Access rights must be granted to roles, not to individual users

Control Statement: Object, column and record access rights must be granted to roles, never directly to individual users.

Description: Creatio permits access rights to be granted either to a role or directly to a named user. This control requires that every grant target a role. Where an individual genuinely requires access nobody else has, the correct construction is a role with one member, not a grant to the user.

Rationale: A grant to an individual is invisible to every review that reasons about roles, which is how access is designed, documented and reasoned about in practice. It also survives the events that are supposed to revoke it: a user changes department, their role membership is updated to match, and the direct grant persists untouched because nothing in the role model refers to it. The result is access that outlives the job that justified it, held by someone nobody would name if asked who has it, and discoverable only by enumerating grants user by user.

Audit Procedure:

1. Enumerate configured object operation rights, column rights and default record rights.
2. For each entry, determine whether the grantee is a role or an individual user.
3. Record every entry whose grantee is an individual user.
4. For each, identify the access it confers and whether an equivalent role-based grant already exists.

Remediation:

1. For each individual grant, determine whether the access is still required.
2. Where it is not, remove the grant.
3. Where it is, identify or create the role that represents the function requiring the access, add the user to that role, and grant the right to the role.
4. Remove the individual grant once the role-based grant is in place and verified.

Default Value: Creatio permits grants to individual users and applies no warning or restriction when one is created. Neither the permission screens nor the role model distinguish an individually granted right from one inherited through a role when access is subsequently reviewed.