# Access Control Matrix

## Application User Roles

<table><thead><tr><th width="263">Function</th><th width="106" align="center">Admin</th><th width="112" align="center">Project Coordinator</th><th width="124" align="center">Library Moderator</th><th width="146" align="center">Client / Consultant</th></tr></thead><tbody><tr><td><strong>Global Dashboard</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Analytics</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can filter analytics on their data</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Vulnerabilities</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can filter their vulnerabilities</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Portfolios</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module including CRUD operations</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>has view access to Portfolio(s)</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>has view access to Stream(s)</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><strong>Projects</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view projects they have access to</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can access all projects by default</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can perform all workflows on a project by default</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can create new projects</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can update projects</li></ul></td><td align="center">Yes</td><td align="center">Yes (for projects user has access to)</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can archive &#x26; unarchive projects</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can destroy projects</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can invite users to projects</li></ul></td><td align="center">Yes</td><td align="center">Yes (for projects user has access to)</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can manage user access to projects</li></ul></td><td align="center">Yes</td><td align="center">Yes (for projects user has access to)</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can request new projects &#x26; update own project requests</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can access all pending &#x26; actioned project requests</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can approve/reject/request info for all pending project requests</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><strong>Scheduling</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can see own projects</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can see all projects</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Assets (if enabled)</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can create new assets</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can see own assets</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can see uncatalogued assets</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can see all assets, including assets in libraries</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can update own assets</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can update all assets</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can delete own assets</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can delete all assets</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can view linked projects &#x26; groups on assets</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can view vulnerabilities on assets</li></ul></td><td align="center">Yes</td><td align="center">Yes only for vulnerabilities and assets user has access to</td><td align="center">Yes only for vulnerabilities and assets user has access to</td><td align="center">Yes only for vulnerabilities and assets user has access to</td></tr><tr><td><ul><li>can view/restore Archived assets</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Writeups</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can create/read/update/delete writeups in Main Library</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can create/read/update/delete writeups in Imported Library</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can create/read/update/delete writeups in Project Library</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can create/read/update/delete writeups in Custom Libraries</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration for each library</td><td align="center">Based on configuration for each library</td><td align="center">Based on configuration for each library</td></tr><tr><td><ul><li>can create/read/update/restore vulnerabilities in Archived Library</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Test Suites</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module, including CRUD operations</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Groups</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module, including CRUD operations</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can manage Group Membership</li></ul></td><td align="center">Yes</td><td align="center">Based on configuration per group</td><td align="center">Based on configuration per group</td><td align="center">Based on configuration per group</td></tr><tr><td><strong>Users</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module, including CRUD operations</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Flows</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has ability to create flows</li></ul></td><td align="center">Yes</td><td align="center">Based on user configuration</td><td align="center">Based on user configuration</td><td align="center">Based on user  configuration</td></tr><tr><td><ul><li>has ability to view flows</li></ul></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td></tr><tr><td><ul><li>has ability to edit flows</li></ul></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td></tr><tr><td><ul><li>has ability to run flows</li></ul></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td><td align="center">Limited - see <a href="https://support.attackforge.com/attackforge-enterprise/modules/flows">Flows</a></td></tr><tr><td><strong>Self-Service API</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can generate own API key</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can access SSAPI RESTful endpoints/methods</li></ul></td><td align="center">Yes (for APIs user has been given access to)</td><td align="center">Yes (for APIs user has been given access to)</td><td align="center">Yes (for APIs user has been given access to)</td><td align="center">Yes (for APIs user has been given access to)</td></tr><tr><td><ul><li>can access SSAPI Events</li></ul></td><td align="center">Yes (for APIs user has been given access to)</td><td align="center">Yes (for APIs user has been given access to)</td><td align="center">Yes (for APIs user has been given access to)</td><td align="center">Yes (for APIs user has been given access to)</td></tr><tr><td><strong>Reporting Templates</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Attack Chains</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Administration</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>has full access to this module, including CRUD operations</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr></tbody></table>

## Project Privileges

<table><thead><tr><th width="185">Function</th><th width="103" align="center">Admin</th><th width="104" align="center">Project Coordinator</th><th width="184" align="center">Edit</th><th width="86" align="center">Upload</th><th width="87" align="center">View</th></tr></thead><tbody><tr><td><strong>Project</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view project dashboard</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can invite users to project</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Based on configuration per project</td><td align="center">Based on configuration per project</td><td align="center">Based on configuration per project</td></tr><tr><td><ul><li>can view project team and project group members</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Based on configuration per project</td><td align="center">Based on configuration per project</td></tr><tr><td><ul><li>can edit project</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Based on configuration per project</td><td align="center">Based on configuration per project</td><td align="center">Based on configuration per project</td></tr><tr><td><ul><li>can place project on-hold / off-hold</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can add custom tags</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can delete / archive project</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can view project logs</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Scope / Assets</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view project scope/assets</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can create, update &#x26; delete scope/assets</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Testing</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view test cases and execution flows</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can update test cases, including actioning, adding notes &#x26; uploading evidence, adding workspace notes and files</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can assign assets/users to test cases on a project</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can lock/unlock/delete test cases on a project</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can send daily start / stop testing email notifications</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Retesting</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can mark vulnerabilities as ready for retest</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can request a retest</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can confirm retest is completed</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can view retesting history on project</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Vulnerabilities</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view all vulnerabilities (except for vulnerabilities in pending status)</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can view pending vulnerabilities</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can update &#x26; delete vulnerabilities</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can view remediation notes</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can add remediation notes</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can view, create &#x26; reply to review notes</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can view revision history</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can import vulnerabilities from tools &#x26; API</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can export vulnerabilities</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can update SLA</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can re-apply SLA</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can remove SLA</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can update remediation plan</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Attack Chains</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view attack chains</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can create, update, re-order, duplicate and delete attack chains</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Reporting</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can download reports</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can download project JSON export</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can download evidence in ZIP archive</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><ul><li>can view executive summary</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td><td align="center">Based on configuration</td></tr><tr><td><ul><li>can update executive summary</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Based on configuration</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can view, create &#x26; reply to executive  summary review notes</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><strong>Daily Tracking</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view schedule and tracking</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Collaboration</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can view project team member profiles</li></ul></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td><strong>Workspace</strong></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td><td align="center"></td></tr><tr><td><ul><li>can upload files to the project workspace</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td><ul><li>can create,  update &#x26; delete workspace notes &#x26; files</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can upload testing logs</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td><ul><li>can create project notes</li></ul></td><td align="center">Yes</td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes, however can only see own notes</td><td align="center">No</td></tr></tbody></table>