Setting Up Access Controls | User Docs

Last Updated: October 23, 2026

Introduction

Access controls decide who can see and change what in D3. This guide gives a quick overview to help new users set them up.

D3 combines role-based access with assignment:

Roles: each user has one role. The role decides which configuration and operational modules, and which actions in them, the user can use, for example View Playbooks, Edit Playbooks and Publish Playbooks, or Create Incident and Close Incident.
Groups: collections of users. A user can belong to several groups.
Sites: each user has access to the sites they are added to.
Assignment: tasks in an investigation playbook, such as interaction tasks and stage tasks, have an Assigned To option. A task can be assigned to the incident's Investigator or Owner, to a group or to a role.

Here are some examples of what you can do with D3's access controls:

Give analysts a role that can view and edit incidents but cannot publish playbooks.
Require two-factor authentication for everyone with a given role.
Use a group as an assignment group, so that unassigned High and Critical incidents can be routed to it and everyone in it is alerted.
Assign an interaction task to the incident's owner or to a group, so that it appears in their Pending Tasks.
Limit each user to the sites they work on.

Begin by configuring user roles and groups, then create users. For every field of users, groups, roles and sites, see Organization Management.