​
Overview

Groups and security roles provide the organizational structure for managing access, assigning training, scoping access reviews, and controlling permissions within LowerPlane. Groups represent logical collections of employees (by department, function, or project), while security roles define what actions users can perform in the platform.

​
Groups

Groups are flexible containers for organizing employees. They serve multiple purposes across the platform:
  • Training assignments — assign training courses to entire groups
  • Access review scoping — include or exclude groups from access review campaigns
  • Phishing campaigns — target phishing simulations at specific groups
  • Reporting — filter and segment compliance metrics by group

​
Creating a Group

1

Navigate to People

Go to Personnel > People and select the Groups tab.
2

Click Add Group

Click Add Group to open the creation form.
3

Define the Group

Provide the following information:
4

Save

Save the group. It is now available for member assignment and use across the platform.

​
Managing Group Membership

After creating a group, add members by selecting employees from the people directory. Group membership can be managed in two ways:
  1. From the group — open the group and add or remove members
  2. From the person — open an employee’s detail page and assign them to groups
Align your LowerPlane groups with your organizational structure (departments, teams, locations) to make training assignments and access reviews intuitive to manage.

​
Common Group Patterns

​
Security Roles

Security roles define permissions and responsibilities within the LowerPlane platform. Roles control what users can see and do, ensuring proper separation of duties.

​
Built-in Roles

LowerPlane provides default security roles that cover common organizational needs:

​
Assigning Security Roles

Security roles are assigned to individual people through their person detail page or during user creation. A person can have multiple roles, and their effective permissions are the union of all assigned roles.
Security roles control LowerPlane platform access. They are separate from the system access tracked in access reviews, which covers external applications and infrastructure.

​
Custom Roles

If the built-in roles do not match your organizational structure, you can create custom security roles with specific permission sets. Custom roles allow you to:
  • Grant access to specific modules (compliance, risk, vendors, personnel)
  • Restrict write access while allowing read access
  • Create specialized roles for unique organizational needs

​
How Groups and Roles Work Together

Groups and security roles serve different but complementary purposes: A typical setup might look like:
  • An employee in the Engineering group (for training) with the Compliance Officer role (for platform access)
  • A contractor in the Contractors group (for limited training) with the Employee role (for portal access only)

​
Permissions Model

Permissions in LowerPlane follow a role-based access control (RBAC) model:
  1. Each security role grants a set of permissions (read, write, delete) on specific resources
  2. A user’s effective permissions are the union of all their assigned roles
  3. If any role grants a permission, the user has that permission
  4. Users without a specific permission cannot see or access the corresponding features
Be careful when assigning the Admin role. It provides full access to all platform features including user management, billing, and destructive operations. Follow the principle of least privilege.

​
Compliance Relevance

Groups and roles support key compliance controls:

​
Best Practices

  • Mirror your org chart in LowerPlane groups to make management intuitive
  • Use the principle of least privilege when assigning security roles
  • Review group membership quarterly to remove departed employees and add new hires
  • Avoid assigning Admin to more than 2-3 people in the organization
  • Document group purposes in the description field so new administrators understand the intent
  • Create a “New Hires” group for initial onboarding training that is automatically assigned to new employees
  • Audit role assignments as part of your access review process to ensure separation of duties