guidewire-enterprise-rbac

# Guidewire Enterprise RBAC ## Overview Guidewire InsuranceSuite (PolicyCenter, ClaimCenter, BillingCenter) enforces role-based access at both the UI and Cloud API layers. Claims adjusters see only claims in their assigned regions. Underwriters access policy data scoped to their authority level. Admins manage user provisioning through Guidewire Cloud Console (GCC). Insurance regulations (NAIC, state DOI) require strict data classification tiers and audit trails on every policy and claim access. SAML assertions map AD groups to Guidewire roles for SSO. ## Role Hierarchy | Role | Permissions | Scope | |------|------------|-------| | System Admin | User provisioning, role config, API token management via GCC | All modules | | Underwriter | Create/bind policies, view risk data, approve endorsements | Authority-level tier | | Claims Adjuster | View/update claims, upload documents, set reserves | Assigned region/LOB | | Agent/Broker | Submit applications, view own policy status, limited billing | Own book of business | | Auditor | Read-only access to all records, export compliance reports | Organization-wide | ## Permission Check ```typescript async function checkGuidewireAccess(userId: string, resource: string, action: 'read' | 'write'): Promise<boolean> { const response = await fetch(`${GW_CLOUD_API}/admin/v1/users/${userId}/permissions`, { headers: { Authorization: `Bearer ${GW_API_TOKEN}`, 'Content-Type': 'application/json' }, }); const perms = await response.js...