RBAC Matrix
12 roles defined — enforcement to be wired in Phase 5 via route guards and API middleware
Guest
guest
Unauthenticated public visitors
Customer
customer
Registered customers
Dealer
dealer
Authorized dealer staff
Service Advisor
service_advisor
Service booking and history
Technician
technician
Workshop floor technicians
Warehouse Op.
warehouse_operator
Stock intake and movements
Inventory Mgr.
inventory_manager
Full inventory + imports
Procurement
procurement_officer
Supplier and PO management
Support Agent
support_agent
Customer ticket management
Auditor
auditor
Read-only audit and reports
Admin
admin
Full system administration
Super Admin
super_admin
Platform-level access
Permission Matrix— planned, not yet enforced allowed denied
| Role | Public Site | Customer Portal | Orders | Service | Dealer Ops | Inventory | Imports | Reports | Audit Logs | Users & Roles | Settings |
|---|---|---|---|---|---|---|---|---|---|---|---|
Guest guest | |||||||||||
Customer customer | |||||||||||
Dealer dealer | |||||||||||
Service Advisor service_advisor | |||||||||||
Technician technician | |||||||||||
Warehouse Op. warehouse_operator | |||||||||||
Inventory Mgr. inventory_manager | |||||||||||
Procurement procurement_officer | |||||||||||
Support Agent support_agent | |||||||||||
Auditor auditor | |||||||||||
Admin admin | |||||||||||
Super Admin super_admin |
Implementation Plan
RBAC will be enforced in Phase 5 using: (1) React route guards checking user.role against a permissions map, (2) entity-level read/write filters using created_by_id scoping, and (3) backend function middleware validating base44.auth.me().role before mutations.