🎩Role-Based Access Control

Configure role-based access control to enforce least-privileged access for your P0 Security users. Assign roles and manage permissions across your organization.

P0 roles control what actions users can perform within the platform. You can assign roles to individual users or to identity-provider groups (such as Okta groups).

Global roles

Owners

Owners can add integrations and alter settings.

Security Reviewers

Security Reviewers can review access policies and user access (via P0 CLI), and you can optionally configure them as approvers for access requests in Access Policies.

Roles for Just-In-Time Access

Requestors

Every user that can log in to P0 is a Requestor. This is the default baseline role for your users.

Approvers

Approvers can approve access requests.

The Approver role is only in use in either of these cases:

1. There are no access policies in place

2. There are access policies in place and they explicitly reference the P0 Approver role

See Access Policies.

Roles for IAM assessment

Assessment Users

Assessment Users can run, manage, and view the results of environment scans.

Assessment Viewers

Assessment Viewers can view the results of environment scans.

Assigning roles

You can assign roles in P0 Management > Access control within the P0 app. Each role supports two assignment methods:

• Users: Assign the role directly to individual user email addresses.

• Groups: Assign the role to an identity-provider group (e.g., an Okta group). All members of that group inherit the role.

You can also assign roles as code with the P0 Terraform provider (version 0.50.0 or later). Each role has a resource for individual users and one for identity-provider groups:

Role	User resource	Group resource
Owner	p0_owner_user	p0_owner_group
Security Reviewer	p0_security_reviewer_user	p0_security_reviewer_group
Assessment User	p0_assessment_user	p0_assessment_group
Assessment Viewer	p0_assessment_viewer_user	p0_assessment_viewer_group

Assigning roles to groups

If your organization signs in through Okta (or another OIDC provider that emits a groups claim), you can map identity-provider groups to P0 roles. When you assign a group to a role, all members of that group automatically receive the role in P0.

Group mapping requires you to configure a groups claim in your identity provider and then enter the group names in Admin > Access control. For the full setup and troubleshooting steps, see Group-based access control.