Managing User Access & Role-Based Permissions (RBAC)

Audience: System Administrators, Compliance Officers, Operations Leads

Topic: Governance & Security

Overview

For lending institutions, controlling access to borrower data is not just an operational preference; it is a regulatory requirement. PayPlan utilizes a Role-Based Access Control (RBAC) framework to ensure that users only have access to the specific data and tools required for their job function.

This guide outlines how Workspace Admins can assess, allocate, and audit user roles to maintain a secure and compliant lending environment.

1. The Strategic Value of RBAC

RBAC aligns system access with your internal organizational structure. By enforcing strict permission sets, you achieve three critical governance goals:

• Data Privacy & PII Protection: Prevents unauthorized viewing of sensitive borrower data, such as Social Security Numbers (SSNs) or full bank account details.

• Segregation of Duties: Reduces fraud risk by ensuring that the staff member who originates a loan is not necessarily the same user authorized to fund or service it.

• Audit Readiness: Creates a clean audit trail. Every action in the system is logged to a specific user, ensuring accountability for all underwriting decisions and financial transactions.

2. PayPlan Standard Roles

In the PayPlan architecture, a "Role" is a collection of specific backend permission flags. While roles can be customized via a support request, the platform comes with four standard definitions:

1. PayPlan Admin

• Scope: Full Tenant Control.

• Capabilities: User management, product configuration, document template editing, and full visibility into all borrower records and audit logs.

• Best For: System Administrators and Chief Lending Officers.

2. Underwriter

• Scope: Decisioning & Risk.

• Capabilities: Access to credit reports, manual underwriting decision tools, and offer generation.

• Restrictions: Typically restricted from altering system-wide settings or deleting records.

• Best For: Credit Analysts and Risk Managers.

3. Servicing Agent

• Scope: Account Management.

• Capabilities: View repayment schedules, process manual payments, apply fees, and log borrower notes.

• Restrictions: Cannot alter underwriting criteria or loan product configurations.

• Best For: Customer Support and Collections staff.

4. PayPlan Merchant

• Scope: Origination Only.

• Capabilities: Submit new applications and view status updates for their specific location.

• Restrictions: No visibility into detailed credit reports or cross-location data.

• Best For: Third-party partners or retail store associates.

3. Operational Workflows: Assigning Roles

Step 1: Audit Current Access

Before adding new users, review your current hierarchy.

1. Navigate to Admin Portal > User Management.

2. Use filters to view users by Role.

3. Optional: Export the user list to cross-reference with your internal HR records.

Step 2: Modify or Assign a Role

Only users with PayPlan_Admin privileges can execute this workflow.

1. Navigate to Admin Portal > Users.

2. Select the specific user profile to open their details.

3. Click Edit.

4. Select the appropriate Role from the dropdown menu.

5. Click Save.

Note: If a user is currently logged in, they may need to log out and refresh their session for the new permissions to take effect.

4. Governance Best Practices

To maintain a secure environment, we recommend adhering to the following protocols:

• Principle of Least Privilege: Always assign the minimum level of access necessary for a user to perform their daily tasks. If a user only needs to view application status, they do not need Underwriter privileges.

• Masking Sensitive Data: PayPlan supports PII masking. Ensure that roles like "Servicing Agent" or "Merchant" do not have the VIEW_FULL_PAYMENT_METHOD or DOWNLOAD_CREDIT_REPORT permission flags enabled unless absolutely necessary.

• Quarterly Access Reviews: Conduct regular audits of your user list. Revoke access immediately for terminated employees or partners who are no longer active.

5. Troubleshooting Access Issues

If a user reports they cannot perform a specific function, reference the table below before escalating.

When to Contact Support

While Admins can assign standard roles, deeper customization requires backend configuration. Contact PayPlan Support for:

• Custom Role Creation: If you need a hybrid role (e.g., "Senior Underwriter" with specific override authorities).

• Permission Flag Audits: To request a detailed report of exactly which backend flags are attached to your current roles.