Skip to main content
S
StudAI BOS

Governance

Roles & Permissions

BOS decides who can do what using two complementary systems: roles (RBAC) and attributes (ABAC). Together they give you precise, scalable control.

RBAC: permissions by role

Role-Based Access Control grants permissions based on a person's role. Everyone with the same role has the same baseline access. BOS ships with sensible base roles:

  • Admin — full control, including settings, users, and billing.
  • Manager — can approve and manage within their area.
  • Member — can do day-to-day work but not approve sensitive actions.

Larger organizations can use more granular roles to match their structure. You assign roles in Users & Roles.

ABAC: permissions by condition

Attribute-Based Access Control adds rules based on the details of the action — not just who you are. For example:

  • Expenses over ₹50,000 require an extra approval.
  • Only the deal owner can apply a discount above a threshold.
  • Access to certain records is limited to a specific department.

ABAC lets you express “it depends” rules that a simple role list can't capture.

How they work together

RBAC sets the baseline (“Managers can approve expenses”), and ABAC refines it (“…but expenses over ₹1,00,000 need two approvers”). Both are checked on every action by the workflow engine.

Where checks happen

Permissions are enforced at the single write path — the workflow engine. This means there's no way to bypass them through a particular screen or shortcut, and the same rules apply to actions taken by the Orin assistant.

Related governance