Roles, permissions and scope

Role and scope are separate

A role decides what a user may do. Scope decides which records the role applies to. A facility manager at two homes and a facility manager at nine homes hold the same role with different scope; neither can see a facility outside their assignment.

The roles

OCRS ships a fixed set of roles rather than free-form permissions, so an evaluator can reason about them.

1. 1State administrator — jurisdiction-wide read of occupancy, capacity and extracts; cannot write census data
2. 2Organization administrator — full administration of one organization, its facilities and its users
3. 3Provider administrator — multi-facility operations and rollups inside one organization
4. 4Facility manager — bed configuration, census submission and history for assigned facilities
5. 5Facility reporter — census submission for assigned facilities
6. 6Auditor — read-only review of everything in scope, with no ability to change it

Enforcement

Permissions are enforced in the database, not in the interface. Row-level policies scope every read and write to the signed-in user's organization and facility assignments, so changing a URL or calling the API directly cannot reach another organization's records. The interface hides what a role cannot use, but hiding is never the control.

Multi-factor authentication

Administrative roles must complete multi-factor enrolment before they can use administrative surfaces. An account that has not enrolled is held at the enrolment step rather than granted partial access.

Auditability

Sign-ins, census submissions, administrative changes, role assignments and extract generation are written to an append-only audit trail that cannot be edited or deleted from the application. Role assignments can be reviewed at any time in the administration console.