Creating users and setting permissions

1. Regulatory Concept & Core Standards

Today we will learn to assign permissions proportionate to reporting-channel roles. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. The demonstrations in this course use a generic platform and fictional data. Field names depend on the chosen product. The aim is to understand which settings to look for and how to verify the result, keeping technical administration rights separate from access to case content.

A permission must meet a work-related need. Reading, assigning, communicating, exporting, closing and administering are different actions. Least privilege means granting only the access required. Individual accounts identify who acted. Shared accounts weaken accountability and complicate revocation when someone changes roles.

Apply the following rule: Sapin II distinguishes the reporting procedure from the anti-corruption measures under article 17. For the companies described in article 17(I), the general criteria combine at least 500 employees and turnover exceeding EUR 100 million, with group rules. Since 15 June 2025, article 17(I)(3) also covers the managers of legal entities operating the port installations specified in Transport Code article L.5332-16(2). Check this specific category instead of treating the employee and turnover thresholds as universal. The obligations include the measures listed in article 17(II).

2. Practical Implementation & Procedure

Define roles before creating users. Map each role to permitted actions and accessible cases. Enable suitable authentication where available, and test both a permitted and a prohibited action. Document approvals. Plan periodic reviews, temporary cover and revocation. Technical support should not retain permanent content access without a justified need. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

In the demonstration, a support user can export every attachment although their role should only involve credentials. The team removes content permission and checks that the technical function still works. A negative test confirms that inappropriate access is now blocked. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Why should you test an action that the user is not authorised to perform? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Because verification must confirm both necessary access and the blocking of inappropriate access. A role that enables someone to work may still grant excessive powers that are not apparent in ordinary use.

One mistake to avoid is: copying an administrator's permissions to resolve an access request quickly.

Now apply the national rule to a second decision. The team presents every integrity instrument as mandatory in every country. How should the message be revised?

Distinguish what national law actually requires, the conditions for its application to the entity and the proposed good practices. The specific rule just examined must appear in the corresponding procedure. Each duty needs a source; each management choice needs a purpose, an owner and evidence of implementation.