Roles, permissions & approvals
Roles & permissions: What someone may do and what someone sees are two questions.
The PBM Campaign Platform keeps the two questions strictly separate. The role determines which actions someone may perform. Three visibility layers determine which customer data they see at all while doing so. Both are checked on every access – and can be explained at the push of a button.
- Admin
- Campaign Manager
- Advisers
- Insights Viewer
- Support
| Advisers | |
|---|---|
| View insights | permitted |
| Remove customer from campaign | permitted |
| Start campaign | not permitted |
- List access
- 2 lists
- Brands
- 1 · Regionalbank Musterstadt eG
- Access tags
- Region North · Private Customers team
The problem
Why do permission concepts fail in sales organisations?
Because they pack permissions and visibility into the same role. With 40 branches, you end up with 40 variants of the same role – and nobody knows any more why someone sees something.
“A separate admin role for every branch.”
One role, many visibility areas.
The role is the same everywhere; visibility narrows it down.
“The adviser sees too much – or nothing at all.”
Visibility as an intersection.
Only someone who passes all three layers sees a customer.
“Why does she have access? No idea.”
Access diagnosis.
Every visibility decision is explained layer by layer.
Visibility ≠ action
What does “visibility and action are separate” mean?
Definition
In the PBM Campaign Platform, the role answers what someone may do – such as start a campaign. Visibility answers which contacts, lists and campaigns they see while doing so. An action is only permitted if both apply.
Example
A Campaign Manager may start campaigns. If he has no access to the customer list “Life Reinvestment 2026”, he does not see the campaign – and therefore cannot start it either.
May: on · Sees: on
Customer list · Life Reinvestment 2026
Wiederanlage Leben 2026
Permitted – permission and visibility present
May: off · Sees: on
Customer list · Life Reinvestment 2026
Wiederanlage Leben 2026
May: on · Sees: off
Not visible – and therefore cannot be started.
May: off · Sees: off
Not visible – and therefore cannot be started.
| May start campaign | Sees customer list | Outcome |
|---|---|---|
| yes | yes | Permitted – permission and visibility present |
| no | yes | Campaign visible, the “Start” button is missing |
| yes or no | no | Not visible – and therefore cannot be started. |
Roles
Which roles are there in the PBM Campaign Platform?
The platform comes with standard roles as templates – those below are examples. You define your own roles yourself. Permissions are granted additively: a role only has what has been explicitly assigned to it. Roles are the same across the installation – what they apply to is decided by visibility.
| Role | Typical task |
|---|---|
| Super Admin | Setting up the installation, all permissions |
| Admin | Managing users, access, content and campaigns within their own visibility area |
| Campaign Manager | Building and managing campaigns, journeys, content and segments |
| Adviser (standard user) | Seeing own customers, using the customer card, removing customers from a campaign |
| Insights Viewer | Reading analytics, nothing else |
| Support | Mainly read-only, with access to the audit log |
| Service account | System access for interfaces, for example from the core banking system |
| AI agent | Reporting tasks; acting agents only behind human approval |
Hidden rather than greyed out
What someone may not do does not appear in the interface at all. No grey button that arouses curiosity, no menu items without a function. An adviser sees a calm interface with exactly their tasks.
Visibility
Who sees which customers?
Only someone who passes all three layers sees a customer. Visibility is always the intersection, never the sum.
-
Access to the customer list – granted explicitly for each person. Anyone without access does not see the list.
-
Brand boundary – every customer belongs to exactly one brand. Staff at one bank never see the customers of another. This boundary is hard; it applies even if an attribute further down is maintained incorrectly.
-
Responsibility – via freely definable responsibility attributes such as region, team or territory. At least one must match.
Example
Adviser Christina Reuter has access to the list “Life Reinvestment 2026”, to the brand “Regionalbank Musterstadt eG” and the responsibility “Region North”. She sees Marlene Hoffmann from Region North – but no customer from Region South and never a customer of another bank.
Approvals
Where does the four-eyes principle apply?
In two places: when a campaign is started and for content. You can tie the campaign start to a second person across the installation, per customer list or per campaign. Content is approved under the four-eyes principle by default – separately for each language version. Human approval is always preceded by the automatic compliance and tone check.
- Every approval is logged with person and time.
- Who created a piece of content and who approves it are shown separately in the log.
- Acting AI agents only work behind human approval.
- Draft
- Approved
- Active
- Paused
- Ended
- Archived
Approved · C. Reuter · four-eyes
Login & assistance
How do staff log in – and who may work on behalf of whom?
-
Registration
Via your central identity provider using single sign-on (OIDC, for example Microsoft) or with a password, optionally with passkeys. There is no self-registration: accounts are only created by invitation or via an interface.
-
Assistance
Assistants can act on behalf of an adviser – with the adviser’s visibility and permissions, but with their own login. The log records who acted on behalf of whom.
Microsoft Entra ID (OIDC) Example
Access diagnosis
Why can’t Jan Becker see the customer Marlene Hoffmann?
The access diagnosis answers exactly these kinds of questions. The platform checks layer by layer and shows where access fails – here, at the brand boundary. An AI phrases the result in plain language and suggests the next step. The decision itself is made by the rule set, not by the AI.
- Support resolves tickets without guesswork.
- Data protection can demonstrate who may see a record and why.
- Admins find configuration errors before anyone notices them.
Question: Why can’t Jan Becker see the contact Marlene Hoffmann?
Explanation generated- 1 · List access List “Life Reinvestment 2026” – access (met)
- 2 · Brand boundary Brand “Regionalbank Musterstadt” – not enabled ← this is where it fails (not met)
- 3 · Responsibility Region North (met)
For advisers
What do advisers gain from this model?
A clear view of their own customers – and their hands on the wheel. The customer card shows which campaign a customer is taking part in, what they last experienced and how warm they are. If a campaign does not fit right now, the adviser removes the customer with one click – permanently for this campaign.
Cross- & upselling with adviser handover Contract renewal & reinvestment
The fact that an adviser appears as the sender of a letter does not give her access to any data. The sender is personalisation; visibility comes solely from her user account.
Marlene Hoffmann
Campaign participations
Life reinvestment 2026Step: landing page visited
ActiveActivities
- 03 Feb 06:00Letter delivered (time-based)
- 05 Feb 18:12LP login · two-factor ✓
- 05 Feb 18:15“Tax advantage” argument read (2:40 min)
- 05 Feb 18:16Lead score 72 ↑ Sample data
Actions
Where the role model makes the difference
-
Banks & cooperative banking groups
Partner banks cleanly separated
-
Branch, dealer & franchise networks
each location sees only its own customers
-
Cross- & upselling
-
Contract renewal & reinvestment
Frequently asked questions about roles, permissions & approvals
What is the difference between role and visibility?
The role defines what someone may do in the PBM Campaign Platform, such as start campaigns or approve content. Visibility defines which customers, lists and campaigns they see while doing so. An action is only possible if both apply. Both checks run on every access.
Can an adviser see only their own customers?
Yes. In the PBM Campaign Platform, an adviser only sees customers whose list they have access to, who belong to their brand and for whom at least one responsibility attribute such as region or team matches. They never see customers of other brands.
Where does the four-eyes principle apply?
When starting campaigns and when approving content. For campaign starts, it can be set across the installation, per customer list or per campaign. Content is approved under the four-eyes principle by default, separately for each language version. Every approval is logged.
Does the PBM Campaign Platform support single sign-on?
Yes. Single sign-on runs via OIDC, for example with Microsoft. Alternatively, users log in with a password, optionally with passkeys. There is no self-registration; accounts are created by invitation or via an interface.
Can assistants work on behalf of advisers?
Yes. Assistants work with their own login on behalf of an adviser, taking on the adviser’s visibility and permissions. The log records who acted on behalf of whom.
How can you trace why someone does or does not see a customer?
With the access diagnosis. It checks customer list, brand and responsibility individually and shows at which layer access fails or why it is granted. An AI phrases the result in plain language; the decision is made by the rule set.