Rencore
Delegated RBAC
Workspace-level role assignments scope governance per team. Different teams see only their relevant data, security findings for security, cost data for finance, ownership scope for regional IT.
Delegated RBAC is Rencore's role-based access control with workspace-level scoping. Assign roles per workspace so different teams see only the governance scope they own. Combined with virtual environments and multi-tenant support, RBAC lets MSPs and large enterprises run a single Rencore instance for many separate audiences without leaking data across boundaries.
Why scoping matters
A large enterprise has multiple business units, regional IT teams, and compliance officers, each owning a slice of governance. A single shared admin view exposes everyone’s data to everyone, which fails most internal audit standards and creates information overload. The platform needs to scope what each role sees.
For MSPs the requirement is stricter: customer data must not be visible to other customers’ admins. Workspace-level RBAC plus virtual environments are the foundation.
How roles compose
Rencore ships with default roles (Admin, Editor, Reader, Approver) and supports custom roles for fine-grained scenarios. Each role grants a set of capabilities; assign roles per workspace so a user can be Admin in one workspace and Reader in another. Capabilities cover dashboard access, policy configuration, automation execution, approval authority, user management, and audit log access.
Beyond the platform
For organizations with strict identity governance, every Rencore role assignment is tied to Entra ID group membership. Provisioning a new admin means adding them to the relevant Entra ID group; deprovisioning happens by removing them from the group. No orphaned Rencore accounts after offboarding.
Frequently asked questions
What is Rencore governance?
How do Rencore policies work?
Can I build custom automations in Rencore?
Trusted by
