The Alumni Roles and Permission Matrix

1. Purpose

This document establishes Univerza requirements and operating expectations for The Alumni Roles and Permission Matrix, with clear ownership, approval, implementation, and auditable evidence.

2. Scope

This document applies to The Alumni product, its teams, systems, administrators, contracted institutions, service providers, and related data. It shall be applied together with the corporate documents referenced in the metadata.

3. Principles and Requirements

1. Map Alumni roles and institutional/class/group scopes to view, edit, import, export, messaging, administration, and audit permissions.
2. The Document Owner shall maintain documented processes, assigned responsibilities, proportionate controls, and traceable approvals for this subject.
3. Product, System, and Data Owners shall implement the requirements within their scope and shall not reduce the corporate baseline without approved risk acceptance.
4. Material decisions, changes, exceptions, incidents, and reviews shall be recorded and retained as evidence.
5. Controls shall be reviewed after material legal, contractual, organizational, product, system, vendor, or risk changes.

4. Roles and Responsibilities

• Document Owner — The Alumni Product Owner: Maintains the content, implementation, measurement, and review of this document.
• Approver — Information Security Lead: Approves the effective version and accepts any documented residual risk.
• Product/System/Data Owners: Implement requirements and maintain evidence within their respective scope.
• Risk, Privacy, Security, and Legal: Advise, review, challenge, and escalate deficiencies according to their mandates.
• Personnel and contractors: Comply with the requirements, report incidents, and do not bypass controls.

5. Minimum Evidence

• Approval record and document change history.
• Related exception, risk, and remediation records.
• Evidence of applicable communication, training, or acknowledgement.
• Logs, registers, reports, or test results showing that requirements operate in practice.

6. Exceptions and Non-compliance

Exceptions shall follow UNI-GOV-007 and document the rationale, risk, compensating controls, approver, and expiry date. Non-compliance shall be recorded, impact-assessed, and tracked to remediation.

7. Production Readiness Gate

• ☐ The Document Owner has verified accuracy and alignment with actual operations.
• ☐ Privacy, Security, Legal, or Risk review has been completed as applicable.
• ☐ The metadata approver has approved the document and assigned an effective date.
• ☐ approval_status=approved, target_environment=production, and production_eligible=true.
• ☐ Affected parties have been informed or trained and evidence has been linked.

8. Review

Review at least annually and following any material legal, contractual, organizational, product, system, vendor, or risk change.