Roles and permissions

Part ofSet up Soveryne for your organisation

This page explains which roles each Soveryne product has and what each role can do. Use it to decide which role to give a person, and to understand why a button you can see is refused.

How roles work

Each product has its own roles. Command has named roles for governance work. The other products have two levels of access: administrator and everyone else.

People get their role when they sign in, from your organisation's sign-in rules or a personal invitation. See Single sign-on.

Administrator access is never granted through single sign-on. No sign-in rule, domain rule or invitation can make someone an administrator. Your first administrator is set up by Soveryne or by your partner when your workspace is created.

In Command, most buttons are visible to everyone. When your role does not allow an action, Command refuses it and shows a message, instead of hiding the button.

Command

Command has five named roles.

Role	What it is for
Admin	Runs the workspace: people and sign-in, departments, the organisation profile, frameworks, and every governance task
Policy editor	Writes and approves controls, generates and publishes policies, and asks colleagues for evidence
Incident responder	Opens investigations and incidents and runs the response, including reporting deadlines
Auditor	Reads everything that matters for an audit, and runs the AI evidence check. The role your staff get by default.
Security manager	Looks after the asset register and the organisation profile, imports frameworks, and runs the AI assists on controls and evidence

What each role can do

Task	Admin	Policy editor	Security manager	Incident responder	Auditor
See controls, evidence, frameworks, incidents and the audit log	Yes	Yes	Yes	Yes	Yes
See the asset register	Yes	Yes	Yes	Yes	Yes
See policy documents	Yes	Yes	Yes	No	Yes
See evidence requests	Yes	Yes	Yes	No	Yes
Create, edit, publish and delete controls	Yes	Yes	No	No	No
Run the AI assists on a control (draft, critique, mapping suggestions, translation)	Yes	No	Yes	No	No
Approve a control that is in review	Yes	Yes	Yes	No	No
Link a control to an asset	Yes	Yes	Yes	No	No
Apply a template pack	Yes	Yes	No	No	No
Generate, approve and publish policy documents	Yes	Yes	No	No	No
Get proposed changes from the AI co-pilot in the policy editor	Yes	Yes	Yes	No	No
Draft an evidence request	Yes	Yes	Yes	No	No
Send evidence requests and review what comes back	Yes	Yes	No	No	No
Upload evidence files	Yes	No	No	No	No
Run the AI evidence check (Check as auditor)	Yes	No	Yes	No	Yes
Open investigations and incidents, and work on them	Yes	No	No	Yes	No
Register, edit and retire assets	Yes	No	Yes	No	No
Answer import questions in the Review queue	Yes	No	No	No	No
Enrol frameworks and create a custom framework	Yes	No	No	No	No
Import a framework	Yes	No	Yes	No	No
Manage departments	Yes	No	No	No	No
Edit the organisation profile	Yes	No	Yes	No	No
Change the workspace Content language	Yes	No	No	No	No
Invite people, change roles, and deactivate accounts in Users & roles	Yes	No	No	No	No
Manage single sign-on	Yes	No	No	No	No

Every role sees the records its row in the table allows for the whole organisation, not only the records the person created. Notifications are personal.

Chat. Every role can use at least one of Command's assistants. The assistants you can pick depend on your role. See Chat and assistants.

Giving people a role

Staff who sign in from your organisation's email domain get Auditor unless your sign-in rules say otherwise. It is deliberately a read-mostly role.

To give someone another role, invite them by email address with that role, or change their role in Users & roles. You open Users & roles from Organisation › Workspace administration › Manage access. See Command settings.

You can't change or deactivate an Admin account in Users & roles, and you can't make anyone Admin there.

Note

Users & roles can show role names that differ from this page, and it lists roles that are not described here. Give people only the roles described on this page.

Counsel

Counsel has administrators and users. The profile menu shows your role as admin or user.

Role	What they can do
user	Chat with Counsel, upload their own documents, read the policies published to them, answer the evidence requests sent to them, and create a personal Report phishing token for Outlook
admin	The same screens as a user. Counsel has no separate administrator pages.

Your staff get user access through your organisation's email domain. People from outside your domains need a personal invitation.

Your uploads, chats and evidence are private within your organisation. No other user can see them.

You can only answer an evidence request that was sent to you.

See Counsel.

MESH

Role	What they can do
Admin	Everything in MESH: connect, verify, refresh and remove sources; add, edit and remove context entities and relationships; see People and groups, Workload identities, Access inventory, Import history, Review queue and Activity
Everyone else	Browse the Workspace view of the register, read-only

Assets themselves are registered, edited and retired in Command, under Assets.

Import questions are listed in MESH's Review queue, but you answer them in Command, under Assets › Connected sources › Review queue. That needs the Admin role in Command.

See MESH.

ATLAS

ATLAS has administrators and users. The account menu shows your role as admin or user. A person with neither sees No access and the message "Ask an ATLAS admin for access".

Task	admin	user
Add an organisation, add domains, addresses and ranges to scope	Yes	Yes
Verify ownership by DNS or another proof, and verify with a launch code	Yes	Yes
Generate launch code	Yes	No
Record attestation for ownership proved outside DNS	Yes	No
Record or withdraw the active reconnaissance mandate	Yes	Yes
Record authorisation and Withdraw authorisation for intrusive testing	Yes	No
Run scans; pause, resume and cancel them; edit scan profiles	Yes	Yes
Mark crown jewels and set criticality on the Map	Yes	Yes
Ticket and Accept findings	Yes	Yes
Export posture report and Export findings CSV	Yes	Yes

The intrusive testing form is shown to users too, but only an admin can record the authorisation. See ATLAS scope and consent.

BAIT

BAIT has administrators and users. On top of that, two responsibilities are given to named people, not to a role: approving campaigns, and being the Data Protection Officer.

Task	admin	user
Complete Set up your programme and edit Settings › Organisation	Yes	No
Add and verify sending domains	Yes	No
Bring in your people from your directory	Yes	No
Write, edit and approve scenarios	Yes	No
Create a campaign, request approval, pause and resume it	Yes	Yes
Approve a campaign	Yes, if marked as an approver	Yes, if marked as an approver
Download reports	Yes	Yes
Request identity reveal (audited)	Yes	No

Approvers. Only people marked as approvers can approve a campaign, and nobody can approve a campaign they created. You need at least two people on your programme team.

Data Protection Officer. Identifying the person behind a result needs a Data Protection Officer on file, and the person who asks can't be the Data Protection Officer. You name them under Settings › Organisation.

Employees who receive simulations never use BAIT.

See BAIT.

SPECTER

Role	What they can do
Everyone	Browse Adversaries, Techniques, Malware, CVEs, Sources and Source health, open every record, and search the CVE catalogue
Admin	The same, plus the Last Attempt At and Error Code columns on Source health

Nobody can change SPECTER's intelligence from the console. It is a shared, read-only catalogue. See SPECTER.

Troubleshooting

What you see	Likely cause	What to do
A page in Command is empty after you sign in	No sign-in rule gives you a role yet	Ask your administrator to invite you with a role. See Single sign-on.
An action in Command fails with an error message	Your role does not allow it	Check the table above, and ask an Admin to change your role if you need it
"Only an admin can change the workspace language."	You are not an Admin in Command	Ask an Admin to change the Content language
"An SSO mapping may not assign the admin role."	A sign-in rule tries to grant administrator access	Remove the rule. Administrator access is set up separately.
ATLAS shows No access	You have no role in ATLAS	Ask an ATLAS administrator for access
BAIT says "Only administrators of this BAIT installation can do this.", or a button you expected is not shown	The action is for administrators only, so BAIT hides it from users	Ask a BAIT administrator
BAIT says "You do not have permission to do that. This action needs an administrator of this BAIT installation."	The action is for administrators only	Ask a BAIT administrator
MESH shows only Workspace	You are not a MESH administrator	Ask an administrator to connect sources or change the register for you

← PreviousSingle sign-on Next →People and departments