Role Based Access Controls (RBAC)

  Restore Visibility 

   Estimated Read Time: 5 minutes

---

Sections in this article:

• What Are Role Based Access Controls (RBAC)?
• Boolean Operators
  • And Operator
  • Or Operator
  • Set the Boolean Operator

---

What Are Role Based Access Controls (RBAC)?

Role Based Access Controls (RBAC) allow user access to be managed at the group level rather than individually, ensuring a structured and efficient approach to permissions.

In Gatekeeper, the primary object is the contract record, as all other objects link back to it. Using any combination of these objects, you can provide the correct level of access for your users.

When setting up RBAC groups, there are three key objects to consider:

• Entities – The legal entities that make up your organisation that are parties to contracts.
• Teams – Typically aligned with departments, e.g., Legal or InfoSec.
• Categories – Used to group contracts within your repository, describing the goods or services obtained under the contract.

Additionally, you can provide access to specific contracts and vendors for access groups. 

Benefits of RBAC:

• Ensures users have only the necessary access, enhancing security and control.
• Allows system administrators to efficiently manage user access at scale through access groups.

Example

John is part of the Legal Team and manages only Commercial Contracts. Using RBAC, you can create an access group where Team = Legal and Category = Commercial, ensuring John can view all relevant contracts and vendors.

Users can also be a part of many access groups, so using this example, you could grant further access for John by adding additional RBAC groups to John's permissions.

Boolean Operators

When setting up RBAC Groups, it's important to understand how the And vs. Or operator affects access:

And Operator

A record must meet all selected conditions for the user to access it.

In the Venn diagram, each circle represents a different core object provisioned in an RBAC group, such as entity, team, or category. The red-shaded intersection represents contracts that meet all conditions:

✅ The contract is linked to the entity
✅ AND linked to the team
✅ AND linked to the category

Only contracts that meet all conditions will be accessible. The AND operator is more restrictive, as fewer records meet all conditions.

For example, if a group is set to Team = Legal AND Category = Commercial, users can only access contracts that belong to the Legal team and are categorised as Commercial.

Expand the following section for a detailed breakdown of what users can do:

 

Or Operator

A record only needs to meet one of the selected conditions for the user to gain access to it. 

In this Venn diagram, the red area highlights the contracts that will be accessible based on any of these associations:

• All contracts linked to the entity
• OR all contracts linked to the team
• OR all contracts linked to the category

This makes the OR operator less restrictive than the AND operator, as adding more objects to an access group will provision more contracts by association.

For example, if a group is set to Team = Legal OR Category = Commercial, users in this group will have access to all contracts in the Commercial category, even if they aren’t linked to the Legal team.

Access groups may also provision core objects through secondary associations. These occur when a provisioned contract is linked to additional core objects not explicitly selected in the group. In such cases, users receive Collaborator access to these indirectly associated objects.

Expand the following section for a detailed breakdown of what users can do:

Set the Boolean Operator

To set the Boolean Operator:

1.  From the navigation menu, expand the Settings option, then click Configuration.
2. Click Role Based Access Control (RBAC) Configuration.
3. Select the appropriate radio button.
4. Click Save.

Additional Reading

• Create an Access Group - this article walks through the steps for creating an access group.