User groups, roles, and segregation of duties

Case Flow access is controlled through permissions that are resolved from user-group membership supplied by the identity and access-management environment. Case Flow consumes that group membership and applies the mapped permissions to separate responsibilities such as investigation, workflow management, page management, reporting, filing-regulator administration, and skill management.

Access configuration determines who can see information, perform case actions, and change the operating model. It is the control layer that separates routine case handling from configuration, reporting, approval, and administration responsibilities.

• Use identity and access management to establish user-group membership.
• Map the required permissions and roles to each group so they govern the actions and configuration surfaces users can access.
• Use dedicated roles for workflow, page, view, workboard, reporting, filing-regulator, data, and skill responsibilities.

Steps to enable and configure

• Define user groups in the identity and access-management environment to reflect the operating model and segregation-of-duties requirements.
• Map the required roles and permissions to each group.
• Provision representative users for each persona.

Tips and considerations

• Use least privilege as the default and document exception access.
• Separate configuration, operational case handling, and approval responsibilities where required.
• Review group membership and access whenever workflows, workboards, or reporting responsibilities change.