Roles and permissions
A role is a named set of permissions, the same in every tenant. A person holds one role per tenant they belong to, and the two say nothing about each other. Permissions are worked out from the person's user on every request, so a role change applies on their next call, with no sign-out.
The roles
| Role | Type | Reaches |
|---|---|---|
participant | participant | Their own records: profile, user sequences and journeys, responses, readings, chats, data export. The apps only. |
coach | staff | Every participant in the tenant (while their consent stands): assigning journeys and sequences, chats, tasks, profiles, tags, groups and extras. Reads the content catalog without changing it. |
admin | staff | Everything in the tenant: content, settings, invitations, roles, status and consent, import and export. |
platform_admin | staff | As admin, plus what reaches past one tenant: creating and deleting tenants, the tiers, erasing a person from every tenant, API keys, webhooks, and the platform's own settings. |
sales | staff | Exactly three reads: the tenants and cohorts it belongs to (with their sign-up links) and the tier names. Never a participant. |
api_client | service | Held only by an API key's service account: the tenant's catalog, redeeming booking tokens, and tagging by external id. |
sales and api_client are each locked by a test that fails if anything widens them.
Where each role works
A participant role works only in the two apps. The portal, MCP and the cli are staff surfaces. A
service role works only on the API, and the API key sign-in admits nothing else. Only an active
user signs in.
A second factor
A role can require one (requiresSecondFactor). A session whose sign-in didn't use one holds
no permissions: every resource is refused and the session says needsSecondFactor, until the
person signs in with a factor or enrols one during that session. The participant and service roles
never require one.
Two layers
- The permission decides whether an operation is open to the session at all.
- On a person's records, the caller must be that person, or staff or a service account in the tenant the session is in; reading someone else also needs their consent to stand. There is no assignment of participants to particular coaches.
A 403 forbidden is the first layer or the second; a 403 consent_required is a participant whose
health data can't be written until they consent.