---
title: Define document sharing permissions
description: Controls who can view, edit, or manage a document using the Document Management system in Third-party Risk Management \(TPRM\).
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/third-party-risk-management/tprm-doc-share-permissions.html
release: australia
product: Third-party Risk Management
classification: third-party-risk-management
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [TPRM, document permissions, sharing permissions, access control]
breadcrumb: [Use the Document Management System, Third-party Risk Management, Governance, Risk, and Compliance]
---

# Define document sharing permissions

Controls who can view, edit, or manage a document using the Document Management system in Third-party Risk Management \(TPRM\).

## Before you begin

Role required: sn\_vdr\_risk\_asmt.vendor\_assessor

## About this task

Sharing permissions define which users or groups can view, edit, or manage a document. You can apply user criteria, individual users, or groups for granular control.

-   If permissions don’t apply correctly, review user criteria or group membership.
-   If you can’t edit permissions, request access from the document owner or administrator.

## Procedure

1.  Navigate to **Workspaces** > **Vendor Management Workspace**, select the list icon \[Omitted image "ws-list-icon.png"\] Alt text: and then navigate to **All Documents**.

2.  Select the document record that you want and then the **Versions** tab.

3.  Locate the **Sharing permissions** field.

4.  Select the type of permission control:

    -   **User Criteria Permissions** – Apply conditions based on roles or attributes.
    -   **User Permissions** – Add individual users.
    -   **Group Permissions** – Assign access to groups.
5.  Specify whether users can **View**, **Edit**, or **Manage** the document.

6.  Select **Submit** to save changes.


## What to do next

Verify that permissions work as expected by checking access from a user account with restricted rights.