Role-Based Access Control (RBAC)

Define a framework that governs actions within the platform based on organizational roles. Select default (buyer, manager, catalog admin) or set up custom user roles and assign permissions, such as rights to view, create, edit, cancel, approve, or delete. Users automatically inherit the permissions associated with their designated roles. Restrict permissions to resources, allowing granular control over access.

What the role-based access control feature delivers for your business: 

• Enhanced automated security: Users can only access and make changes to the elements of the system relevant to their job functions and responsibilities, minimizing the risks of errors, unauthorized access, or data breaches.

• Reduced management overhead: Centralized and efficient access management frameworks streamline updates and changes, simplifying and optimizing system administration.  

• Operational efficiency: Predefined permissions and access rights streamline the workflow, reduce confusion, errors, and unnecessary restrictions, ensuring users can work productively in a secure and well-structured work environment. 

Whether an account can sign in to the admin back office is a separate decision from what permissions that account has. An administrator sets the rule by account type or by specific permission, and any denial overrides an allowance.

It’s the answer to a question security reviewers ask often: can a partner integration or a customer’s own system call the API it needs without that account ever being able to open the admin panel. It can, and setting it up is a matter of configuration, not custom development.

Implementers can find the configuration details in Virto’s documentation.

RBAC offers a powerful framework for managing access and permissions throughout the platform, and supports complex B2B environments with clear, transparent, and automated systems. Discover more about robust control and administration features in Virto Commerce by visiting our user guide.