Access Management
To protect your data from unauthorized access, Bloomreach Engagement has developed Role-based access control. Having the access minimization principle in mind, this system allows you to make sure that only the right people have access to personal data or specific modules.
With Bloomreach Engagement, you can define and manage dedicated persons with specific permissions, such as to modify, view, or export customer data and execute campaigns. You can set separate access with the explicit purpose for each user either on a project or account level.
To do this go to Settings
> Project settings
> Access management
where you can select from, assign, and modify specific access rights.
Project limit
Note that in each project there is a limit of 1000 users.
Role-based access control (RBAC)
Role-based access control groups small sets of certain permissions and accesses under "roles" that can be assigned to team members by the Admin. This way, administrators are able to decrease the risk of major mistakes and security breaches by carefully restricting the access of the users to perform only the tasks that they really need.
Inviting a new project member
You can invite new users to your project and decide, which role is suitable for their work, as shown in the picture below. They will have to accept your invitation, and until they do so, they will appear within pending invitations.
The invitation is valid for 7 days for security reasons. After this time, the invited user will no longer be able to accept it and the administrator or superadmin has to resend the invitation.
You can make changes to the specific role and permissions while the invitation is pending, and you can further refine user accesses even after the invitation has been accepted. Thus, do not worry if you accidentally invite someone with an incorrect role or permissions, as the role can be changed anytime by the Project Administrator.
Configuring permissions
Once the user is in the project, you can adjust their project role by hovering over their name and clicking on the Edit button on the right side in the Project team
tab. Here, you can select multiple roles from a list of roles (some of which are described in the table below). There are several roles predefined by Bloomreach Engagement, and you can also create your own custom roles to suit your specific needs.
Assigning multiple roles
You can assign multiple roles to each user by scrolling down his or her individual access permission setup and selecting add role group
. Then, in project team
you can see all individual roles and their descriptions under that person´s name.
Temporary roles
The administrator can grant the user a temporary role by setting an expiration date in the user interface. Select the icon Add expiration
and select the exact day and time that the user´s role will expire. Expired roles are visible in the interface, but are not active and do not grant any permissions. We recommend setting expiration for highly sensitive roles, such as Admin roles and Personal Data Viewer.
Permission hierarchy
Roles naming hierarchy
There are several access roles in Bloomreach Engagement out of the box. To make it easy for you to quickly understand the scope of the role, all of them abide by the following naming convention: The first word or two represents the section of the application, and the later the extent of the permission.
When it comes to the extent of the permission, there are levels of roles with an increasing set of permissions, creating a kind of hierarchy of roles, as described in the flowchart below. Higher-level roles inherit all permissions from lower ones and lower levels never allow functions from higher-level roles. For example, while an Admin has access to all other functions, sole Editors cannot publish or export from Bloomreach Engagement (they can only do the task they are assigned and abilities hierarchically beneath them). All standalone roles follow this hierarchy and naming.

Admin: has full access to data, objects, and settings; can change settings that impact wider scope; can manipulate customer consent; can edit and delete data in bulk.
Editor: can write and delete access; can modify and delete objects.
Publisher: can execute access; can trigger an action that may have an immediate impact on the end customers or make objects publicly available.
Exporter: can export or download data from the Bloomreach Engagement application.
Approver: can only approve specific actions.
Requester: can create a request.
Viewer: read-only access; cannot modify objects.
Permission scopes hierarchy
Be aware of the hierarchy between Instances, Accounts, and Projects. Roles granted on a higher scope (account) are applied to all lower scopes (project). Similarly, if users operate on their own private instance, that instance has the highest hierarchy (instance -> account -> project)
For example, if a user is granted "Analyses Viewer" on the Account scope, the user will have "Analyses Viewer" in all projects under that Account.
Roles assigned to users on an instance scope are applied to all accounts and projects within the instance. Roles assigned to users on account scope are applied to all projects within the account.

Ensure Project Safety by granting a role on the correct Scope
Roles assigned to users on an instance scope are applied to all accounts and projects within the instance. Roles assigned to users on account scope are applied to all projects within the account.
This might be critical, as you might be granting Account rights to someone, who is supposed to see/edit one Project ONLY.
Roles
Predefined roles
There are several predefined standalone and non-standalone roles that come out of the box and that can be assigned to the members/users of your project. All standalone roles follow the naming and hierarchy of roles described above. In addition to those, there are several non-standalone roles set up by Bloomreach Engagement that allow access to specific actions. Remember, a user can have multiple roles assigned, but each user must have at least one stand-alone role to be able to access the project. The following is the list of all predefined roles in Bloomreach Engagement.
Role type | Description | Standalone |
---|---|---|
Analyses Editor | Can view, edit, and delete all analyses; can edit customer data - excluding consents. | Yes |
Analyses Exporter | Can view and export all analyses. | Yes |
Analyses Viewer | Can view all analyses. | Yes |
Campaigns Admin | Has full access to Campaigns (can view, edit, delete, start, and stop all Campaigns; can edit running Campaigns; can change Campaigns settings); can edit customer data - excluding consents. | Yes |
Campaigns Editor | Can view, edit, and delete Campaigns; can edit customer data - excluding consents. | Yes |
Campaigns Viewer | Can view Campaigns and their evaluations. | Yes |
Customer Data Exporter | Can export customer data in bulk. | Yes |
Exports Module Admin | Has full access to setup Exports of customer data including PII. | Yes |
IAM Admin | The role allows the administration of Identity and Access Management (Roles, Policies, and Service Accounts). | No |
Personal Data Viewer (flag) | Has view access to private fields (personal data, PII). | No |
Project Admin | Has full access to everything in projects; has full access to the project access management; can edit customer data - including consents. | Yes |
Project Developer | Has full access to imports, catalogs, and integrations; can change selected project settings; can view customer data. | Yes |
Project User (Legacy) | Can open projects and view customer data. | Yes |
Technical Support | Has roles: Analyses Editor and Analyses Exporter, Campaigns Admin, and Customer Data Exporter | Yes |
Temporary Access Approver | Can approve temporary access requests. | No |
Email Campaigns Editor | Can view, edit and delete Email Campaigns. | Yes |
Email Campaigns Publisher | Can view, edit, delete, and publish Email Campaigns. | Yes |
Email Campaigns Viewer | Can view Email Campaigns and their evaluations. | Yes |
Weblayers Editor | Can view, edit and delete Weblayers. | Yes |
Weblayers Publisher | Can view, edit, delete, and publish Weblayers. | Yes |
Weblayers Viewer | Can view Weblayers and their evaluations. | Yes |
Experiments Editor | Can view, edit and delete Experiments. | Yes |
Experiments Publisher | Can view, edit, delete, and publish Experiments. | Yes |
Experiments Viewer | Can view Experiments and their evaluations. | Yes |
Access to private fields (personal data, PII) is granted by the special role of 'Personal Data Viewer'. Bloomreach Engagement predefined roles never include this role. Personal Data Viewer must be granted explicitly or included in your custom roles.
To read more about the roles and see which specific roles are inherited, find the role in Access management
-> Roles
Stand-alone role required
Remember that each user must have at least one stand-alone role to be able to access the project. If a user does not have any stand-alone role, for example, only being a
Personal Data Viewer
, they will have a problem with logging into the project.
Instance-level roles
Bloomreach Engagement offers three main types of instances for your projects: shared, private and exclusive instance. These contain different features and configurations of data layers. In each of these instances, data is separated and access management is enabled to ensure your security. You can learn more about our Security architecture in its separate article.
What is important for Access management, is that the additional layers of security within the more sophisticated types of instances, such as the private or exclusive instance, will require some additional roles and accesses or permissions compared to the shared instance. For projects running on a private instance, there are these additional roles, as described in the table below.
Role | Description | Standalone |
---|---|---|
Super Admin | Has full access to all accounts (Account Admin), projects (Project Admin) and customer data (including PII); has full access to instance-specific settings; has full access to instance access management. | Yes |
Sales (Legacy) | Will be added shortly | No |
Temporary Access Requester | Can request temporary access. | No |
Instance Manager | Has full access to all accounts (Account Admin), projects (Project Admin), and customer data (including PII); has full access to instance-specific settings. | Yes |
AccessLockedProjects (flag) | Will be added shortly | No |
DebugImf (flag) | Will be added shortly | No |
OverrideSqlAccess (flag) | Will be added shortly | No |
ListAllProjects (flag) | Will be added shortly | No |
Granular roles
Bloomreach Engagement allows you to assign finely detailed roles to your project members, not limiting you to choose from broader predefined roles listed above. Remember, a user can have multiple roles assigned, but each user must have at least one stand-alone role to be able to access the project.
Role | Description | Standalone |
---|---|---|
Customers Viewer | Can view Customer attributes and events. | Yes |
Customers Editor | Can view, edit and delete Customer attributes and events. | Yes |
Data Manager Viewer | Can view Data manager. | Yes |
Data Manager Definition Editor | Can view, edit and delete Data manager definitions. | Yes |
Event Analyses Editor | Can view, edit and delete Event Analyses (e.g. Funnels, Trends, Retentions, Flows, and Geo Analyses). | Yes |
Event Analyses Exporter | Can view, edit, delete, and export Event Analyses (e.g. Funnels, Trends, Retentions, Flows, and Geo Analyses). | Yes |
Event Analyses Viewer | Can view Event Analyses (e.g. Funnels, Trends, Retentions, Flows, and Geo Analyses) and their results. | Yes |
Imports Admin | Can view, edit and delete Imports. | Yes |
In-App-Message Editor | Can view, edit and delete In-App-Message. | Yes |
In-App-Message Publisher | Can view, edit, delete, and publish In-App-Message. | Yes |
In-App-Message Viewer | Can view In-App-Message and their evaluations. | Yes |
Initiatives Editor | Can view, edit and delete Initiatives. | Yes |
Managed Endpoints Editor | Can view and edit Managed Endpoints. | Yes |
Managed Endpoints Publisher | Can view, edit and publish Managed Endpoints. | Yes |
Managed Endpoints Viewer | Can view Managed Endpoints and their evaluations. | Yes |
Project Usage Viewer | Can view the Usage Dashboard on the project level. | Yes |
Account Usage Viewer | Can view the Usage Dashboard on the project and the account level. | Yes |
Reports Editor | Can view, edit and delete Reports. | Yes |
Reports Exporter | Can view, edit, delete, and export Reports. | Yes |
Reports Viewer | Can view Reports and their results. | Yes |
Scenarios Editor | Can view, edit and delete Scenarios. | Yes |
Scenarios Publisher | Can view, edit, delete, and publish Scenarios. | Yes |
Scenarios Viewer | Can view Scenarios and their evaluations. | Yes |
Segmentations Editor | Can view, edit and delete Segmentations. | Yes |
Segmentations Exporter | Can view, edit, delete, and export Segmentations. | Yes |
Segmentations Viewer | Can view Segmentations. | Yes |
Surveys Editor | Can view, edit and delete Surveys. | Yes |
Surveys Publisher | Can view, edit, delete, and publish Surveys. | Yes |
Surveys Viewer | Can view Surveys and their evaluations. | Yes |
Custom role
While there are roles predefined by Bloomreach Engagement, you can set up your own custom roles. This allows you to add and combine several inherited roles to create a single role that would suit your specific needs. In other words, custom roles are stacked from predefined roles and inherit all their permissions and scope level.
To do so, go into theproject
-> roles
-> + Create custom role
in the right top corner. Select + Add inherited role
.
When there is a team with the same responsibilities and permissions operating the Bloomreach Engagement application, we do recommend creating a custom role. This custom role would inherit all required roles - allowing you to then only assign this single role to all team members. Furthermore, this makes it easier to see who is currently a member of this role on the Custom roleMembers
tab.
Limitations
Custom roles (user-defined) can be combined from multiple roles, but it's not possible to remove a permission from a particular role.
Removing access for users
Removing a user only removes their access. However, all analyses and campaigns they created will remain.
Identity domain
Under Access Management
> Account/Project team
, you can check who is part of your identity domain.
The identity domain serves to solve the tension between users having only one user account but access to multiple accounts and projects. When enforcing some requirements (like requiring an email and password or SSO to log in), it is unclear what policies to follow, as during the login process, it is unclear what accounts would be accessed since users have access to multiple, and these have different settings.
However, the identity domain solves this issue. When users are invited to the instance for the first time, an account is set up where they were invited as their native domain. Following this, the policies and settings from this account would apply to the user.
Currently, the identity domain supports the following settings:
- Single Sign-on
- Authentication methods
- Password settings
You can check who is part of your identity domain under Access Management
> Account/Project team
.
There is a column called Native account. If the name matches the account name, it means the user belongs to this account, and the settings apply. If there is “Other”, the user is from a different account. We do not reveal the native account of the users to other clients to avoid revealing what other accounts are on the instance.
If you need to change the native account for your user, please contact our support team.
Troubleshooting
error "Forbidden 403":
When user roles are changed, there is a small delay before the new permissions are applied. Be aware that permission changes are not applied immediately – it may take up to 1 minute to propagate changes into all components. If you are still getting the error after waiting a few minutes and reloading the application, and you think you should have access/permissions for this action, please contact our support.
Updated 10 days ago