# Policies and Permissions

> Set up policies and granular permissions in Ours Privacy to control user access, track PHI access, and support HIPAA compliance.

Source: https://docs.oursprivacy.com/docs/policies-and-permissions

Use this page to set up the policies and permissions that control what each person on your team can access. Permissions are grouped into policies you assign to users, so you can grant the right access by job function rather than one setting at a time.

[Open Policies in app](https://app.oursprivacy.com/admin/policies)

***

## Policy management

Create policies to define permission sets for different groups of users.

![The Policies tab listing six policies, each row showing how many permissions it allows, how many it denies, and a PHI tag on the policies that grant access to protected health information](https://docs.oursprivacy.com/img/policies-and-permissions/policies-and-permissions-img-1.jpg)

### Custom policy creation

Give each policy a descriptive name and purpose so its use is clear. Build policies to match a team structure, a business requirement, or a compliance need.

Start from a preset if one is close to what you need, then adjust it. Each preset shows how many permissions it grants before you apply it.

![The Presets column offering Full Admin, Publisher / Editor, Viewer, Analyst, and Developer templates, each with a description, a permission count, and a Use this preset button](https://docs.oursprivacy.com/img/policies-and-permissions/policies-and-permissions-img-3.jpg)

### Granular permission control

Configure individual permissions within a policy, scoped to a resource and an action. For example:

* `allowedEvent:find` views allowed event details
* `allowedEvent:create` creates new allowed events
* `allowedEvent:delete` deletes allowed events
* `allowedEvent:update` modifies existing allowed events
* `allowedEvent:list` lists all allowed events

![A policy editor with a Policy Name field, a Permission Summary counting allowed and denied permissions and how many of each involve PHI, and lists of individual allowed and denied permissions with PHI tags](https://docs.oursprivacy.com/img/policies-and-permissions/policies-and-permissions-img-2.jpg)

### Permission categories

Permissions are grouped by category and action so policies stay easy to configure:

* **Event Management:** create, view, edit, and delete events
* **Billing:** view and modify billing information
* **Consent Settings:** manage consent configuration
* **User Management:** invite users, assign roles, and modify accounts
* **Organization Settings:** manage organization-level configuration
* **Data Access:** access sensitive data and PHI-related information

[Dashboards](https://docs.oursprivacy.com/docs/analytics/dashboards) follow the Web Analytics permissions: view access opens them, and write access creates and edits them. The [AI Assistant](https://docs.oursprivacy.com/docs/ai-assistant/privacy-and-permissions) answers within each user's own permissions, so it only looks up what that person can already see.

### PHI access tracking

Each permission shows whether it grants access to Protected Health Information (PHI), so you can see where sensitive healthcare data is reachable and keep that access aligned with HIPAA requirements.

### Policy assignment

Assign one or more policies to a user. When a user has several policies, their access is the combined set of permissions across all of them.

## User permission management

### Individual user configuration

Set permissions for each user independently when their access needs to differ from a shared policy.

### Inline permission editing

Edit a user's permissions directly, with search and filtering to find the permission you need. Changes are reflected as you make them.

### Permission summary

View the allowed and denied permissions for any user, including which ones grant PHI access. This gives you a clear picture of each user's access during a compliance audit.

### Audit trail

Every permission change is logged with a timestamp, the user, and the details of the change, so you have a record for compliance and security reviews. These entries can also be streamed into your SIEM, which is the usual way teams alert on a permission change that grants PHI access. See [SIEM Audit Log Streaming](https://docs.oursprivacy.com/docs/siem-audit-log-streaming).

## Best practices

* Build policies around job functions, not individual people.
* Use descriptive names that make a policy's purpose obvious.
* Review and update policies as your team and needs change.

***

## Next Steps

* **[Security Controls](https://docs.oursprivacy.com/docs/security-controls)**: Configure MFA, inactivity timeout, and data protection.
* **[Account Management Features](https://docs.oursprivacy.com/docs/account-management-features)**: Manage users, roles, and organization settings.
* **[SIEM Audit Log Streaming](https://docs.oursprivacy.com/docs/siem-audit-log-streaming)**: Stream permission changes and data access into your SIEM.