Roles & permissions

Invariant uses role-based access with organization scoping. Key constraints:

Org scoping: every user is bound to one organization; data is isolated per org.
Roles: Administrator, QA Manager, and standard user roles determine what each person can view and do.
Controlled sign-offs (approve, close, effectiveness verification, reopen) are restricted to QA Manager / authorized approvers.
Maker-checker: an independent approver is required — authors cannot approve their own records.
Server-side enforcement: all access rules are enforced on the server, not just hidden in the UI.

Role boundaries for the updated workflows

Workflow	Role and availability boundary
CSV validation and imports	Administrator; onboarding imports enabled. User imports need their additional feature.
Filter the training matrix	Administrator, QA manager, or reviewer; employee-group training enabled.
Create or retire curriculum versions	Administrator or QA manager; employee-group training enabled.
List or download operational reports	Administrator or QA manager, with applicable reporting availability.
Maintain document categories	Administrator; document categories enabled.
Open an audit-linked record	The destination retains its organization, role, and feature checks.

Operators do not gain management access from this release. A feature being present in documentation or released software does not mean it is enabled for every organization or user.

Get Started

Changelog

Tutorials

How-to Guides

Page Reference

Administrators

Explanation

Compliance & Validation

Role boundaries for the updated workflows

​Role boundaries for the updated workflows

Role boundaries for the updated workflows