Core Role Definitions
Standardized permission sets mapped to organizational responsibilities. Roles cascade from Global HQ → Regional → Division → Team.
🛡️
System Administrator
Platform Level
Full platform lifecycle management, role provisioning, SSO configuration, and cross-tenant policy enforcement.
Global Config
User Mgmt
Audit Export
📊
Division Lead
Division/Regional
Manages team assignments, approves access requests within division scope, and oversees divisional data governance.
Team Mgmt
Approval Workflow
Division Analytics
🔍
Data Analyst
Cross-Functional
Read-only access to aggregated datasets, BI tool integration, and scheduled report generation with data masking applied.
Read-Only
BI Access
Export
🔐
Security Auditor
Compliance
Immutable access to audit trails, permission reviews, policy violation alerts, and compliance reporting dashboards.
Audit Logs
Policy Review
No Modify
👷
Field Operator
Operations
Task execution, equipment telemetry, shift logging, and safety protocol compliance. Restricted to assigned sites only.
Task Execute
Site-Limited
Mobile App
🤝
External Partner
Vendor/Contractor
Time-bound, scope-restricted access. Enforced by NDA tags, session recording, and automated revocation post-contract.
Scoped Access
Session Record
Auto-Revoke
Permission Matrix
Granular capability mapping across core enterprise modules. Conditional access requires MFA or IP allowlisting.
| Module |
System Admin |
Division Lead |
Data Analyst |
Security Auditor |
Field Operator |
External Partner |
| Identity & Directory |
Full Control |
Manage Team |
— |
Audit Only |
— |
— |
| Financial Systems |
Full Control |
Approve ≤$500K |
Read/Export |
Audit Only |
— |
Invoice View |
| R&D / IP Vault |
Policy Override |
Project Scoped |
Masked Data |
— |
— |
— |
| Supply Chain / ERP |
Full Control |
Regional Ops |
Read/Forecast |
— |
Execution |
PO/Tracking |
| Compliance & Audit |
Config/Export |
Submit Reports |
— |
Full Access |
— |
— |
Full/Read Access
Conditional/Scoped
Restricted/None
Multi-Tenant Role Cascade
Roles inherit baseline permissions from global policy, then apply division-specific overrides and site-level constraints.
Global HQ
Baseline Policy & SSO
→
Regional Hub
Geo/Compliance Rules
→
Division
Module Access & Quotas
→
Team / Site
Task Assignment & Limits
Security & Compliance
Zero Trust Enforcement
Every access request is verified against identity, device posture, network context, and behavioral baselines before session grant.
Automated Provisioning
SCIM 2.0 & LDAP sync with HRIS. Roles auto-apply on hire, change on transfer, and revoke on exit within 15 minutes.
Immutable Audit Trail
WORM storage for all permission changes, login events, and data access. Tamper-proof hashing meets SOC 2 Type II & ISO 27001.
Just-In-Time Access
Elevated privileges granted temporarily for maintenance or audits. Auto-escalation requires dual-approval and time decay.
Frequently Asked Questions
How do I request access to a new module? ▾
Submit a request via the Platform → Access Portal. Your Division Lead will receive it automatically. Requests are processed within 24-48 hours based on compliance routing.
Can roles be customized per subsidiary? ▾
Yes. Division Leads can apply permission overrides within the global policy boundary. Custom roles require Security Team approval for audit compliance.
What happens to accounts during subsidiary acquisition? ▾
Legacy accounts are quarantined during due diligence. A unified migration script maps existing permissions to Aevum Zenth role equivalents with manual review checkpoints.
How are external vendors managed? ▾
Vendors receive scoped, time-bound accounts linked to active POs. Access auto-revokes on contract expiration, with optional extension workflows requiring legal sign-off.