Settings & Administration - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

ABAC Phase 1: Foundations is available for supported objects across AI Governance, Privacy Automation, Tech Risk & Compliance, and Third-Party Management, and introduces the following core capabilities to manage record-level access and collaboration:

Assignments

Leverage out-of-the-box or custom assignments, which are sets of permissions that define what users can do on a record. Assignments can be applied through record sharing or inherited through user attributes and workflow stages to automatically grant record-level permissions for owners, approvers, reviewers, and other users involved in the record lifecycle.

Sharing, Requesting & Managing Access

Share individual records directly with users, request access to records, review who currently has access, and modify or revoke access as needed.

Record-Level Auditing

Review audit history for record access and assignment configuration changes to understand what changed, who made the change, and when the change occurred.

Reporting

Column reports, PDF reports, and report schedules respect ABAC assignments across all object types included in ABAC Phase 1.

Record Admin Access Rules

Configure record-level admin access rules across all supported object types, and optionally leave the record admin attribute empty.

System Assignments

All system assignments are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

At General Availability, all supported objects have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments. ABAC is enabled in all tenants regardless of packaging and pricing, and customers who used share modals in Data Mapping Automation are migrated to the new sharing experience automatically.

ABAC helps organizations manage access more precisely by aligning permissions to records and assignments rather than relying on increasingly complex role structures. This enables granular record-level access control, improves governance, and simplifies collaboration across teams and workflows. With this enhancement, administrators can reduce access-management complexity while strengthening security and accountability across the OneTrust Platform.

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

OneTrust Activity Log

Gain a unified, real-time view of user and system audit events across the OneTrust Platform with the Activity logs screen to increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis. The General Availability release includes the following additional enhancements for this feature:

  • Capture changes or movement on platform-level events such as domains, languages, localization edits, emails, and more.

  • The Activity log screen now opens with a 30-day filter applied by default, and a notification banner lets you know the filter is active so you can adjust the date range as needed. Pagination has also been improved for faster performance and load times.

  • Integration events are now captured in the audit record, with activity payloads and message formatting standardized across Global Activity and integration events for more consistent, traceable audit data.

  • Process agent actor information in all audit exports and downstream integrations so that all your work receives a consistent and complete picture of agent-initiated activity.

  • Captures the network context for events, such as original caller's IP address and device details for actions performed, to identify the actual source system and support incident investigation and compliance reviews.

  • Document download and file attachment events are recorded during exports and bulk actions to understand what actions were performed and maintain audit evidence.

  • Activity information is also available in the activity tabs of supported and subscribed product areas, such as users, organizations, risks, and more. In these areas, you can filter an entity's activity by event type when the option is available.

  • The standardized Activity Record Created event is now available for sending audit information to SIEM tools with a supported OPenAPI spec for use. The existing, renamed Activity Record Created (Legacy) event is still supported and will be deprecated in the Spring '27 Release. For more information, see Integrating OneTrust Activity Logs with External SIEM Tools.

For more information, see OneTrust Activity Log.

Copy Assignments to Sandbox

Assignments are now copied from the parent tenant to a sandbox during sandbox creation or refresh. The copy includes seeded and custom assignments, as well as user-attribute and workflow-stage approval assignment mappings. After the copy, you can create additional assignments directly in the sandbox, helping you test assignment-dependent workflows in an environment that more closely reflects the parent tenant. This enhancement applies to sandboxes created after the 202609.1.0 release. If your sandbox was created before that release, refresh it before creating assignments.

For more information, see Sandbox Management Overview.

Unified Table Experience in Attribute Manager

Attribute Manager now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

  • AI Governance

  • Audit Management (Public Preview)

  • Data Catalog (Public Preview)

  • Data Mapping Automation

  • Enterprise Policy Management

  • Incident Management (Public Preview)

  • Issues Management

  • IT Risk Management

  • Third-Party Due Diligence

  • Third-Party Risk Management

Standardized Attribute Export

OneTrust now provides a standardized export experience for attribute tables across any product using Attribute Manager. This gives administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

  • AI Governance

  • Audit Management (Public Preview)

  • Data Catalog (Public Preview)

  • Data Mapping Automation

  • Enterprise Policy Management

  • Incident Management (Public Preview)

  • Issues Management

  • IT Risk Management

  • Third-Party Due Diligence

  • Third-Party Risk Management

Text Field Character Limit

Text fields across all Attribute Managers now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences. Previously, limits of about 1,000 characters truncated responses for complex workflows such as AI governance and legal risk assessments.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

  • AI Governance

  • Audit Management

  • Data Catalog

  • Data Mapping Automation

  • Enterprise Policy Management

  • Incident Management

  • Issues Management

  • IT Risk Management

  • Third-Party Due Diligence

  • Third-Party Risk Management

  • Universal Consent & Preference Management

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table now uses the standard OneTrust table, providing a consistent, standardized table experience across the platform. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

This enhancement will be available for the following products, refer to their release notes for impacted objects:

  • AI Governance

  • Audit Management

  • Data Catalog (Public Preview)

  • Data Mapping Automation

  • Enterprise Policy Management

  • Incident Management (Public Preview)

  • Issues Management

  • IT Risk Management

  • Third-Party Due Diligence

  • Third-Party Risk Management

Reorder Workflow Trigger Groups and Check Rule Content for Unsafe HTML

Administrators can now reorder trigger groups in workflows to control the sequence in which rules run, making workflow execution more predictable. When creating rules with Create Task or Send Notification actions, HTML sanitization checks now help keep task and notification content safe. Together, these updates give administrators more consistent, manageable control over workflow automation across OneTrust products.

This enhancement is available for workflows in the following products. Refer to each product's release notes for the impacted workflows:

  • AI Governance

  • Audit Management

  • Enterprise Policy Management

  • Incident Management

  • IT Risk Management

Mention Users and In-App Attachment Notifications with Attribute-Based Access Control (ABAC)

Users with assignment-based access can now take part in comments and mention other users when they have the access ability to comment. They can also download eligible export attachments from in-app notifications when they are authorized. Permissions are checked throughout, including after an assignment or export permission changes, so customers get a more consistent experience without access extending beyond its intended boundaries.

This enhancement is available for all ABAC-supported objects in the following ABAC-adopted solutions:

  • AI Governance

  • Privacy Automation

  • Tech Risk & Compliance

  • Third-Party Management

New Roles APIs

Added the Get List of Roles API and Get Role API to retrieve system and custom roles available in the tenant, with the new ROLE_READ OAuth scope providing read access to these APIs. These APIs provide an authoritative way to discover and validate tenant roles, reducing reliance on manual role ID retrieval for user provisioning, access reconciliation, and other access management workflows.

Fixed

  • Resolved an issue that prevented the names of custom attribute options added during entity creation from displaying on the Attribute details screen.

  • Resolved an issue that prevented the assignment name from updating in the page title until the record was saved or activated.

  • Resolved an issue that caused incorrect operators to display in Project rule conditions for array-type values.

  • Resolved API documentation issues to properly reflect parameter requirements across various Access Management, Documents, and SCIM APIs to align with actual API behavior.

  • Tasks created on an issue now automatically inherit the organization of the parent issue record.

  • Resolved an issue that caused a 403 error to display when ABAC users attempted to delete attachments.

  • Resolved an issue that prevented the user list from loading when multiple organization filters were applied.

  • Resolved an issue that prevented email attachments from being included in notifications when using a Microsoft Exchange SMTP connection.

New Public Preview Features

Platform-Consistent Table Experience for Tasks

The Tasks table now offer the same table experience as other tables across the platform. Users get consistent behavior when moving between tables, along with core functionality such as sorting and filtering. This improves usability and interface consistency, reduces friction, and delivers the modern, reliable table experience users expect.

Existing Public Preview Features

Privacy Risk Agent |Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

  • Task Add Attachment

  • Task Add Comment

  • Task Created

  • Task Deleted

  • Task Remove Attachment

  • Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Platform Enhancements

Customize Global Header Navigation

Apply your organization's branding to the Global header navigation, including the popover, using Application Branding in Global Settings. This enhancement extends your branding beyond the platform logo for a consistent experience across the platform.

For more information, see Application Branding Settings.

Improved Global Font

OneTrust has updated the font used throughout the platform to improve readability, visual consistency, and the overall user experience. This is a visual enhancement only and does not affect platform functionality or workflows.

Things to Know

AI Features on by Default for New Customers

As of the OneTrust 202611.1.0 release, AI Features in General Availability will be turned on by default for new customers outside of the EU and UK. EU, UK, and dedicated environments are not impacted and will remain on an opt-in model. This enhancement promotes visibility and usage of OneTrust AI Features for eligible environments without prior configuration.

For more information, see Managing AI Features in the OneTrust Platform.

Get Help Links to New Documentation Hub

The Get Help menu in the OneTrust platform now directs users to the Documentation hub of myOneTrust.

Global Search + ABAC

Global Search now supports searching for items based on explicitly tagged users and user groups granted access through Attribute-Based Access Control (ABAC).

Legacy Sharing vs. ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options.

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders. If you are ready before your environment is upgraded, please contact OneTrust Support.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.