Yes, custom roles can be created or existing ones changed when a BaaS dashboard provides those controls. Roles group individual permissions into reusable access profiles, and the available options vary by dashboard. This guide to managing user roles and permissions in a BaaS dashboard explains how to approach access settings.
Access controls should be clear and practical: people need the permissions to do their jobs, without unnecessary access. A well-defined role structure makes those boundaries easier to manage and explain.
You’ll learn how roles group permissions, what different access levels allow, and how to document and communicate access policies. This guide is written by Alexander Legoshin.
Key Takeaways
Group dashboard permissions into roles that reflect responsibilities, then tailor access to each person’s work.- Use clear role documentation and communication so users understand what access they have and why.
- Distinguish permissions to manage your own dashboards from permissions that affect dashboards created by others.
- Consider how automation can support role assignment and help surface unusual access activity.
Table of Contents
- What are user permissions and roles in Dashboards?
- Documenting and communicating access policies
- Dashboard creation, editing, and deletion permissions
- How roles group user permissions
- Gemba
What are user permissions and roles in Dashboards?
A permission grants the ability to perform an action; a role groups permissions for users with similar responsibilities. In a BaaS dashboard, build roles around actual work and give each person only the access their duties require.
Automated Role Assignment and Monitoring
Automated role assignment applies predefined access rules, while monitoring can flag unusual activity. An identity and access management system might assign roles based on a person’s job title or department. Monitoring tools can alert administrators to unexpected access patterns.
For onboarding, match the person’s responsibilities to a role before granting access. When someone leaves or changes responsibilities, promptly revoke or adjust their permissions. Before applying changes to live users, test each role with a dedicated account and verify both permitted and blocked actions.
Role Management Options and Limits
Role Management is where administrators configure role permissions, if the dashboard provides that option. Review every permission before changing a role, then check which users will inherit the change. BaaS platforms have no universal role limit or standard access-control charge; limits and pricing depend on the platform and plan.
A Conversations Manager role, where available, should grant only the actions needed to manage conversations. Treat workspace opt-in as a separate access decision, not proof that a user has broader permissions. To revoke access, remove the person’s role or disable their account through the dashboard’s administrative controls, then review any separately managed connected access.
Industry-Specific Role Assignment Examples
Industry-specific role assignment matches access to each team’s work and the sensitivity of its information. In healthcare, a clinical user and an operations manager may need different dashboard views. The U.S. Department of Health and Human Services identifies HIPAA as relevant to protecting patient health information.
In a finance team, a payment preparer might be allowed to prepare work, while an authorized reviewer handles approval. In customer support, a Conversations Manager role could be limited to conversation tasks, with workspace opt-in handled separately. These examples show how responsibilities shape roles; they don’t mean every dashboard uses the same labels or controls.
Role Hierarchies and Inherited Permissions
A role hierarchy organizes roles so a higher-level role can pass permissions to roles beneath it. For example, a dashboard administrator might inherit an analyst role’s permissions and have additional administrative access.
Inheritance reduces repeated configuration, but it can also grant more access than intended. Before using a hierarchy, trace each inherited permission from parent to child and remove anything that doesn’t fit the lower role’s duties. A permissions matrix listing each role, its allowed actions, and the reason for each assignment makes access easier to review.
Documenting and communicating access policies
An access policy records who can use each system, which actions they may take, and why. Clear documentation helps your organization explain decisions, communicate boundaries, and identify risks from misconfigured BaaS roles, such as unauthorized access to sensitive data or actions outside a user’s responsibilities.
Access Policy Records
Access policy records define roles, their permissions, and the reason for each assignment. For every role, document its purpose, allowed actions, relevant applications or data, and the organizational owner responsible for reviewing it.
Then explain the policy in direct language users can apply to their work. For example, clarify which tasks a support role permits and which require escalation. Regular training can reinforce the rules; documentation helps only when employees can understand and follow it.
Organizational Access Hierarchy
An organizational access hierarchy connects permissions to reporting lines and decision-making responsibilities. A team lead may need access to team-level records, while an individual contributor needs only the information required for their tasks.
Document each leadership role separately rather than assuming seniority justifies unrestricted access. Record who approves role changes, who owns each permission group, and how delegated responsibilities affect access. This makes authority visible without treating every manager as a system administrator.
Least-Privilege Compliance
Least-privilege access gives users only the permissions needed for their assigned duties. This limits exposure if an account is misused and reduces the chance of accidental changes to sensitive records.
The European Union identifies GDPR as a regulatory requirement for which role-based access control can support audit-ready compliance. For financial institutions, SOX and PCI DSS are also identified as relevant to protecting customer data and financial transactions. These frameworks do not make a role configuration compliant by itself; record the access rationale and review permissions against actual duties.
Dashboard Access and Data Segregation
Unified Dashboard application access determines which applications someone can open through a shared dashboard. Scoped access narrows that reach to specific data, teams, or functions instead of granting broad visibility across the organization.
For example, separate customer-support and finance workspaces, then assign access according to each team’s responsibilities. Document what each scope includes and how users request changes. For customer-verification workflows, KYC and AML compliance management is a relevant consideration when defining who can access compliance-related processes.
Dashboard creation, editing, and deletion permissions
Dashboard permissions determine who can create, change, or remove dashboards. Scope matters: access limited to a person’s own dashboards differs from access that affects dashboards created by colleagues.
Create, Edit, Delete Your Own Dashboards
The Create, Edit, Delete your own dashboards permission lets users customize dashboards they created. A team member with this access can build a personal view and adjust its layout without gaining the broader ability to change everyone’s dashboards.
Assign this permission when someone needs to manage their own reporting workspace. For example, an analyst could create a project dashboard and update it as the work changes. Before granting access, distinguish dashboard ownership from access to the underlying data: editing a view and accessing its data are separate permissions.
Edit Dashboard
The Edit Dashboard permission lets users edit dashboards created by anyone. This broader scope can suit an administrator or reporting lead responsible for maintaining shared team dashboards.
Consider the practical effect: a user may be able to update a colleague’s dashboard, not just their own. Grant this permission to people responsible for maintaining shared views. If someone needs to edit only dashboards they created, the own-dashboard permission is more narrowly scoped.
Delete Dashboard
The Delete Dashboard permission lets users delete dashboards created by anyone. Since it extends beyond personal work, it has a wider impact than editing one’s own dashboard.
Reserve this permission for roles that genuinely need to remove shared dashboards. A dashboard administrator, for example, may need to retire an obsolete team view, while an analyst may only need to create and refine personal dashboards. If the settings allow it, assign deletion separately from editing.
Reviewing Dashboard Access
A dashboard permission review compares each role with the actions its users need to perform. Check the own-dashboard option against Edit Dashboard and Delete Dashboard, then grant only the permissions required.
When responsibilities change, update the user’s role and verify the resulting dashboard access. A test account can confirm whether someone can edit personal dashboards, edit shared dashboards, or delete dashboards created by others. This makes the access boundary clear before applying the same permissions across a team.
How roles group user permissions
A permission authorizes one action, while a role combines permissions for a defined responsibility. In a BaaS dashboard, grouping related actions lets administrators assign access by function instead of configuring each person separately.
A role-permission matrix is a reference table linking each role to its allowed actions. For example, an operations role might view payment dashboards and download reports, while a reviewer can also access approval functions. The matrix makes differences visible before roles are assigned and helps administrators explain the reason for each permission.
Role-based access control, or RBAC, assigns permissions through roles rather than directly to individuals. The ANSI/INCITS RBAC standard is identified as ANSI/INCITS 359-2004 and was later revised as INCITS 359-2012. The practical principle is consistent: define roles around responsibilities, then give each user the role matching their work.
Granularity determines how far permissions reach. A dashboard might let a user view a report without changing it; a more granular system can define access at the database, table, or column level. For instance, a Print/Download Dashboard permission allows users to print or download dashboards as reports. Keep that action separate from editing when responsibilities differ.
To configure roles, list work functions first, map each function to the required actions, then assign the narrowest matching role. Give every person a unique account so actions can be tracked and audited. Avoid shared logins, which make it harder to identify who performed a change.
Roles need maintenance as responsibilities shift. Review access regularly, adjust permissions when duties change, and revoke access when someone leaves. Compare each role with its current tasks: if a permission no longer supports a defined responsibility, remove it. That is the central discipline of a guide to managing user roles and permissions in a BaaS dashboard: group access coherently and keep every permission tied to a real function.
Gemba
Gemba helps non-banks launch branded financial services through banking infrastructure. Its offerings include fast time to market embedded banking, a White-label Banking Interface, ultra fast bulk payments, global payroll, global account to card payouts, Banking API Integration, multi-currency IBAN Accounts, and SEPA & SWIFT Payment Infrastructure.
If your access-policy decisions are part of a broader plan to introduce branded financial services, consider how roles and permissions fit your operating model. Clear responsibility boundaries help teams plan who needs access to which functions as services take shape.
Alexander Legoshin wrote this article. Contact Gemba to discuss your business needs.
Make access part of your operating model
A guide to managing user roles and permissions in a BaaS dashboard is most useful when it informs decisions beyond the dashboard. As your financial services evolve, make access design part of operational planning: consider which responsibilities will change, where teams need clear boundaries, and how to keep policies aligned with actual work.
That discipline helps your organization make deliberate choices as it develops branded financial services. Gemba supports businesses embedding banking into their operations, with fast time to market embedded banking, a White-label Banking Interface, and ultra fast bulk payments. The next step is to connect your access needs with the wider service model you’re shaping.
Bring your priorities and questions into a conversation with Gemba. Discuss your embedded banking plans, and move forward with a clearer view of the roles, responsibilities, and operating model your business needs.
Frequently Asked Questions
Can I create custom roles or modify the existing ones?
That depends on the dashboard’s role-management controls. If custom roles are supported, an administrator can create one for a specific function, such as viewing reports without editing them. If roles are fixed, access may be adjustable only through the available settings. Before changing an existing role, consider everyone assigned to it, since the change may affect the whole group.
Do users have the same role in all workspaces?
Not necessarily; role scope depends on how the platform handles workspaces. A person might have one role in a finance workspace and another in a support workspace, or a single organization-wide role. For example, a teammate could view payment information in one workspace while managing customer conversations in another. Review each workspace’s membership and access settings separately rather than assuming permissions carry across.
What does RBAC stand for?
RBAC stands for role-based access control. It is an access model in which permissions are associated with roles, and users receive permissions through their assigned role. For example, a reporting role might allow dashboard viewing, while an administrator role includes configuration access. RBAC organizes access around job functions, but role names and available controls vary by system.
What happens if someone tries to access a feature they don’t have permission for?
The system should prevent the action, but the exact response depends on the dashboard. A restricted control might be hidden, disabled, or trigger an access-denied message when selected. For example, a user without dashboard-editing permission may still view a shared dashboard but be unable to save changes. Test important restrictions with a limited-access account so users know what to expect.
What are user roles and permissions in a BaaS dashboard?
Permissions define the actions a user can take, while roles group related permissions into an access profile. In a BaaS dashboard, a reporting role might allow access to transaction summaries, while another role can manage account settings. The distinction matters: assigning a role grants its associated actions, so its scope should match the person’s actual responsibilities.
How do I create, edit, and delete user roles in a BaaS dashboard?
Use the dashboard’s role-management settings when they provide the required controls. To create a role, define its purpose and select the necessary permissions; to edit one, review who uses it before changing access. Before removing a role, reassign affected users to an appropriate alternative. Some dashboards restrict role creation or deletion, so available actions depend on platform design and administrator access.
Frequently Asked Questions
Can I create custom roles or modify the existing ones?
That depends on the dashboard’s role-management controls. If custom roles are supported, an administrator can create one for a specific function, such as viewing reports without editing them. If roles are fixed, access may be adjustable only through the available settings. Before changing an existing role, consider everyone assigned to it, since the change may affect the whole group.
Do users have the same role in all workspaces?
Not necessarily; role scope depends on how the platform handles workspaces. A person might have one role in a finance workspace and another in a support workspace, or a single organization-wide role. For example, a teammate could view payment information in one workspace while managing customer conversations in another. Review each workspace’s membership and access settings separately rather than assuming permissions carry across.
What does RBAC stand for?
RBAC stands for role-based access control. It is an access model in which permissions are associated with roles, and users receive permissions through their assigned role. For example, a reporting role might allow dashboard viewing, while an administrator role includes configuration access. RBAC organizes access around job functions, but role names and available controls vary by system.
What happens if someone tries to access a feature they don’t have permission for?
The system should prevent the action, but the exact response depends on the dashboard. A restricted control might be hidden, disabled, or trigger an access-denied message when selected. For example, a user without dashboard-editing permission may still view a shared dashboard but be unable to save changes. Test important restrictions with a limited-access account so users know what to expect.
What are user roles and permissions in a BaaS dashboard?
Permissions define the actions a user can take, while roles group related permissions into an access profile. In a BaaS dashboard, a reporting role might allow access to transaction summaries, while another role can manage account settings. The distinction matters: assigning a role grants its associated actions, so its scope should match the person’s actual responsibilities.
How do I create, edit, and delete user roles in a BaaS dashboard?
Use the dashboard’s role-management settings when they provide the required controls. To create a role, define its purpose and select the necessary permissions; to edit one, review who uses it before changing access. Before removing a role, reassign affected users to an appropriate alternative. Some dashboards restrict role creation or deletion, so available actions depend on platform design and administrator access.
