System roles and permissions
Last updated: November 9, 2026
ComplyAdvantage Mesh uses role-based access control (RBAC). What a user can see and do is determined by the roles assigned to them in the account they are working in, not by the individual user record.
Every account comes with three system roles: Analyst, Supervisor, and Admin. These cover the most common ways compliance teams divide work. Alongside them, you can build your own roles with exactly the permissions you need. See Creating and managing custom roles.
How access is put together
Three things define access in Mesh:
Permission. A single action, such as viewing a case or creating a screening configuration.
Role. A named set of permissions. System roles are provided by ComplyAdvantage; custom roles are created by you.
Account. Roles are assigned per account. A user who works in more than one account in your organization can hold different roles in each. See Switching between accounts.
A user can hold more than one role in the same account. Permissions are additive, so the user gets the combined permissions of every role assigned to them. Removing access means removing the role that grants it, not adding a restriction on top.
Base and action permissions
Most product areas need two permissions to work, not one.
Base permissions open the area. Without the base permission, the individual action permissions in that area do nothing. They read as Access to base customer screening functionality or Access to base customer monitoring functionality.
Action permissions allow a specific operation inside it, such as Create and screen customers or Monitor and unmonitor customers.
Base permissions are account permissions, and action permissions are user permissions. An account permission enables a product, a data source, or a feature for the whole account, and only ComplyAdvantage can enable one. A role holds user permissions only.
So a user who onboards and screens customers requires Create and screen customers on their role and Access to base customer screening functionality on the account. Either one alone will fail.
To have an account permission enabled, contact your Customer Success Manager.
The three system roles
Role | Intended for | Access in summary |
|---|---|---|
Analyst | Day-to-day investigation work | Review and action the queue: customers, alerts, and cases |
Supervisor | Team leads and reviewers | Everything an Analyst can do, plus insights and exports |
Admin | Platform administrators | Everything a Supervisor can do, plus configuration, users, and roles |
Good to know - System roles maintain themselves. System roles cannot be edited or deleted, and they are marked with a lock icon in the roles list. As features are released, ComplyAdvantage adds the relevant new permissions to each system role automatically. Custom roles do not update this way: when a new permission becomes available, you decide whether to add it to each of your own roles. |
What each role covers
The table below is a guide to the shape of each role rather than a complete list. Permissions are added as the platform grows, so treat the Roles and permissions page in Mesh as the authoritative record.
Area | Analyst | Supervisor | Admin |
|---|---|---|---|
View, create, and screen customers | Yes | Yes | Yes |
Turn customer monitoring on and off | Yes | Yes | Yes |
View and update alerts and risks | Yes | Yes | Yes |
View, update, assign, and label cases | Yes | Yes | Yes |
Insights dashboards | No | Yes | Yes |
Exports and downloads | No | Yes | Yes |
Risk models, screening configurations, and scenario configurations | No | No | Yes |
Create and update case workflows | No | No | Yes |
Webhooks and email notification configurations | No | No | Yes |
Add users, assign roles, and create custom roles | No | No | Yes |
Check exactly what a role grants
The roles and permissions page shows every permission in the platform and whether a given role has it.
Select Settings from the main navigation.
Go to Access management and select Roles and permissions.
Select a role to open its details.
Toggle Show only granted permissions to hide everything the role does not grant.
Important to know - Some permissions depend on others. A permission can require another permission to work. Viewing a case, for example, is a prerequisite for moving it to another stage. Where a dependency exists, Mesh marks the permission with an icon and selects the permissions it depends on for you. A permission is available only when your account has the account permission it requires. |
Permissions for specific case types
Access to cases is controlled per case type, so a role can be scoped to customer screening, customer monitoring, payment screening, or transaction monitoring work. Users with the Admin role keep access to every case type. For how to configure this, see Permissions by case type.
Organization-level permissions
A small set of permissions covers management across every account in your organization rather than within one account, such as viewing all accounts and managing roles at organization level. These sit outside the three system roles, so no system role includes them.
Role names and language
System role names are shown in the language the user has selected, so an Analyst in a French-language session sees the French name for the role. Custom role names always display exactly as you configured them.
What each permission allows
The tables below describe each permission you can grant to a role, in the groups the Roles and permissions page uses. The last column names the account permission each one requires.
Customers group
Permission | What it allows | Account permission required |
|---|---|---|
View customers | View customer list, customer details, customer risk score, customer audit log, and customer screening reports. | None |
Update customers | Update customer details and recalculate their risk score. | None |
Delete customers | Delete customer records. | None |
Create and screen customers | Create and screen customers, individually or in a batch. | Access to base customer screening functionality |
View customer monitoring status | View whether a customer is being monitored. | Access to base customer monitoring functionality |
Monitor and unmonitor customers | Enable or disable customer monitoring during initial onboarding, or at a later date. | Access to base customer monitoring functionality |
Create and update labels | Create and update customer labels. | None |
Create and update segments | Create and update segments within the account. | Access to base transaction monitoring functionality |
Manage custom fields for customers | Create, update, and delete custom fields to be used on customers. | None |
Manage custom lists for customer screening | Create and update custom lists for customer screening. | Access to custom lists for customer screening |
Rescreen customers on demand | Rescreen a customer on demand, in the web platform or through the API. | Allow re-screen on demand |
Transactions group
Permission | What it allows | Account permission required |
|---|---|---|
View transactions | View transactions. | Access to base transaction monitoring functionality or Access to base payment screening functionality |
Upload transactions | Upload transactions for Transaction Monitoring or Payment Screening. | Access to base transaction monitoring functionality or Access to base payment screening functionality |
Manage held transactions | Release a held transaction. | Access to base transaction monitoring functionality or Access to base payment screening functionality |
View lookup lists | View the entries in a lookup list. | Access to base transaction monitoring functionality or Access to base payment screening functionality |
Manage lookup lists | Create and update lookup lists. | Access to base transaction monitoring functionality or Access to base payment screening functionality |
Cases, alerts and risks group
Permission | What it allows | Account permission required |
|---|---|---|
View onboarding cases | View case lists, case details, case notes, and case audit logs for customer onboarding cases. | Access to base customer screening functionality |
View monitoring cases | View case lists, case details, case notes, and case audit logs for customer monitoring cases. | Access to base customer monitoring functionality |
View payment screening cases | View case lists, case details, case notes, and case audit logs for payment screening cases. | Access to base payment screening functionality |
View transaction monitoring cases | View case lists, case details, case notes, and case audit logs for transaction monitoring cases. | Access to base transaction monitoring functionality |
Update cases | Leave case notes, make case decisions, and transition cases, for the case types the role can view. | None |
View alerts | View alerts, risks, and risk notes. | None |
Update alerts | Update properties of alerts, such as alert status. | None |
Update risks | Update the status of a risk. | None |
Create and delete mutes | Create and delete mutes for future alerts about the same risk. | None |
View fraud detection cases | View fraud detection cases. | Fraud detection |
Regulatory reporting group
Permission | What it allows | Account permission required |
|---|---|---|
View FinCEN CTR reports | View FinCEN CTR report list and individual reports. | Account has access to FinCEN CTR reports |
Create FinCEN CTR reports | Create or edit FinCEN CTR reports. | Account has access to FinCEN CTR reports |
Submit FinCEN CTR reports | Submit CTR reports to FinCEN. | Account has access to FinCEN CTR reports |
View FinCEN SAR reports | View FinCEN SAR report list and individual reports. | Account has access to FinCEN SAR reports |
Create FinCEN SAR reports | Create or edit FinCEN SAR reports. | Account has access to FinCEN SAR reports |
Submit FinCEN SAR reports | Submit SAR reports to FinCEN. | Account has access to FinCEN SAR reports |
View FINTRAC EFTR reports | View FINTRAC EFTR report list and individual reports. | Account has access to FINTRAC EFTR reports |
Create FINTRAC EFTR reports | Create or edit FINTRAC EFTR reports. | Account has access to FINTRAC EFTR reports |
Submit FINTRAC EFTR reports | Submit EFTR reports to FINTRAC. | Account has access to FINTRAC EFTR reports |
View FINTRAC STR reports | View FINTRAC STR report list and individual reports. | Account has access to FINTRAC STR reports |
Create FINTRAC STR reports | Create or edit FINTRAC STR reports. | Account has access to FINTRAC STR reports |
Submit FINTRAC STR reports | Submit STR reports to FINTRAC. | Account has access to FINTRAC STR reports |
Manage FinCEN CTR settings | Manage settings such as pre-fill data for FinCEN CTR reports. | Account has access to FinCEN CTR reports |
Manage FinCEN SAR settings | Manage settings such as pre-fill data for FinCEN SAR reports. | Account has access to FinCEN SAR reports |
Manage FINTRAC EFTR settings | Manage settings such as pre-fill data for FINTRAC EFTR reports. | Account has access to FINTRAC EFTR reports |
Manage FINTRAC STR settings | Manage settings such as pre-fill data for FINTRAC STR reports. | Account has access to FINTRAC STR reports |
Insights group
Permission | What it allows | Account permission required |
|---|---|---|
View and download insights | View insights dashboards and download insights data. | None |
Risk policies group
Permission | What it allows | Account permission required |
|---|---|---|
View risk models | View all risk models configured within the account. | None |
View scenarios | View scenarios and scenario configurations within the account. | Access to base transaction monitoring functionality |
Create and update scenarios | Create and update scenarios and scenario configurations within the account. | Access to base transaction monitoring functionality |
Create and update risk models | Create and update risk models within the account. | None |
Create and update customer screening configurations | Create and update screening configurations within the account. | Access to base customer screening functionality |
Artifact Builder Create | Create and edit scenarios by describing them in a chat, with the scenario logic generated by AI. The user also requires Create and update scenarios. | Access to base Artifact Builder functionality |
Case workflows group
Permission | What it allows | Account permission required |
|---|---|---|
Update case workflows | Update case workflows configured within the account, including stage permissions. | None |
Developers group
Permission | What it allows | Account permission required |
|---|---|---|
View webhooks | View webhooks configured within the account. | None |
Create and update webhooks | Create and update webhooks within the account. | None |
Access management group
Permission | What it allows | Account permission required |
|---|---|---|
View all accounts | View all accounts within the organization. | None |
View users | View users and their accounts within the organization. | None |
View users external service information | View the sign-in details held for users in the organization, such as their last login and number of logins. Mesh does not display these details on any page. | None |
Create and update users | Create and update users within the organization. | None |
View roles in account | View roles in the logged-in account. | None |
View roles in organization | View roles in any account within the organization. | None |
Create, update, and delete roles in account | Create, update, and delete roles in the logged-in account. | None |
Assign roles in account | Assign roles to any user in the logged-in account. | None |
Assign roles in organization | Assign roles to any user in any account within the organization. | None |
View email notification configurations | View email notification configurations within the account. | None |
Create and update email notification configurations | Create, update, and test email notification configurations within the account. | None |
Manage client subscription | Open Billings & Subscription from the user menu to manage the subscription for your organization. The option appears only if your organization has self-serve subscription management. | None |
View machine credentials | View the API credentials in the account, on the API Access page under Settings and Access management. | None |
Create and manage machine credentials | Create and deactivate API credentials in the account. Requires View machine credentials. | None |
Agents group
Permission | What it allows | Account permission required |
|---|---|---|
View AI agents | View all AI agents. | Access to agentic workflows |
Create and update AI agents | Create and update AI agents. | Access to agentic workflows |
Assign cases to AI agents | Assign cases to AI agents. | Access to agentic workflows |
Next steps
Creating and managing custom roles walks through building a role from a chosen set of permissions. Duplicating a system role is the quickest starting point when you want an Analyst or Supervisor with one or two changes.
Managing users covers adding users to an account and updating their roles, including in bulk.
Permissions by case type covers restricting a role to specific case types.