Purpose and Scope
This document provides Recommended Secure Configuration guidance for top‑level administrative accounts in the TRM Labs platform in compliance with FedRAMP Revision 5 Recommended Secure Configuration requirements FRR‑RSC‑01; FRR-RSC-02; and FRR-RSC-09.
Per FedRAMP guidance, all linked information below is publicly accessible at https://support.trmlabs.com.
Top-level administrative account role definitions
The TRM Labs Platform implements role-based access control for customers to implement least-privilege and separation of duties for their tenant. Specifically, the platform provides three user roles.
Administrator: Users with this top-level administrative role can perform all the same operations as users authorized for the Owner role. Additionally, users with this role can add or remove the Administrator role for other users. They may also use the Bulk User Management feature. Administrators have full control over the parent customer environment and all child environments group
Owner: Users with this privileged role are authorized to perform sensitive operations in addition to operations authorized for the default, unprivileged Collaborator role. Users with the Owner role can manage users (but cannot assign the Administrator role); manage organization settings; manage API keys; manage configuration of the Risk Engine, if enabled; and access Audit Log.
Collaborator: Users with this default role are not authorized for any administrative or privileged operations in the platform. This role allows users to create graph visualizations, examine specific blockchain transactions and entities with Block Explorer, and utilize other features for applicable blockchain intelligence use cases.
Admin account lifecycle procedures
As part of the Palantir Federal Cloud Service – Supporting Services (PFCS-SS), all customers must integrate their identity provider with the Palantir Apollo’s authentication service to securely manage credentials and multi-factor authenticators. The TRM Labs Platform does not permit customers to manage the administrative account lifecycle outside of the Apollo platform with the customer’s identity provider.
Table of all admin-controlled security settings and risks
Only authorized platform operators from TRM Labs Platform control security settings and have authorization to select values other than the secure defaults. Customer users with the Administrators and Owners role still cannot change security settings for their organization directly. Customers may open a support ticket to contact the platform operations team and inquire about these settings and possibly request changes from secure defaults.