Functional actor,Required duties,Restriction / independence,Related cases,Assigned account reference,Selected profile,Tenant / domain,Verified by/date,Result
IAM configuration maker,"IAM masters, assignments, mappings; create and submit",No own approval; no automatic tenant-wide administrator grant,IAM-01; R1-S01; R1-S02,,,,,Not run
IAM independent checker,Read proposed/current access and decide eligible rows,Different identity from maker/affected beneficiary where required,IAM; R1-S01,,,,,Not run
Axis owner / independent reviewer,Inspect and decide owned mappings; publish eligible experience,Owner approval and independent decision may require separate participants,AXIS; R1-X03,,,,,Not run
Core / reference steward,"Manage parties, references, controlled model proposals",Business identity creation does not grant IAM access,CORE,,,,,Not run
Tenant maker / commercial administrator,"Onboarding, evidence, configuration and subscription proposals",Registration does not authorize lifecycle execution,TENANT,,,,,Not run
Tenant/TCP reviewer and operator,"Eligible owner review, readiness checks, environment/lifecycle operations",Operator scope limited to assigned tenants,TCP; R1-X01,,,,,Not run
Data / Studio maker,"Supported source/dataset authoring, report/dashboard/template authoring, preview and submit",No self-review; use only authorized sources and fields,VISTA; PULSE,,,,,Not run
Data / content checker,Current saved preview and eligible row decisions,Separate identity; review does not imply execute/send authority,VISTA; PULSE; R1-S08,,,,,Not run
Scheduler maker / reviewer / operator,"Governed jobs/schedules and authorized runs, cancellation/recovery",Run as identity separately authorized; review and execution are distinct,SCHEDULER,,,,,Not run
Scheduler service identity,Execute exact registered operations with required dataset permissions,No interactive credential sharing; expiry/revocation checked,R1-S06,,,,,Not run
Custodia custodian / reviewer,"Capture, metadata, evidence review and authorized custody actions","Classification, retention and legal holds constrain actions",CUSTODIA,,,,,Not run
MEDES business roles,Member/case/evidence/correspondence duties under approved MEDES grants,Missing grants currently block the recorded production profiles,MEDES; R1-G02,,,,,Not run
Nexora author / reviewer / learner,"Content governance, assigned learning, assessment/completion",A learner is not a publisher; viewing is not completion,NEXORA,,,,,Not run
Reader / denied-context tester,Read only assigned data; deliberate negative control account,Must lack tested mutation or other-domain permission,R1-S02; R1-S03; R1-S04,,,,,Not run
Release / UAT / operations owners,"Confirm baseline, run evidence, triage and sign-off",Named owners to be assigned in workbook; signatures are not prefilled,R1-O01; R1-O02,,,,,Not run