Delete rights on custom objects must not be granted to a company-wide role

Control Statement: Delete rights on a custom object must not be granted to a role that reaches the entire organisation.

Description: An organisation role sitting at the root of the organisational structure — one with no parent — is inherited by every user beneath it, which in practice is everyone. Granting the delete operation on a custom object to such a role gives every licensed user the ability to permanently remove any record of that object. Delete rights must instead be granted to the specific roles whose function requires removing records.

Rationale: Delete is the one operation whose consequences cannot be reviewed after the fact. A wrongly granted read right exposes data that is still there; a wrongly granted delete right destroys it, and in Creatio a deleted record is gone for every user at once. Company-wide delete is very rarely a deliberate design decision — it is normally the residue of a permission set copied from another object or granted broadly during implementation to unblock testing, then never narrowed.

Audit Procedure:

1. Identify the organisation roles at the root of the organisational structure — those with no parent role. These are the roles that reach every user.
2. Open System Designer → Users and administration → Object permissions.
3. For each custom object, review the operation permissions and record every grant of the delete operation to a role identified in step 1.
4. For each such grant, determine whether company-wide delete is a deliberate, recorded decision.
5. Record the object as non-compliant where the grant exists without an approved exception.

Remediation:

1. Identify the roles whose function genuinely requires deleting records of the object.
2. Grant the delete operation to those roles explicitly.
3. Remove the delete grant from the company-wide role.
4. Where company-wide delete is genuinely intended, record it as an approved exception in the system of record required by CSB-FDNS-001.

Default Value: Creatio does not grant delete rights to any role by default; object operation permissions are empty until an administrator configures them. Company-wide delete is therefore always the result of an explicit grant, whether or not its breadth was understood at the time.