Enterprise Policy Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

New Exceptions APIs

Added theSearch Exceptions API andGet Exception API to retrieve and search document exceptions across Tech Risk & Compliance (TRC). The EXCEPTION and EXCEPTION_READ OAuth scopes are now available to provide access to these APIs when configuring client credentials in Global Settings. These APIs provide programmatic access to exception data, reducing the need to manually export and manipulate data for reporting or third-party tools while supporting enterprise policy exception management use cases across TRC.

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types, and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across Tech Risk & Compliance have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing. Business objectives are now a supported object in ABAC Phase 1: Foundations.

Tech Risk & Compliance also includes changes to risk permissions, risk field visibility, and the Stage advancement setting in risk workflows. Review custom roles related to risk management to make sure they continue to work as intended.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Tech Risk & Compliance (TRC), mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Unified Table Experience in Attribute Manager

Attribute Manager in Enterprise Policy Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Enterprise Policy Management objects:

  • Exception

  • Policy

  • Privacy Notice

  • Procedure

  • Standard

Standardized Attribute Export

Attribute data in Enterprise Policy Management can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following Enterprise Policy Management objects:

  • Exception

  • Policy

  • Privacy Notice

  • Procedure

  • Standard

Text Field Character Limit

Text fields in the Enterprise Policy Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following Enterprise Policy Management objects:

  • Exception

  • Policy

  • Privacy Notice

  • Procedure

  • Standard

Standard Table Experience for Attribute Options

The attribute options table in the Enterprise Policy Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. Attribute options can now be reordered, and the Workflow Approval tab displays the current-stage approvers list for greater visibility. This makes maintaining attribute options easier and simplifies future maintenance.

These enhancements will be available for the following Enterprise Policy Management objects:

  • Exception

  • Policy

  • Privacy Notice

  • Procedure

  • Standard

Enterprise Policy Management workflows: Reorder trigger groups and HTML sanitization checks

In Enterprise Policy Management workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or Send Notification actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for Enterprise Policy Management workflows on the following objects:

  • Exception

  • Policy

  • Privacy Notice

  • Procedure

  • Standard

Fixed

  • Resolved an issue that caused controls to display in every section of exported procedure, policy, and standard documents.

  • Resolved an issue that caused shared policy links to return an error when the policy name contained special characters.

Existing Public Preview Features

AI-Powered Document Analysis | Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

  • Controls

  • Risks

  • Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Permissions

  • Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Enterprise Policy Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Share Option Enhancements

The Share option is now the first item listed in the Context menu to improve accessibility for accounts with ABAC enabled. This has been updated for the following list screens:

  • Exceptions

  • Policies

  • Procedures

  • Standards

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.