Inheriting Record Access Restrictions on Newly Created Records

When you create new records in Risk Cloud, record-level access permissions automatically inherit from linked records to maintain consistency and security. This article explains how record access is applied by default, and details additional inheritance behavior for different creation methods.

Overview

• User Groups determine which users have access to a record. You can add individual users or entire groups.
• Record Creator (the user who initiated creation) is always granted access by default.
• Default User Group defined in the workflow settings is always granted access.
• Additional inheritance rules apply depending on how the new record is created.

For more on configuring User Groups, see Get Started with Record Level Access with User Groups.

Default Inheritance

Whenever a new record is created—regardless of method—the following are added automatically:

1. Record creator
2. Default User Group (configured in Workflow Settings)

Method-Specific Inheritance

1. Create Single Record from Linked Workflow Section

When expanding a linked workflow section (for example, adding an issue under an audit), the new record:

• Inherits all User Groups already assigned to the parent record.

2. Create via Assessment Scoping

When creating an assessment through the scoping tree, the new assessment links to two parents:

• Record in Tree
• Assessment Object from 1 Level Higher in Tree

The new record inherits User Groups from both parents, ensuring all relevant stakeholders retain access.

3. Create via Bulk Create and Link

When creating an assessment through Bulk Create & Link, the new assessment links to two parents:

• "Created From" Record
• "Linked To" Record

Each new record inherits User Groups from the parents in the same ways as assessment scoping.

Examples

Tips

• Review your Default User Group in Workflow Settings to ensure the right baseline access.
• Ensure Record Level Access is set at the parent records before the child records are created to entire access is inherited correctly