Skip to main content
Joinly by KoppelHet

Roles and RBAC

Everyone gets the access they need. Automatically.

Define once what someone needs, based on job, department, location or any other attribute. Joinly gives that access automatically to everyone it applies to, adjusts it when something changes and revokes it when they leave. Starting from access that grew over the years? Joinly suggests the roles automatically from your own data.

No credit card, nothing to install. Talk to an IAM specialist

  • ISO 27001-certified
  • Certified by AFAS
  • Data in Amsterdam
Conditional roles in Joinly that follow an employee's job

“Just give him the same rights as Kees”

That is how access grows in most organisations. Someone gets a colleague's rights, that colleague already had too many, and nobody ever cleans it up.

For IT that means tickets every week. For the security officer it means rights nobody can explain any more, and no answer to the question of who can reach the financial data.

How it works

From access that grew to roles that keep themselves up to date

  1. Step 1

    See who has what

    Joinly automatically builds an overview of all the rights everyone has at that moment. So you see at a glance where access was assigned by hand and a role can take over.

    Export the matrix to Excel for the auditor.

    The authorisation matrix in Joinly: per department and job, what share of the group has each access item, and whether a role grants it

  2. Step 2

    Joinly suggests the roles automatically

    No weeks in Excel to design a role model. Joinly recognises who has the same access and suggests those groups as roles. At the top, the suggestion that makes the most manual admin unnecessary.

    Role suggestions in Joinly: groups of colleagues with the same access, sorted by how many manual assignments a role takes over

  3. Step 3

    Create the role automatically and see the impact first

    Before anything is saved, you see who gets the role, who gains new access through it and which manual assignments it absorbs. From then on the role keeps itself up to date: whoever joins gets it automatically, and whoever moves loses it.

    Creating a role from a suggestion: conditions, linked access items and the impact before anything is saved

  4. Step 4

    Keep roles and reality in line

    Role evaluation puts who should have a role next to who has it. Deviations show access that hardly anyone in the same group has, with its source and who granted it. You apply the difference in one click.

    Access another source still covers stays in place when you revoke.

    Deviations in Joinly: access that hardly anyone in the same group has, with source, date and who granted it

What it delivers

  • For IT

    No more tickets for standard access

    New colleagues have exactly what their job needs on day one. A change of job is one change in HR.

  • For the security officer

    Every assignment can be explained

    For each person you see which rule granted the access, and you clean up deviations in one click. It is all in the audit log.

  • For the auditor

    The authorisation matrix is always current

    No spreadsheet that falls behind: the matrix comes from actual access, and you export it whenever you like.

Customer story · Infrastructure and engineeringFrom scattered employee data to one reliable basisAt Koninklijke Oosterhof Holman employee information was kept in several places, and those places contradicted each other. Now AFAS is the source and the rest of the organisation follows by itself.Read the story

Ask away

Frequently asked questions about roles

  • What goes into a role?

    Entra groups (security and Microsoft 365), Enterprise Applications with their app roles, Microsoft licences and applications such as Bitwarden or HubSpot. Whoever gets the role gets all of it at once, and loses it again when it is revoked, unless another source still covers the access.

  • Which data can a role be assigned on?

    Any field from your HR system: department, job, location, contract type or a custom field. You combine them, for example department Care and location Utrecht. When HR changes a field, the access moves with it.

  • How do I start if my access has grown over the years?

    With the authorisation matrix and the role suggestions: they show which groups of colleagues already have the same access. You bring existing memberships along as a source, so nothing disappears. Then you introduce one role at a time, and role evaluation shows beforehand what will change.

  • What is the difference between RBAC and ABAC?

    With RBAC, access hangs on a role; with ABAC, on attributes such as department, location or contract type. The best models use both: a role per job, and rules on attributes for what differs by department or location. Those attributes are already in your HR system.

  • Can I hand out temporary roles?

    Yes. A role or a single right gets an end date, and on that date the access lapses by itself. That way contractors and interns never keep access longer than agreed.

  • How do I avoid too many roles?

    Keep roles broad and use rules on HR attributes for the differences. Genuine exceptions go through a request with approval. Make a role for every exception and within a year you have more roles than employees.

  • What if two rights may not go together?

    Then you record that as segregation of duties. If someone gets the second half through a role, Joinly holds that access until someone chooses.

More of the product

Try roles yourself

In your free trial environment you see with demo data how roles grant access by job, department and location.

No credit card, nothing to install.

Rather talk to someone first? Talk to an IAM specialist