Team, Roles & Auditor Access
Role-based access that gives your team, your contractors and your external auditor exactly the right view, no more, no less.
Aegis is run by a team, and access to a compliance program is itself something auditors care about. Role-based access control (RBAC) is built in, so everyone sees what they should and nothing they should not.
People and the organization
The Organisation area is where you manage the humans in your program, employees and contractors, and the work assigned to them. From here you add people, assign them roles, and track the tasks and attestations they owe. Alongside people sit the device, software and Shadow AI views, because governing an organization means governing its people and their endpoints together. Security training is managed here too, under Organisation › Training.
Built-in roles
| Role | What they can do |
|---|---|
| Owner | Full control of the organization and its program; typically the CISO or founder |
| Admin | Full program administration, including assigning security training |
| Auditor | Read-only access to controls, evidence and policies, for external assessors |
| Employee | Sees and completes the tasks, policies and training assigned to them |
| Contractor | A scoped role for non-employees |
The newer program areas follow the same split. Owners and admins can work on the
security assessment, plan the roadmap and use the
Document Vault; auditors can read all three; employees and contractors don't see
them. Custom roles get these areas only when an admin grants the assessment, roadmap or vault
permission.
Users can hold more than one role, and every customer-facing action is checked against a granular
resource:action permission model behind the scenes, so access is enforced consistently across the
product, not just hidden in the UI.
The employee portal
Employees and contractors do their part in the employee portal, a separate, simpler site from the admin app. They sign in with a one-time code sent to their work email, or with Google, Microsoft or a password where your organization has set those up.
The portal home shows their progress, "{n} of {total} tasks done", and the tasks that make it up:
- Security Policies, to read and accept the policies that apply to them.
- Install the device agent, which also shows how many device checks are failing.
- Security training, a card for each course assigned to them, when training is enabled.
When everything is done, the portal says so. Their completions flow straight back into your program as evidence.
Custom roles
Beyond the built-in set, you can define custom roles with their own combination of permissions, for the reviewer who should see risks but not billing, or the contractor who needs one module and nothing else. This lets access mirror how your team actually divides the work.
The auditor view
When it is time for an assessment, you do not export a pile of files and hope. You invite your auditor to a dedicated, read-only auditor view that exposes your controls, their mapped evidence, and your policies. The auditor walks the program as it really is; you keep an unbroken record of exactly what they could see.
The auditor role is read-only by design. An external assessor can review everything they need to form an opinion, and can change nothing, which is exactly the separation an audit expects.
Why it matters to a CISO
- Least privilege is the default. People get the narrowest role that lets them do their job.
- Access is itself evidence. A clean role model, with a read-only auditor path, is precisely what access-control and audit requirements ask for.
- Onboarding and offboarding are program events. Adding and removing people is done where the program lives, so joiner/leaver activity is captured, not scattered across tools.
Next steps
Security Training
Assign courses and get graded evidence of who passed.
Endpoint & Shadow AI
Govern the devices your people use.
Policies
Assign, approve and attest policies by role.
Security & Data Handling
How Aegis secures the account itself.
Capabilities
The full feature reference.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com