Users, Groups, Roles

Short version:

• A User is a person.
• A Group is a team/bucket.
• A Role is a permission key attached to a group.
• A user gets roles through group membership.

Data model

• users
• groups
• group_members (joins users to groups)
• group_roles (roles granted by each group)

User --> group_members --> Group --> group_roles --> role string

How access is checked

1. System loads user roles from their groups.
2. Policy checks for required role (or admin).
3. Sidebar hides links user cannot read.

Back:

• Docs overview
• Forms + Lists
• Rules Engine