Creating users and setting permissions

1. Regulatory Concept & Core Standards

Today we will learn to assign permissions proportionate to reporting-channel roles. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. The demonstrations in this course use a generic platform and fictional data. Field names depend on the chosen product. The aim is to understand which settings to look for and how to verify the result, keeping technical administration rights separate from access to case content. The law of 16 May 2023 governs the reporting channel. Proposed risk plans, codes, calendars and control tools are organisational good practice unless a separate applicable rule creates a duty. Public-service or public-procurement requirements must not be generalised to every private business.

A permission must meet a work-related need. Reading, assigning, communicating, exporting, closing and administering are different actions. Least privilege means granting only the access required. Individual accounts identify who acted. Shared accounts weaken accountability and complicate revocation when someone changes roles.

Apply the following rule: Internal and external forms on MyGuichet can have different recipients and purposes. Article 7 allows written or oral reports, or both, in one of the three administrative languages or another accepted language. The whistleblowing law does not make the Portuguese RGPC Luxembourg law. Risk plans, codes, training calendars and control matrices in these courses are good practice unless a separate national or sector duty applies.

2. Practical Implementation & Procedure

Define roles before creating users. Map each role to permitted actions and accessible cases. Enable suitable authentication where available, and test both a permitted and a prohibited action. Document approvals. Plan periodic reviews, temporary cover and revocation. Technical support should not retain permanent content access without a justified need. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

In the demonstration, a support user can export every attachment although their role should only involve credentials. The team removes content permission and checks that the technical function still works. A negative test confirms that inappropriate access is now blocked. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Why should you test an action that the user is not authorised to perform? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Because verification must confirm both necessary access and the blocking of inappropriate access. A role that enables someone to work may still grant excessive powers that are not apparent in ordinary use.

One mistake to avoid is: copying an administrator's permissions to resolve an access request quickly.

Now apply the national rule to a second decision. The team presents every integrity instrument as mandatory in every country. How should the message be revised?

Distinguish what national law actually requires, the conditions for its application to the entity and the proposed good practices. The specific rule just examined must appear in the corresponding procedure. Each duty needs a source; each management choice needs a purpose, an owner and evidence of implementation.