Access Control
The platform implements Attribute-Based Access Control (ABAC) layered on top of role-based permissions. In addition to role assignment, access decisions consider market scope, data residency zone, document confidentiality, and active workspace context.
Role Permissions Matrix
| Role | Modules | Create | Edit | Approve | Delete | Admin | Description |
|---|---|---|---|---|---|---|---|
| Regulatory Affairs | All | Yes | Yes | Yes | No | No | Full read/write access to all regulatory content. Can approve submissions and correspondence responses. |
| Reg Ops Publishing | PublishingSequencesContent AssemblyDispatch | Yes | Yes | Yes | No | No | Full access to publishing, sequence management, dispatch, and content assembly. |
| Labeling | LabelingStatementsArtwork | Yes | Yes | Yes | No | No | Full access to labeling artefacts, statements library, and artwork. Read-only on submissions. |
| Quality | InspectionDeviationsValidationAudit Log | Yes | Yes | No | No | No | Read access to all modules. Write access to deviations, CAPAs, validation evidence, and inspection packs. |
| Affiliate | ProductsApplicationsLabeling (read) | No | No | No | No | No | Read-only access to portfolio, applications, and labeling for assigned markets only. |
| Admin | All | Yes | Yes | Yes | Yes | Yes | Full system administration including user management, policy configuration, and integration management. |
| Inspector View | Inspection PacksAudit LogValidationDossiers (read) | No | No | No | No | No | Read-only access to all content configured for inspection readiness. Cannot modify any records. |
Attribute-Based Access Rules
Market Scope
Users may only access applications and labeling for markets assigned to their user profile.
Data Residency
Data tagged with a data residency zone may only be accessed by users located in that zone.
Approval Authority
Only users with Approve permission on the relevant module may advance workflow status to Approved.
Confidential Flag
Documents marked Confidential require explicit delegation from the document owner to share.
Session Context
Actions are scoped to the active Workspace (Enterprise/US/EU/JP/China/LATAM) selected at login.