Safety Rbac Compliance And Governance

Operator promotes a contractor to 'admin' role for one project. The contractor can now read every credential on the entire instance.

Global admin/owner roles are instance-wide. For per-project scope, use project-level roles (Enterprise) — contractor gets project editor / viewer, not instance admin. Audit member roles quarterly. Remove on contract end.

Compliance team asks for who-activated-workflow-X 90 days ago. Audit logs show only the last 30 days.

Audit logs (Enterprise) capture user actions; configure retention or export to a SIEM (Splunk / Datadog) for long-term storage. Compliance frameworks (SOC 2) typically require 1 year. Pipe events via syslog / webhook to durable storage.

Marketing site claims SOC 2 Type II. Sales asks operator to embed the badge on the customer-facing dashboard.

Verify current SOC 2 report scope (Cloud only? Enterprise self-host?) before claiming. Treat as [REQUIRES-VERIFICATION] when promoting publicly. Pull the current attestation from n8n's trust page and pin the report period in any customer document.