Core concepts
Roles and permissions
Access is granted through roles, and every permission is an explicit entity::action pair.
Permission format
Every permission is written as entity::action — for example form::publish or submission::approve. Each area has a wildcard, such as member::*, that grants every action in it. Nothing is implied silently.
Permission areas
| Wildcard | Actions |
|---|---|
| association::* | view · update · delete · settings · branding · policies · domains · sudo |
| member::* | create · view · list · update · delete · import · export · tag · fields · status |
| unit::* | create · view · list · update · delete · roster · officers |
| role::* | create · view · list · update · delete · assign · revoke |
| form::* | create · view · list · update · delete · publish · archive |
| submission::* | view · list · review · approve · reject · delete · export |
| event::* | create · view · list · update · delete · publish · invite · register · ticket |
| attendance::* | mark · checkin · view · export |
| finance::* | view · list · dues · donations · subscription · invoice · refund |
| notification::* | send · templates · preferences · audit |
| report::* | view · create · export · schedule |
| website::* | view · edit · publish · theme |
| task::* | create · view · list · update · delete · assign · project |
| governance::* | view · election · vote · results · motion |
Roles
A role is a named set of permissions, scoped to one association. Platform preset roles sit alongside the custom roles an association creates; presets can't be renamed or deleted. Assigning and revoking roles needs role::assign and role::revoke.