Keeping sensitive records sensitive

A record's business unit decides who can see it, and Also visible to can share it with other units. Within those units, a record's classification and privilege narrow who can read it, and each person holds their own grants for Confidential and Privileged records. This article walks through each layer as the Risks, Incidents and Settings & Team guides describe it.

Every record is owned by an organisational unit in your organisation's hierarchy, which starts at Whole Business. Owners and admins assign people to units, and a Public record is visible to everyone who can see its unit.

Also visible to shares a record with other business units. On risks and incidents, only owners and admins can set it. The units it is shared into can view and link to the record, but only the owning unit can edit it. Opening a risk or incident shared into your unit shows Make your own, which opens a pre-filled form for your own copy to propose.

To be named under Restricted to, a person must hold the Confidential or Privileged grant and have access to the record's unit. No role, grant or sharing widens access beyond that list. See Highly sensitive in the glossary.

Privilege marks a record as legally privileged, separately from its classification. On the Incidents register, for example, a Privileged incident is visible only to people who hold Privileged access.

The grants apply across the whole organisation, and to owners too: an owner without the Confidential grant cannot open Confidential records. Forms that set a record's level offer Confidential and Highly sensitive only if you hold the Confidential grant, and Privileged only if you hold the Privileged grant. You can check your own grants on User Profile, under Classification access and Privilege level.

Reports count every record in scope, whatever the grants of the person running them. A Confidential or Privileged record is also named there by its classification only, with no title or detail.

The AI assistant never sees Confidential, Privileged or Highly sensitive records, for any user, including owners and people who hold Confidential or Privileged access. The same applies to the AI Narrative block on the Reporting Canvas. See What it can never see.