On This Page (4 sections)

Administration & SecurityVersion 2.0SOC 2 CC6.1 / ISO 27001:2022 / Invariant INV-06

Restricting User Access with Facility-Level Scoping & Separation of Duties (SoD)

Administrator guide for configuring plant-level data isolation, restricting plant operators to specific physical sites, and enforcing regulatory Separation of Duties rules.

Last Reviewed: 2026-08-26

Owner: Security Administration Lead

Prerequisites & Required Authorizations

Client Administrator role.

Expected Outcome

Multi-facility user scoping applied and Separation of Duties conflicts automatically prevented.

1. Separation of Duties (SoD) Architecture

Under Invariant INV-06 and ISO 27001 controls, Carbonatoz prevents conflicting role assignments:

An individual cannot simultaneously hold Data Entry (carbon_accountant or facility_manager) and Audit Signoff (verifier_lead) within the same organization.
An individual cannot approve their own submitted declarations.

2. Configuring Plant-Level Scoping

Step 2.1: Open Team Member Detail

Navigate to AdministrationTeam & Roles.

Select an active team member and click Edit Permissions.

Step 2.2: Set Facility Boundaries

Under Facility Access Scope, select Restricted to Specific Facilities.

Check the permitted plants (e.g., Plant #1 - Jamshedpur Blast Furnace only).

Leave unassigned plants unchecked (e.g., Plant #2 - Angul DRI Smelter).

Click Save Scope.

When the user logs in, all activity data, meters, and readings from other plants are completely hidden and inaccessible.

Previous Procedure

Managing Statutory Compliance Deadlines & Automated Escalation Alerts

Next Procedure

Maintaining the Facility Emission Source Register & Calibration Logs

Was this operational procedure helpful?

Your feedback helps our regulatory practice teams refine operational SOPs.