LowerPlane uses role-based access control (RBAC) to manage what each team member can see and do within your organization. Properly configured roles ensure that the right people have the right access — a fundamental compliance requirement across all frameworks.

​
Roles

LowerPlane provides five predefined roles:

​
Role Permissions Matrix

The Auditor role is specifically designed for external auditors who need to verify your compliance posture. It provides sufficient access for audit purposes without exposing operational settings or user management.

​
Inviting Users

1

Navigate to Settings > Users

Open the user management page from the Settings menu.
2

Click Invite User

Click the Invite User button to open the invitation form.
3

Enter the user's email

Provide the email address of the person you want to invite.
4

Select a role

Choose the appropriate role for the new user based on their responsibilities.
5

Send the invitation

Click Send Invite. The user receives an email with a link to create their account and join your organization.
Follow the principle of least privilege: assign the minimum role necessary for each person’s responsibilities. You can always upgrade a role later if needed.

​
Managing Existing Users

​
Changing a User’s Role

  1. Go to Settings > Users and find the user in the list.
  2. Click on the user or the role dropdown.
  3. Select the new role.
  4. Confirm the change.

​
Removing a User

  1. Go to Settings > Users and find the user.
  2. Click Remove or the delete action.
  3. Confirm the removal. The user immediately loses access to your organization.
Removing a user does not delete their contributions (evidence uploads, policy edits, test completions). These records are preserved for audit trail integrity. The user’s name remains in activity logs.

​
Viewing 2FA Status

The user list displays each team member’s two-factor authentication (2FA) status:
  • Enabled — The user has configured 2FA on their account
  • Not Enabled — The user has not yet set up 2FA
This visibility helps you enforce your organization’s MFA policy. See MFA Settings for organization-wide enforcement options.

​
User Management as Compliance Evidence

Proper user management directly satisfies compliance controls: LowerPlane maintains an audit log of all user management actions:
  • When users were invited and when they accepted
  • Role assignments and changes
  • User removals and the reason (if provided)
  • Last login timestamps

​
Best Practices

  • Review user access quarterly. Remove users who no longer need access and verify that roles still match responsibilities.
  • Use the Auditor role for external auditors. Never give auditors Admin or Member access.
  • Require 2FA for all users. Enable organization-wide MFA enforcement to meet authentication controls.
  • Limit the number of Owners and Admins. Keep privileged roles to the minimum necessary.
  • Document role assignments. Use notes or an external record to explain why each person has their assigned role. Auditors may ask.