Configure Navan admin roles, travel policies, approval workflows, and department-level access controls.
Use when setting up enterprise RBAC, policy enforcement, or approval chains in Navan.
Trigger with "navan rbac", "navan roles", "navan travel policy", "navan approval workflow".
allowed-tools
Read, Write, Edit, Bash(npm:*), Grep
version
1.7.0
license
MIT
author
Jeremy Longshore <jeremy@intentsolutions.io>
tags
["saas","navan","travel"]
compatibility
Designed for Claude Code
Navan Enterprise RBAC
Overview
Navan's enterprise tier provides granular role-based access control, configurable travel policies, and multi-tier approval workflows. The platform enforces in-policy vs out-of-policy bookings at the point of purchase — travelers see policy-compliant options highlighted and must justify out-of-policy selections through approval chains. This skill covers the admin role hierarchy, policy rule configuration, department-scoped access, and API-driven policy management.
Prerequisites
Navan enterprise account with Global Admin or Travel Admin access
OAuth 2.0 credentials with admin-scoped permissions (see navan-install-auth)
Organizational hierarchy defined (departments, cost centers, reporting lines)
Dedicated Customer Success Manager contact (included with enterprise tier)
Instructions
Step 1: Understand the Navan Role Hierarchy
Global Admin
├── Travel Admin — Manage travel policies, view all bookings
├── Expense Admin — Manage expense policies, approve/reject reports
├── Finance Admin — View spend analytics, export financial reports
├── Department Manager — Approve bookings/expenses for direct reports
├── Arranger — Book travel on behalf of other employees
└── Traveler — Book own travel within policy, submit expenses
// Bulk role assignment for department onboardingasyncfunctionassignDepartmentRoles(departmentId: string,
userEmails: string[],
role: string): Promise<void> {
for (const email of userEmails) {
const res = awaitfetch('https://api.navan.com/v1/users/role-assignment', {
method: 'POST',
headers: {
'Authorization': `Bearer ${accessToken}`,
'Content-Type': 'application/json'
},
body: JSON.stringify({
email,
role,
department_id: departmentId,
effective_date: newDate().toISOString()
})
});
if (!res.ok) {
console.error(`Failed to assign ${role} to ${email}: HTTP ${res.status}`);
} else {
console.log(`Assigned ${role} to ${email} in dept ${departmentId}`);
}
}
}
// Example: onboard engineering managersawaitassignDepartmentRoles('dept-eng-001', [
'manager1@company.com',
'manager2@company.com'
], 'department_manager');
Step 5: Audit Role Assignments
# List all users with admin roles
curl -s -H "Authorization: Bearer $NAVAN_ACCESS_TOKEN" \
'https://api.navan.com/v1/users?role=admin&limit=100' | python3 -m json.tool
# Get policy violations report
curl -s -H "Authorization: Bearer $NAVAN_ACCESS_TOKEN" \
'https://api.navan.com/v1/reports/policy-violations?start_date=2026-01-01' \
| python3 -m json.tool
Output
A fully configured RBAC system with department-scoped travel policies, multi-tier approval workflows, and role assignments for the organizational hierarchy. Travelers see policy-compliant options at booking time, out-of-policy requests route through the approval chain, and admins have audit visibility into policy violations.
Error Handling
Error
Code
Solution
Insufficient admin permissions
403
Requesting user needs Global Admin or Travel Admin role
Department not found
404
Verify department_id exists; create via admin dashboard first
Conflicting policy rules
409
Two policies targeting the same department; deactivate the old one first
Invalid approval chain
400
Ensure tier order is sequential and approver_type values are valid
User not found
404
Verify email matches an active Navan user; check SCIM sync status
Navan Integrations — SCIM and directory sync for automated role management
Next Steps
After configuring RBAC, see navan-security-basics for SSO/SAML enforcement and credential hardening, or navan-observability for monitoring policy compliance and booking patterns.
