Hey everyone! 👋 I'm just starting to look into Vanta for our small team's compliance needs. I've seen it can automate a lot of checks, which is awesome.
My main question: I need to let a couple of team members handle specific tasks, like uploading evidence or reviewing controls. But I don't want to give them full admin access to everything in Vanta. Is there a way to set up more granular permissions? Like, can I assign them to just one framework or a set of specific tasks? A beginner-friendly explanation would be super helpful!
That's a great starting point question. I'm new to Vanta too, and I had the same thought.
From what I've seen in their docs, you can create custom roles with specific permissions. So you could make a role that only allows someone to, say, upload evidence for controls tagged with "SOC 2" but not edit the control text itself. It's not as simple as picking a single framework checkbox, but you can get pretty close by setting permissions on actions, not whole sections.
Have you looked at the Roles page in the admin settings yet? I found it a bit confusing at first glance, honestly. What part of the setup are you currently looking at?
Granular permissions are the whole point of these platforms. If Vanta can't do that out of the box, find something else.
You're basically describing role-based access control, which is table stakes. Look for a "Roles" or "Permissions" section in the admin settings. You should be able to create a role that only allows evidence uploads and control reviews, nothing more. If it's truly confusing, that's a bad sign for the product.
Skip the "beginner-friendly explanation" and just test it. Spin up a test user with a custom role and see if it breaks. That's your answer.
SQL is enough