Creating users and setting permissions

1. Regulatory Concept & Core Standards

Today we will learn to assign permissions proportionate to reporting-channel roles. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. Examples use a generic platform and fictional data. Function names depend on the product. Suitability and compliance of a particular installation must be checked; the demonstration does not certify functions in a particular UNOVOX licence.

A permission must meet a work-related need. Reading, assigning, communicating, exporting, closing and administering are different actions. Least privilege means granting only the access required. Individual accounts identify who acted. Shared accounts weaken accountability and complicate revocation when someone changes roles.

Apply the following rule: Entities with an internal-route duty and external authorities report previous-year statistics to KPK by 1 March; this does not mean sending every identified case. The ZIntPK integrity plan has a different group of obliged entities. Current KPK guidelines apply from 1 January 2025, with reporting on implementation by 5 June. Portugal’s RGPC is not Slovenian law. Recommended organisational measures are not automatically universal legal duties.

2. Practical Implementation & Procedure

Define roles before creating users. Map each role to permitted actions and accessible cases. Enable suitable authentication where available, and test both a permitted and a prohibited action. Document approvals. Plan periodic reviews, temporary cover and revocation. Technical support should not retain permanent content access without a justified need. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A support role can export the entire case. An anonymised view or test example would suffice for the technical issue. The team limits rights and reviews previous exports. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Must support always see content to assist? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Establish the minimum necessary view, authorise it for a concrete task and check the access trail.

One mistake to avoid is: copying an administrator's permissions to resolve an access request quickly.

Now apply the national rule to a second decision. The team describes every prevention measure as mandatory in every organisation. How should the explanation change?

Separate the specific duty and its obliged entities from recommended practice. Integrity plans, conflicts and public procurement have their own scope. Portugal’s RGPC does not transfer automatically. For a recommended control, identify risk, owner and evidence of effectiveness.