monthly reports, the board pack and the cost figures in it, the plan behind them, and assurance findings and risk acceptances. Carries none of the matching edit rights, and cannot produce a board pack, only read one. |
| Auditor | auditor |
Programme-wide, read-only | Reads everything, changes nothing. Sees all five stages, the assurance work, the decisions taken, the plan, how the programme is tracking and every published report, plus the cost figures, programme-wide, while carrying none of the matching edit rights. Cannot edit anything, cannot sign anything off, cannot accept a risk, and cannot generate a board pack: only read all of it, including anyone’s Advisor history and whether a risk acceptance has lapsed. |
| Assessor | assessor |
Programme-wide | Runs assessments against a framework: scores nodes, raises findings, attaches evidence, and rules on each finding, challenge it, hand it to business as usual, or scope the work needed to answer it. Programme-wide, not tied to any one workstream. Deliberately cannot accept a risk: the person who assessed must not be the person who accepts the risk, and that separation is built into which capabilities this role holds, not left to a check elsewhere to catch. |
| Risk Owner | risk_owner |
Programme-wide | The risk-accepting authority, deliberately a separate stance from Assessor: reads assessments, findings and the decisions taken on them, and can accept a risk, programme-wide. Cannot raise, score or rule on findings, a Risk Owner accepts a risk someone else raised, and is still refused if they try to accept a risk on a finding from an assessment they themselves assessed, regardless of which roles they hold. |
| Assess Contributor | assess_contributor |
Programme-wide | Scores the sections of an assessment they’ve been assigned, a network lead answering network questions, a SOC lead answering detection questions, without seeing the rest of the module. Sees only the assessments they’re named on, and only what that assessment’s own visibility setting and their own section assignment allow. Cannot accept a risk or administer frameworks. |
Role × permission matrix
Section titled “Role × permission matrix”✓ means the role holds the permission, including permissions it holds because a stronger one implies them (for example, being able to edit cost figures implies being able to see them). For a role scoped to a person’s own work, each permission applies only within that work.
| Permission | Member | Admin | System administrator | Workstream Lead | Work Package Owner | Customer | Delivery Lead | Finance | Reviewer | Board Reader | Auditor | Assessor | Risk Owner | Assess Contributor |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
self.manage |
✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
assess.view |
· | ✓ | · | · | · | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | · |
assess.edit |
· | ✓ | · | · | · | · | · | · | · | · | · | ✓ | · | · |
assess.manage |
· | ✓ | · | · | · | · | · | · | · | · | · | · | · | · |
assess.contribute |
· | · | · | · | · | · | · | · | · | · | · | · | · | ✓ |
decide.view |
· | ✓ | · | · | · | · | ✓ | · | · | ✓ | ✓ | ✓ | ✓ | · |
decide.edit |
· | ✓ | · | · | · | · | ✓ | · | · | · | · | ✓ | · | · |
deliver.view |
✓ | ✓ | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · |
deliver.edit |
✓ | ✓ | · | ✓ | ✓ | · | ✓ | · | · | · | · | · | · | · |
deliver.manage |
· | ✓ | · | · | · | · | ✓ | · | · | · | · | · | · | · |
change.approve |
✓ | ✓ | · | ✓ | ✓ | · | ✓ | · | ✓ | · | · | · | · | · |
steer.view |
✓ | ✓ | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | · | · | · |
prove.view |
✓ | ✓ | · | ✓ | ✓ | · | ✓ | ✓ | · | ✓ | ✓ | · | · | · |
prove.edit |
✓ | ✓ | · | ✓ | ✓ | · | ✓ | · | · | · | · | · | · | · |
costs.view |
· | ✓ | · | · | · | · | · | ✓ | · | ✓ | ✓ | · | · | · |
costs.edit |
· | ✓ | · | · | · | · | · | ✓ | · | · | · | · | · | · |
acceptance.sign |
✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | · | · | · | · | · | · | · |
acceptance.sign_on_behalf |
· | ✓ | · | · | · | · | ✓ | · | · | · | · | · | · | · |
risk.accept |
· | ✓ | · | · | · | · | · | · | · | · | · | · | ✓ | · |
advisor.use |
✓ | ✓ | · | ✓ | ✓ | · | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | · |
advisor.audit |
· | ✓ | · | · | · | · | · | · | · | · | ✓ | · | · | · |
audit.read |
· | ✓ | · | · | · | · | · | · | · | · | ✓ | · | · | · |
admin.manage |
· | ✓ | · | · | · | · | · | · | · | · | · | · | · | · |
accounts.manage |
· | · | · | · | · | · | · | · | · | · | · | · | · | · |
instance.operate |
· | · | ✓ | · | · | · | · | · | · | · | · | · | · | · |
framework.author |
· | ✓ | · | · | · | · | · | · | · | · | · | · | · | · |