Roles & access
Create roles that grant each part of Noru at none, view or edit, and give them to members.
What it is
Roles & access lists the four built-in roles and the roles your organization defines itself. A custom role sets each module of Noru, such as Policies, Risks or Access reviews, to None, View or Edit, so you can let someone read policies and run access reviews without seeing your risk register. Each member holds exactly one role.
Roles & access is being rolled out. If you do not see it under Settings, it is not on for your organization yet; members keep the four built-in roles.
Where to find it
SettingsRoles & accessKey actions
Create a role
Evidence and Audits are filed against controls, so they need at least View on Frameworks & controls. When you grant either, Frameworks & controls is raised for you, and its row says which modules need it.
Change a role
Click Edit on the role. Changes apply to everyone on the role on their next page load or API call, including API keys and AI clients connected over MCP.
Duplicate or delete a role
Open the ⋯ menu on the role. Duplicate opens a copy to adjust. Delete role… is refused while members still have the role; give them another role under Members first.
Give someone a role
Roles are given under Members: pick the role in a member's role select, or in the invite dialog when you invite someone.
Statuses and fields
| Level | What a member on the role can do in that module |
|---|---|
| None | Nothing: its pages are not in the sidebar and open as not found |
| View | Read its pages and records |
| Edit | Read, create, change, link and delete |
| Field | Meaning |
|---|---|
| Built-in | Admin, Editor, Viewer and Auditor; they cannot be changed. An auditor works only in the external audits they are invited to |
| Member count | How many members have the role |
Tips and gotchas
Everyone can always reach their own work: their training, policy acknowledgements and workflow tasks waiting on them. Someone who reviews access still needs View on Access reviews to open a review.
A custom role never manages the organization. Members, roles, security, billing, API keys and webhooks stay with admins, so nobody can widen their own access.
- Records from a module a role does not include are shown as a count, for example "2 linked risks aren't shown because your role doesn't include Risks". Titles and names never reach the member.
- An organization can have up to 20 custom roles.
- The audit package download includes the asset inventory, training records and risk register, so it needs View on Risks, Assets and Personnel & training as well.
What Noru does not do
- It does not grant access record by record: a role covers a whole module.
- It does not combine roles. A member has one role, so you can always answer what they can do from that role alone.
- It does not map groups from your identity provider to roles.
Related
Last updated on