Roles

Overview

The Roles feature in the CoffeeBean platform allows you to define and manage reusable access profiles associated with integrated systems or applications.

A role represents a level of access to a specific system or resource. It may correspond either to a single permission or to a grouped set of permissions, depending on how the mapping is defined for the integrated application.

This model simplifies the implementation of access governance practices based on Role-Based Access Control (RBAC) and can also be combined with dynamic policies implemented through CoffeeBean Workflows.

You can also create new roles from this menu using the “+” button in the top-right corner. When creating a new role, you will need to provide configuration details and associate it with a previously created system or application.

Viewing and Managing Roles

In the Roles section, all access profiles configured in the platform are listed.

For each role, the following information is displayed:

• Associated system or application
• Access profile name
• Risk score
• Description
• Creation date

This view allows administrators to quickly identify existing access profiles and their relationship with managed systems. From here, it is also possible to edit role information such as name, description, and risk level.

New roles can also be created from this menu using the “+” button located in the top-right corner of the screen.

When creating a new role, you must provide basic configuration details and associate it with a system or application already registered in the platform.

Permission Mapping

In addition to representing access profiles or business roles, roles can also be used to represent specific system permissions.

In this model, each role may directly correspond to an individual permission or technical privilege within the integrated application, allowing the platform to accurately reflect the target system’s authorization structure.

These elements are configured using the same role creation process. Roles can be mapped directly to specific system permissions. Depending on the use case, these roles can be classified or identified using tags, attributes, or naming conventions, enabling their use in automated flows and policies defined in CoffeeBean Workflows.

This model allows the platform to support different levels of granularity in access management, including:

• Functional roles or business roles, which represent grouped permissions
• Individual technical permissions, which represent specific application privileges

This approach enables the solution to support different access control models used by integrated systems while maintaining consistency between the application’s permission structure and the platform’s governance model.

Role Assignment

Roles can be assigned to identities in different ways within the platform, providing flexibility in implementing access policies.

Direct Assignment to Users

A role can be assigned directly to a specific user, granting access to the associated system or application.

This type of assignment is commonly used in scenarios such as:

• Access granted by a manager or administrator
• Workflow-approved access requests
• Temporary or exceptional access

Assignment via Groups

Roles can also be assigned to user groups.

In this model, all users within the group automatically receive the access defined by the role.

This approach enables automated access provisioning based on:

• Organizational structures
• Business roles
• Departments
• Platform-defined automated policies

This model is widely used in RBAC architectures, where groups represent organizational functions and roles represent system access profiles.

Assignment via Policies and Workflows

In addition to direct or group-based assignments, roles can also be automatically assigned through policies and workflows defined in CoffeeBean Workflows.

These workflows may consider:

• User attributes
• Events from external systems
• Organizational changes
• Specific business rules

This model enables the implementation of hybrid architectures that combine RBAC, ABAC, and PBAC.

Role Risk Classification

The CoffeeBean platform allows you to assign a risk score to each configured role.

This value is defined during role configuration and ranges from 0 to 100, representing the criticality or sensitivity of the access granted by the role.

Roles that provide access to more sensitive or privileged functionalities may have higher risk scores, while roles with operational or lower-impact access may have lower scores.

This risk classification can be used as a reference in various governance processes, including:

• Access request reviews
• Access certification campaigns
• User risk analysis
• Detection of excessive privilege accumulation
• Automated workflow policies

For example, policies can be configured to:

• Require additional approval for high-risk roles
• Prioritize critical access reviews during certification campaigns
• Trigger alerts when users accumulate high-risk access

Integration with Access Governance

The use of roles enables more efficient access governance models, supporting:

• Standardization of access profiles
• Automated access provisioning
• Traceability of access grants
• Access auditing and certification

When combined with groups, workflows, and platform policies, roles become a central component in implementing identity and access governance models at scale.