RBAC matrix

Source of truth in code: packages/domain/src/rbac.ts.

Roles

tenant_owner, admin, duty_lead, office, staff, viewer, platform_operator

Permissions by role

Permission	Owner	Admin	Duty lead	Office	Staff	Viewer	Platform operator
config.manage	✓	✓					✓
staff.import	✓	✓					✓
rota.publish	✓	✓	✓				✓
absence.create	✓	✓	✓	✓			✓
override.last_resort	✓	✓	✓				✓
notify.configure	✓	✓					✓
analytics.view	✓	✓	✓	✓			✓
export.create	✓	✓	✓	✓		✓	✓
user.invite	✓	✓					✓
ai.use	✓	✓	✓				✓
sso.configure	✓						✓
scim.configure	✓						✓
integrations.outlook.configure	✓	✓					✓
audit.view	✓	✓					✓

Invite UI roles

The Admin invite form offers: Admin, Duty lead, Office, Staff, Viewer. Tenant owner is created at provisioning time.

See also

• Roles and permissions
• Admin users