Vendor Pulse: Roles & Permissions Reference

Overview

Access to Vendor Pulse is controlled by permission scopes — strings such as vendor:view. Each section of the product checks for its own scope, and a user who lacks it sees an "Unauthorized" screen instead of the page.

This page covers Vendor Pulse only. For the cross-product picture, see the Zeron Platform: Complete Permissions & RBAC Reference.

Prerequisites

Access to Admin → Management, where users and groups are maintained
The list of sections each of your teams actually needs

How Permissions Work

Groups bundle one or more policies. Add a user to a group and they inherit its permissions. This is the approach we recommend.
Permissions can also be attached to a user directly.
Scopes are additive — there is no deny.
View and change are separate scopes. Granting vendor:view does not allow adding a vendor.

Section Access

These scopes decide whether a section opens at all.

Section	Scope needed
Dashboard	`dashboard:view`
Vendors (list and all vendor tabs)	`vendor:view`
Master Data (Templates and Product & Service Categories)	`master:view`
ZIN Advisor (Checklist, Knowledge Base, Questionnaire)	`zin:view` or `zin:add`
Documents	`dashboard:view`
Reports	`report:view`

Note: the Documents section is gated by dashboard:view, not by a documents-specific scope. Listing and exporting the documents inside it additionally needs one of vendor:assessment:view, vendor:assessment:review or vendor:assessment:add.

Note: zin:view opens ZIN Advisor and its Checklist tab, but the Knowledge Base and Questionnaire tabs load their data on questionnaire:view, questionnaire:add or zin:add. Give read-only users both zin:view and questionnaire:view.

Vendor Tabs

Once vendor:view lets you open a vendor, individual tabs have their own checks.

Tab	Requirement
Profile	`vendor:view`
Digital Risk	`vendor:digital:view`, the vendor must have a primary domain, and the deployment must not be on-premise
Manage Risk	`vendor:risk:view`
Assessment Process	`vendor:assessment:view`
Documents	`vendor:view` to open; an assessment scope to list the documents
Vendor Analysis	Not available on on-premise deployments
Team	`vendor:view`

Action Scopes

Vendors and categories

To do this	Required scope
View vendor list, vendor details, vendor team	`vendor:view`
Add a vendor (single or bulk), edit a vendor	`vendor:add`
Create or edit a product/service category or subcategory	`vendor:add`
Delete a vendor	`vendor:delete`
Delete a category or subcategory	`vendor:delete`
View the digital risk / external attack surface of a vendor	`vendor:digital:view`

Assessments

To do this	Required scope
View assessments, answers and answer history	`vendor:assessment:view`
Download the assessment template and import answers	`vendor:assessment:view`
Create an assessment, change its due date, send a reminder	`vendor:assessment:add`
Rate vendor answers, submit the review, use Review with ZIN AI	`vendor:assessment:review`
Delete an assessment	`vendor:assessment:delete`
List, view and export evidence documents; approve or reject evidence; delete a private document	`vendor:assessment:view`, `vendor:assessment:review` or `vendor:assessment:add`

Risks

To do this	Required scope
View risks, mark and unmark risks for evaluation, reset the selection	`vendor:risk:view`
Add or update a risk (including Mark as Risk from an answer), link documents to a risk, send risks to a vendor for evaluation	`vendor:risk:add`

Master Data

To do this	Required scope
View templates, categories and questions	`master:view` (or `master:add`)
Export a template	`master:view`
Create or update templates, categories and questions; download the sample template	`master:add`
Delete a template, category or question	`master:delete`

ZIN Advisor

To do this	Required scope
View checklist documents and their generated questions	`zin:view` (or `zin:add`)
Upload a checklist document	`zin:add`
Delete a checklist document	`zin:delete`
Add generated checklist questions to a template (Assign Template)	`master:add`
View the Knowledge Base and the questionnaire list, review screen and export	`questionnaire:view`, `questionnaire:add` or `zin:add`
Add, edit, import or delete Knowledge Base entries	`questionnaire:add` or `zin:add`
Upload a questionnaire	`zin:add`
Generate answers, edit, retry, approve and delete a questionnaire	`questionnaire:add` or `zin:add`
Get answers through the Chrome extension	`questionnaire:view`, `questionnaire:add` or `zin:add`

Reports

To do this	Required scope
View and download reports	`report:view`

Where the Button and the Save Disagree

In several places the control you can see is governed by a different scope than the action behind it — or by no scope at all. If a user lacks the scope in the right-hand column, the button appears but the request is rejected.

Area	Controls the button	Controls the action
Product & Service Categories — Add, Edit	`master:add`	`vendor:add`
Product & Service Categories — Delete	`master:delete`	`vendor:delete`
Manage Risk row menu (Mark / Unmark Evaluation)	`vendor:risk:add`	`vendor:risk:view`
Assessment row menu — Delete	Always shown	`vendor:assessment:delete`
Assessment row menu — Send Reminder, Edit	Always shown	`vendor:assessment:add`
Review workspace — rating dropdown, Submit Reviews	Always shown	`vendor:assessment:review`
Review workspace — Mark as Risk	Always shown	`vendor:risk:add`
Vendor list — Single Add, Bulk Upload	Always shown	`vendor:add`
ZIN Advisor — Upload Questionnaire	`zin:add` or `questionnaire:add`	`zin:add`
ZIN Advisor — Assign Template	`master:add`	`master:add`

For category work, grant master:add together with vendor:add (and master:delete with vendor:delete). For questionnaire work, grant zin:add.

Vendor Portal Roles

Vendors responding through the vendor assessment portal use roles, not scopes. They have no Zeron account: each person signs in through their personal emailed link and a one-time password. Roles are set by the vendor's own portal Admin.

Role	Answer and upload evidence	Import answers	Invite and remove members, change roles	Submit the assessment
Admin	Yes	Yes	Yes	Yes
Collaborator	Yes	Yes	No	No
Viewer	No	No	No	No

Rules built into the portal:

The vendor's SPOC is the first Admin. Everyone invited afterwards is a Collaborator unless the Admin chooses another role.
Only an Admin sees Submit Answers and Add Collaborator. They are hidden, not disabled, for everyone else.
The SPOC's role cannot be changed and the SPOC cannot be removed. The last Admin cannot be demoted or removed. Nobody can remove themselves.
Changing the SPOC Email on the vendor profile in Vendor Pulse changes who the SPOC is.

You can see a vendor's members, roles and statuses, read-only, on the vendor's Team tab.

Comment Permissions

Action	Rule
Read and post comments	`vendor:view`
Edit a comment	Only the author, only within 15 minutes of posting, and the author needs `vendor:view`. After that the Edit icon disappears and the request is refused
Delete a comment	Only the author. No time limit
Mention a colleague	Available on Internal comments only

Org users and vendor-portal members can never edit each other's comments, in either direction. The vendor portal has no edit or delete action on comments at all.

Common Setups

Read-only reviewer dashboard:view + vendor:view + vendor:assessment:view + vendor:risk:view + master:view + zin:view + questionnaire:view + report:view

Vendor manager The read-only set plus vendor:add, vendor:assessment:add, vendor:assessment:review, vendor:risk:add, master:add, zin:add, questionnaire:add

Vendor manager who can also remove records The vendor manager set plus vendor:delete, vendor:assessment:delete, master:delete, zin:delete

Digital risk analyst dashboard:view + vendor:view + vendor:digital:view + vendor:risk:view + report:view

Troubleshooting

Symptom: A user sees "Unauthorized" on a page → Their group is missing that section's scope. Add it from the Section Access table.

Symptom: A user can view but cannot create or edit → View and add are separate scopes. Add the matching :add scope.

Symptom: A button is visible but the action fails → Check the "Where the Button and the Save Disagree" table above and grant the scope in the right-hand column.

Symptom: A user cannot delete an assessment → vendor:assessment:delete is separate from vendor:assessment:add. It must be granted explicitly. The Delete option is visible either way.

Symptom: A user opens ZIN Advisor but the Knowledge Base and Questionnaire tabs stay empty → They hold zin:view only. Add questionnaire:view.

Symptom: A user sees Upload Questionnaire but the upload is refused → Uploading needs zin:add; questionnaire:add alone is not enough.

Symptom: A user opens Documents but no documents load → Add vendor:assessment:view.

Symptom: A user cannot see Reports → Add report:view.

Symptom: The Digital Risk tab is Unauthorized even with the scope → Confirm the vendor has a primary domain recorded, and that you are not on an on-premise deployment — Digital Risk and Vendor Analysis are unavailable there.

Symptom: The ZIN Advisor chat entry is missing from the sidebar → That is not a permission. The chat entry and the AI search bar only appear when the ZIN AI service is reachable from the deployment.

Symptom: A user does not see Review with ZIN AI → That is switched on per organisation, not per user. Contact support@zeron.one.

Symptom: A vendor contact cannot submit in the portal → They are not an Admin. A Collaborator can answer but not submit; a Viewer is read-only. The vendor's portal Admin must change their role to Admin, or submit on their behalf.

Need more help? Contact support@zeron.one