PolicyCortex User Management: RBAC, Provisioning & Compliance

rbac_configuration:
  roles:
    super_admin:
      description: "Full system administration access"
      permissions:
        - "*:*:*"
      restrictions:
        - requires_mfa: true
        - session_timeout: 4_hours
        - ip_restrictions: ["corporate_network"]

    compliance_manager:
      description: "Compliance program management"
      permissions:
        - "policies:*:*"
        - "compliance:read,write:*"
        - "reports:read,write:compliance"
        - "users:read:compliance_team"
      restrictions:
        - requires_mfa: true
        - data_classification_access: ["internal", "confidential"]

    security_analyst:
      description: "Security monitoring and analysis"
      permissions:
        - "security:read,write:monitoring"
        - "incidents:read,write:*"
        - "vulnerabilities:read,write:*"
        - "reports:read:security"
      restrictions:
        - session_timeout: 8_hours
        - data_access: ["security_logs", "incident_data"]

    policy_author:
      description: "Policy development and maintenance"
      permissions:
        - "policies:read,write:authored"
        - "templates:read,write:*"
        - "workflows:read,write:policy_development"
      restrictions:
        - approval_required: ["policy_publication"]

    auditor:
      description: "Read-only audit access"
      permissions:
        - "audit:read:*"
        - "compliance:read:*"
        - "reports:read:*"
        - "evidence:read:*"
      restrictions:
        - read_only: true
        - audit_trail: "comprehensive"

  permission_matrix:
    policies:
      actions: ["create", "read", "update", "delete", "approve", "publish"]
      resources: ["security_policy", "data_policy", "hr_policy"]

    compliance:
      actions: ["assess", "monitor", "report", "remediate"]
      resources: ["frameworks", "controls", "evidence", "assessments"]

    users:
      actions: ["create", "read", "update", "delete", "activate", "suspend"]
      resources: ["accounts", "roles", "permissions", "sessions"]

  delegation:
    enabled: true
    rules:
      - delegator_role: "compliance_manager"
        delegatable_permissions: ["policies:read,write:team_policies"]
        delegation_duration: "30_days"
        approval_required: false

  dynamic_access:
    context_aware_policies:
      - condition: "high_risk_activity"
        additional_requirements: ["supervisor_approval", "enhanced_mfa"]
      - condition: "sensitive_data_access"
        requirements: ["data_classification_clearance", "audit_logging"]
      - condition: "administrative_action"
        requirements: ["peer_approval", "change_request_ticket"]

{
  "user_provisioning": {
    "onboarding_workflow": {
      "trigger": "hr_system_new_employee",
      "steps": [
        {
          "step": "identity_creation",
          "action": "create_user_account",
          "data_source": "hr_employee_record",
          "validation": ["email_uniqueness", "employee_id_verification"]
        },
        {
          "step": "role_assignment",
          "action": "assign_initial_roles",
          "logic": "department_based_mapping",
          "approval_required": "department_manager"
        },
        {
          "step": "access_provisioning",
          "action": "provision_system_access",
          "systems": ["email", "intranet", "compliance_portal"],
          "delay": "manager_approval_received"
        },
        {
          "step": "security_setup",
          "action": "enforce_security_policies",
          "requirements": ["mfa_enrollment", "password_policy", "security_training"]
        }
      ]
    },
    "access_review_workflow": {
      "frequency": "quarterly",
      "scope": "all_active_users",
      "process": [
        {
          "step": "access_inventory",
          "action": "generate_user_access_report",
          "include": ["roles", "permissions", "last_activity"]
        },
        {
          "step": "manager_review",
          "action": "request_access_validation",
          "deadline": "14_days",
          "escalation": "department_head"
        },
        {
          "step": "remediation",
          "action": "process_access_changes",
          "options": ["maintain", "modify", "revoke"]
        }
      ]
    },
    "offboarding_workflow": {
      "trigger": "hr_system_employee_termination",
      "immediate_actions": [
        "disable_user_account",
        "revoke_active_sessions",
        "disable_mfa_tokens"
      ],
      "scheduled_actions": {
        "24_hours": [
          "complete_access_revocation",
          "backup_user_data",
          "notify_data_custodians"
        ],
        "30_days": [
          "archive_user_account",
          "delete_temporary_data",
          "generate_offboarding_report"
        ]
      }
    }
  }
}