Review organization access and audit

What this is, and who it is for#

Two pages answer the questions an inspector or a quality manager asks about access.

• Access is the review: who holds what across the organization — organization roles, study memberships (in each workspace) and site memberships — whether each grant confers access today, and the exceptions open on it. Granting and ending access happens where the team is managed; this page reads it, and lets an administrator ask for a time-limited exception.
• Organization Audit Trail is the record of what was done: authentication, user management, role changes, access decisions.

Held by: Organization Admin (org.audit.read).

The Organization Admin is the only standard role that holds rbac.manage, user.manage and org.audit.read. A study's own trail is a different page (Review the audit trail).

Where to find it#

Administration → Access and Governance → Organization Audit. From the Organization Team, What they can access and the Studies count open Access narrowed to that person; from a role's panel, See all {n} in the access report opens it narrowed to the role.

What you can do#

Read who holds what#

The Access report tab shows tiles (People, Grants, Study & site grants, With an open exception) and a table with one row for each grant:

Filter by Type, Role, Study, Workspace, Status and With exceptions, or search by name or email. CSV downloads the whole report for the filters in force (13 columns, including Confers access today and Training complete); when there are more grants than one file takes, the file says it is partial and so does a toast.

1

Enlarge

1. Narrow the report by person, role, kind of grant or place.

Enlarge

Request an exception#

An access exception adds or removes one permission on one grant, without changing the role, with a reason and an expiry of at most 90 days. Use the row menu Request an exception… (Request an exception: Add or remove one permission for {person} as {role} … It has a reason and an expiry of at most 90 days.):

1. What the exception does: Remove a permission the role gives or Add a permission the role lacks.
2. Permission: only those the server can accept for this grant (allowed at its scope; to add, not already held, and investigator-only ones only on an investigator role; to remove, held by the role). Its risk rating is shown.
3. Applies until the end of: a date between tomorrow and 90 days (30 days by default). It stops applying then, with no further action.
4. Reason (required).

A standard permission takes effect as soon as it is requested, and the person is signed out so that it applies now. An elevated or critical permission waits for a second Organization Admin to approve (Requested — {person}'s access does not change until a second Organization Admin approves it).

The Exceptions tab lists those still open: Awaiting approval and Active, each with its reason, who asked, until when and who approved. Approve (not your own request, and not one about you), or end one with a reason: Reject (someone else's pending request), Withdraw (your own pending request) or Revoke (an active one). What an ended or expired exception was is in the organization audit trail.

Enlarge

Read the organization audit trail#

Security and administrative activity across the organization. Authentication events, role changes, user management, and access decisions in the workspace you are signed into. Tiles show Events, Today, Past hour and Auth events; the table has When, Who, Action, Record and Details (with the reason in quotation marks), and a search (Search who, action, record, or details…). Tabs narrow to All, Auth, Admin, Access or System. Open an event for its detail, including its place in the hash chain.

Verify chain integrity (Walk the audit hash chains and confirm no event has been inserted, removed or altered) walks the organization's own chain and those of its studies and their workspaces, and reports valid or the point at which a chain breaks. CSV downloads the events in view.

1

Enlarge

1. Walks the organization's audit chains and reports whether any event was inserted, removed or altered.

Enlarge

Enlarge

Every option#

What the exceptions can never do#

These guardrails have no override (ADR 0007):

• Nobody gives themselves an exception: another administrator must.
• The Organization Admin role takes none: removing permissions from the people who must always exist could lock an organization out.
• The permission must exist and be allowed at the grant's scope; an investigator-only one goes only to an investigator role.
• At most one open exception for the same permission and effect on a grant; an addition and a removal of the same permission cannot both be open.
• An addition may not put both sides of a separation-of-duties pair in one person's hands.
• An approver is neither the requester nor the person it is about.

Ending a membership or revoking a grant ends its exceptions. Nothing runs at expiry: an exception simply stops applying.

Limits of the audit view#

The page loads the most recent 5,000 events. If the trail is longer it says Showing the most recent {n} events … filter by category for a complete picture, and a CSV taken then is labelled as partial in the file itself, so a copy cannot pass for the whole trail. The tiles count what was loaded.

What the system records#

access.exception_requested, access.exception_approved and access.exception_ended (with the reason), plus the grants and role changes the report reads from (Audit events). Reading the report or the trail leaves no entry (the audit trail records changes and refusals, not reads), and a CSV of either is made in the browser.

What you cannot do, and why#

• Grant or end access from the Access page. It reviews; access is granted on the team pages, so that the person who can staff a study is the one who does.
• Give yourself an exception, or approve your own request.
• Edit or delete an audit event. The trail is append-only and chained.
• See another organization's grants or trail.

Compliance Q&A#

Related#

Invite and manage members · Manage organization roles · Review the audit trail · Audit events · Auditor