Roles & Permissions
Two staff roles plus granular per-resource permissions, scoped by sub-agency.
Access control keeps staff in the parts of the system they should be in.
Roles #
Staff have one of two roles per agency:
- Admin — full access.
- Staff — access configured per resource.
Granular permissions #
A UserRole record defines per-resource permissions for a staff member, so
you can grant, say, read-only access to statements but full access to contacts.
Spatie permissions are applied per agency.
Sub-agency scoping #
The Manager scope ties a staff member to a sub-agency; queries are automatically filtered to accessible records.
Multi-agency and super-admin #
A user can belong to multiple agencies (via the agency_user pivot), and a
platform-level super-admin can bypass scoping for support. (The super-admin
panel is internal and outside this documentation.)