Docs

Appearance

User Management ​

Modulos uses role-based access control at two levels: organization and AI System. This keeps organization administration centralized while allowing AI System teams to execute governance work with clear separation of duties.

What this is ​

User management covers:

  • who can access the platform
  • what they can do at the organization level
  • what they can do inside each AI System

Most user management actions are managed by organization admins, but viewable by regular members.

Where in Modulos ​

  • Organization → Users to view members, invites, and organization roles
  • Organization → Users → Roles to view the standard AI System roles and the rights they grant
  • AI System → Settings → User Access to assign AI System roles for a specific AI System

Who can do what ​

Permissions

  • Organization Admins invite users, deactivate users, and manage organization roles.
  • Organization Members can typically view users and roles, but cannot change access.
  • Organization Risk Managers focus on maintaining the organization’s risk quantification structure. They typically do not manage user access unless they are also an organization admin.
  • Organization Policy Managers review and approve policy versions in Policy Center. They typically do not manage user access unless they are also an organization admin.
  • AI System Owners manage access to an AI System and day-to-day governance execution within it.

How it works ​

Organization roles ​

Organization roles apply across the organization:

  • Organization Admin: full administrative access to manage users and organization-wide configuration.
  • Organization Member: baseline access, typically with read access to organization-level configuration.
  • Organization Risk Manager: maintain the organization’s risk quantification library and budgets, and support teams running quantification in AI Systems.
  • Organization Policy Manager: review and approve policy versions in Policy Center. Policy Managers are notified when a version is submitted for approval and can approve, reject (with a reason), or publish versions.

Organization Admin is a high-trust role

Organization admins can view and edit the organization’s configuration and access model (users, settings, shared libraries). Treat this role as equivalent to “can administer the organization” and grant it sparingly.

Organization roles usually do not automatically grant access to every AI System. Organization admins are the exception and typically have organization-wide AI System access. For non-admins, AI System access is governed separately, and AI System Owners assign AI System roles per AI System.

AI System roles ​

AI System roles apply inside one AI System:

  • Owner: configure the AI System, assign AI System roles, and run workflows end-to-end.
  • Editor: implement Controls, attach Evidence, and update work items.
  • Viewer: read-only access focused on traceability and Evidence.

This separation supports audit readiness: Editors implement Controls, Requirement Owners review and fulfill Requirements, and Viewers observe with read-only access.

Role model today

Roles are currently hardcoded to a standard set. Modulos will expand this to more customizable RBAC over time.

How to use it ​

Account security ​

  • Two-factor authentication: each user can protect their account with an authenticator app under User Settings → Security. Setup shows a QR code (or a manual setup key), and a 6-digit code confirms activation. The same page shows whether two-factor is enabled and lets the user remove the authenticator app.
  • Locked accounts: when an account is locked, an organization admin opens the user in Organization → Users and clicks Unlock User.

Important considerations ​

  • Deactivating a user removes platform access and invalidates any API tokens they created.
  • Users cannot deactivate themselves; another admin must perform the action.
  • Organization admins typically have organization-wide AI System access. Use AI System roles to grant minimum access to non-admins and to keep separation of duties explicit.
  • If you don’t see Organization → Users, ask an organization admin to confirm access.
Organization Overview

How organization roles relate to AI Systems and shared libraries

Organization Settings

Currency and language defaults that affect governance and reporting

Reviews and Statuses

How status changes and Requirement reviews create audit-ready traceability

Operating Model

How risk governance work is split between organization and AI Systems