RAM: Relationship Authorisation Manager

Relationship Authorisation Manager (RAM) records who can act online for your practice or a business client using their myID. Link the ABN, authorise each person and set their ATO permissions in Access Manager before they start work.

What RAM Controls for a Practice

RAM connects a person’s digital identity to the business they can represent. Your practice uses that authorisation to reach Online services for agents. A business client needs RAM access before entering Online services for business.

A myID proves who the person is. The RAM authorisation records which business they can act for and which participating services they can access.

RAM role	What the person can do
Principal authority	Link the business and authorise others, based on their recognised responsibility for it.
Authorisation administrator	Create and manage other people’s authorisations.
Authorised user	Use the services granted to them for the business.
Machine credential administrator	Create and manage credentials used by business software.

A machine credential is a software credential. The machine credential administrator is the person responsible for creating or managing it. Giving a staff member that role does not itself install a credential in your tax software.

Use RAM’s role and authorisation guidance to choose the person’s role. Give administrator roles only to people who need those powers.

RAM and ATO Access Manager Permissions

RAM grants the business authorisation. ATO Access Manager manages the detailed ATO permissions that apply to authorised staff and software. Both services remain part of setting up practice access.

The ATO’s Access Manager guidance directs you to customise permissions after the person accepts their RAM authorisation. Principal authorities and authorisation administrators have Access Manager administrator access. That role carries broad powers, so an administrative job title alone is no reason to grant it.

For a staff member whose tasks must be limited, follow this order.

1. Create or review the person’s RAM authorisation for the practice ABN. Grant ATO access with Custom permissions instead of Full access.
2. Have the person accept the authorisation using their own myID.
3. Sign in to Access Manager as the principal authority or authorisation administrator. Open Manage permissions and select the staff member.
4. Assign the relevant registered agent number and only the permissions their job requires. Save the changes.
5. Ask the staff member to sign in to Online services for agents. Confirm the practice and intended client list are available.

Check your existing staff-access procedure against both records. A RAM invitation marked accepted proves the person has accepted the authorisation. It does not prove that a Custom user has every permission needed for their job.

Record the tasks you intended to allow beside the saved permissions. Confirm the staff member can reach the required reports and that lodgment permissions remain disabled where their role excludes lodging.

Setting Up the Practice in RAM

The practice’s principal authority links its Australian Business Number (ABN) before adding staff. Online linking requires a Strong myID and matching Australian Business Register (ABR) details.

If you cannot reach Strong identity strength or cannot link online, the alternative linking route requires at least Standard. Use the myID guide for identity setup.

Link the Practice ABN

1. Sign in to RAM with your own myID. Select Link my business and consent to the ATO business lookup.
2. Enter your personal postal or residential address as held by the ATO. Select the practice business from the results.
3. Enter an email address you can access. Request the email verification code, enter it and continue.
4. Review the business summary and complete the required declarations and consent. Submit the link.
5. Confirm RAM shows the practice as successfully linked before creating a staff authorisation.

These steps follow RAM’s online business-linking instructions.

Invite the Staff Member

1. In RAM, open View or manage authorisations, machine credentials and cloud software notifications. Select the practice business, then Add new user.
2. Enter the staff member’s name exactly as it appears in their myID. Use a business email address that only they can access.
3. Choose Standard user for a staff member with Standard or Strong identity strength. Grant the required ATO access and choose administrator roles only where needed.
4. Send the request. The staff member signs in to RAM, selects Accept an authorisation for a business and enters the emailed authorisation code.
5. Have the staff member review the summary, complete the consent declarations and select Accept. Finish their Custom ATO permissions in Access Manager.

The invitation code expires after seven days. A principal authority or authorisation administrator can reissue an expired pending code.

A Two-Person Practice Example

In this fictional practice, the principal lodges returns and one admin adds clients and downloads client-list reports. The admin needs Standard or Strong myID, an Authorised user role and Custom ATO access.

The principal leaves the RAM authorisation administrator and machine credential administrator roles off for the admin. In Access Manager, the principal grants access to the relevant agent number and the client-management and report permissions needed for those tasks.

The ATO permission list separates Add/Delete client and View client reports from return-lodgment permissions. Add/Delete client also permits deletion, so assess that wider power before assigning it. Leave Lodge permissions off and grant only the necessary viewing access.

The expected result is that the admin can access the intended client list and download its reports. The principal retains lodging and access-management responsibility. Confirm these permissions before the admin handles a new client.

Remove a departing staff member’s RAM authorisation on the day they leave. Review remaining authorisations and ATO permissions each quarter as a practice procedure. Check role changes immediately instead of waiting for that review.

Getting a New Business Client Through RAM

A company, trust, partnership or self-managed super fund (SMSF) client needs its ABN linked in RAM to reach Online services for business. That access lets the client nominate your practice where client-to-agent linking applies.

The client completes the nomination. Your practice can explain the steps, but your own RAM authorisation for the practice does not link the client’s business.

Client entity	Person to identify before linking
Company	An eligible director or public officer recorded as an individual associate for the ABN.
Partnership	An eligible individual partner recorded for the partnership ABN.
Trust with individual trustees	An eligible individual trustee recorded for the trust ABN.
Trust with a corporate trustee	A director or public officer of the corporate trustee, using the primary-person route where the ABR has no individual associates.
SMSF	An eligible individual trustee, or a director of its corporate trustee through the applicable linking route.

RAM relies on recorded authority. An individual associate linking online must appear on the ABR and have a matching name. A primary person can use the assisted route with their role supported by the relevant register.

Ask these questions in your onboarding form.

• Who is the principal authority for this ABN, and what is their role?
• Do they have myID, and what identity strength does it show?
• Are the ABR associates current, and does the person’s recorded name match their myID?
• Has the person already linked this ABN in RAM?
• Does a corporate trustee require the alternative linking route?

If an eligible individual associate is missing or recorded incorrectly, online linking cannot match them. Correct the ABN details first. A client unable to access ABR online services can contact the ABR, use its form route or ask an authorised tax professional to update details.

A corporate trustee with no individual associates needs the primary-person route, even when its records are correct. The corporate trustee guide explains who acts for that arrangement.

Once RAM access works, follow the business nomination steps for nomination. For individuals and sole traders, use the separate agent nomination guide instead of treating every client as an ABN-entity nomination.

Machine Credentials for Practice Software

A machine credential lets compatible tax software communicate with government services through Standard Business Reporting (SBR). Desktop or locally hosted software connecting directly can use it to lodge and download information within its permissions.

First identify the connection method. Some desktop products use a sending service provider, so desktop installation alone does not mean your practice needs its own credential.

A principal authority or machine credential administrator can create a credential. Follow RAM’s credential-creation instructions.

1. Install and enable the official browser extension for your operating system. Use the supported Chrome or Firefox browser.
2. Sign in to RAM and select the practice business. Open Manage credentials, then Create machine credential.
3. Set the keystore location and password. Enter a recognisable credential name and review the recorded custodian.
4. Confirm the details and download the credential. Configure your tax software to use the keystore through its documented installation steps.

RAM creates a credential with full permissions. A newly created credential has no access to business appointments. When custom ATO permissions are needed, a principal authority or authorisation administrator follows the ATO’s business-software instructions.

1. Set the machine credential’s Agency access to Custom in RAM.
2. Complete the ATO’s required single test lodgment through your SBR-enabled software, following the software’s documented setup. This registers the credential in Access Manager before permissions can be edited.
3. In Access Manager, select Manage permissions. Search for the credential name in Family Name, or filter by Device or Machine, then select the credential.
4. Add or remove the intended permissions and select Save.

After first use, assign any required business-appointment access under Whose business I can access in Access Manager. Select the intended credential and appointment access, then Save. Include this check when replacing a credential.

A credential is valid for two years. In RAM’s Manage credentials area, inspect Status and the Valid to field. Use the software’s renewal function if available. Otherwise create a replacement before expiry using the same credential name, install it and check access before revoking the old credential.

Follow RAM’s credential management guidance. Removing a custodian’s personal authorisation can leave a credential unassigned and temporarily active. Claim or revoke that credential separately when a custodian leaves.

For cloud-hosted SBR software, the provider generally holds the machine credential. Under the ATO cloud authentication model, your practice notifies the ATO of the provider and its supplied Software ID in Access Manager.

RAM’s My cloud software services notification applies to participating agency services. For ATO hosted-software notification, use Access Manager as directed by the ATO’s software connection guidance. Match your software’s documented connection method before creating a local credential or submitting a notification.

RAM Errors and Who Fixes Them

Check identity strength and recorded authority before changing permissions. A business-linking failure and an accepted staff authorisation with missing ATO permissions need different fixes.

Symptom	Check and fix	Who acts
Insufficient identity strength	Online principal linking needs Strong. Use the supported Standard alternative route when online linking is unavailable. Staff need the strength required by their service.	The principal or staff member updates their myID. The ATO assists with the alternative business link.
No eligible business found	Check the person’s eligible associate role and name against the ABR. Correct stale details before retrying. A corporate trustee can require assisted linking.	The client corrects its records through the ABR route. The ATO handles assisted RAM linking.
Expired or unusable invitation code	Check its seven-day period, exact case and the name in the request. Reissue the pending code or correct the name and send a new request.	The practice’s principal authority or authorisation administrator, with the staff member accepting it.
Declined authorisation	Review why the person declined and whether the business and access were correct. Create a new request with the agreed access for them to accept.	The authorising principal or administrator and the intended user.
Accepted authorisation, but reports unavailable	Check ATO access and Custom permissions for the correct agent number. Grant the required report access without adding unrelated lodgment rights.	The practice’s Access Manager administrator.

A personal myGov-to-ATO linking code belongs to individual online access. It is separate from the RAM authorisation code used to accept a business invitation.

If matching records and the correct identity strength still do not resolve the business link, use RAM’s assisted linking service. Keep the business ABN and error message ready, then confirm the business appears in RAM before retrying the intended ATO task.