Ariath glossary: Access Control
The set of rules and mechanisms that decide who, or what, can view, change or act on data and system resources. It typically combines identifying the user, deciding what that user is permitted to do, and enforcing that decision each time a request is made.
In brief
- What it does
- Decides who can view or act on data and systems, and enforces that decision each time.
- How it differs from authentication
- Authentication confirms who someone is. Access control decides what that person can do.
- What it needs in a wealth management firm
- Defined roles, least-privilege permissions, regular reviews, and records of who accessed what.
How it works
How access control works
Access control generally follows the same sequence each time a user, or a connected tool, asks to use a resource:
Identify the requester
The system establishes who or what is asking, such as a signed-in user or a connected application.
Check permissions
The request is compared with the rules for that requester, such as their role, the data involved and the action they want to take.
Allow or deny
The system grants what the rules permit and refuses the rest.
Record the decision
The request and its outcome are logged so they can be reviewed later.
The rules are set by the firm, and they are only as useful as they are current. When a person's role changes, their permissions need to change with it.
Access control works when permissions are checked every time a request is made, not only when someone first signs in.
Comparison
Access control vs. authentication
The two terms are often used together. They answer different questions.
Authentication
Verifies the identity of a user or system, for example with a password and a second verification step. It does not decide what the verified user may do.
For example
Confirms that the person signing in is a specific advisor.
Access control
Decides what a verified user is permitted to view or change, based on rules such as role, type of data and type of action.
For example
Lets an operations team member open account paperwork while restricting other client notes.
Both are needed. Authentication establishes who is asking, and access control decides what that person can do.
In practice
Access control examples in wealth management
Wealth management firms hold client data across a CRM, custodian and planning tools. Access control shapes who can reach it. These examples are illustrative.
Role-based permissions
Giving advisors, operations staff and compliance staff access to the client data their work requires.
Client-level restrictions
Limiting a household's records to the team that services it.
Connected applications
Setting which data a connected tool can read from the CRM, custodian or planning system.
AI workflow access
Deciding which users can run an AI workflow, and which data the workflow can use on their behalf.
Access reviews
Checking periodically that permissions still match people's current roles.
When AI tools connect to those systems, the same question applies: whose permissions govern what the AI can see? The firm decides, and it records those decisions in its own policies.
What it needs
What access control needs to work
Access control is only as strong as the practices around it. Firms typically put the following in place:
- Defined roles and permissions
- Least-privilege defaults
- An approval process for changes to access
- Regular access reviews
- Logging of access and changes
- Prompt removal of access when roles change
These are firm decisions, set in line with the firm's own policies. Confirm the specifics that apply to your firm with your compliance lead or counsel.
In Ariath
Ariath documents role-based access that is checked for the specific user before connected data reaches a model, scoped to the user and workflow.
Common questions
Frequently asked questions about access control
What is role-based access control?
Role-based access control grants permissions according to a person's role, such as advisor, operations or compliance, instead of assigning them person by person.
Does access control apply to AI tools?
It can. When an AI tool connects to firm data, firms typically ask whose permissions apply to what the tool can retrieve and use.
Is access control the same as authentication?
No. Authentication verifies who someone is. Access control decides what that verified person is allowed to do.
This entry is educational. It is not legal or compliance advice and does not guarantee regulatory compliance. Confirm the requirements that apply to your firm with your compliance lead or counsel.
Give AI the context it needs to act
Ariath connects your CRM, custodian and planning tools into one governed context, with your firm in control of how data is accessed and used.