Roles and permissions

What each role can do on each entity. Rows marked "only own" or "scope" are filtered by the core on every list, read, update and delete.

Roles

Role	Description
budget:admin	Sets up financial years, budget heads, sub-heads and sub-departments; full access
budget:finance	Finance officer: allocates budgets to departments, approves re-appropriations, sees all departments
budget:hod	Head of department: approves or rejects expenditure requests and raises re-appropriation requests
budget:clerk	Department clerk: raises expenditure requests and records the actual expense against approved requests
budget:auditor	Read-only view of allocations, requests, expenses and re-appropriations

Access by entity

Entity	budget:admin	budget:finance	budget:hod	budget:clerk	budget:auditor
Allocation Line	read, create, update, delete	read, create, update, delete	read	read	read
Budget Allocation	read, create, update, delete	read, create, update, delete	read	read	read
Budget Head	read, create, update, delete	read, create, update, delete	read	read	read
Budget Sub-head	read, create, update, delete	read, create, update, delete	read	read	read
Expenditure	read, create, update, delete	read	read	read, create — only own rows (via recorded_by)	read
Expenditure Request	read, create, update, delete	read, update	read, update	read, create, update — only own rows (via requested_by)	read
Financial Year	read, create, update, delete	read, create, update	read	read	read
Re-appropriation	read, create, update, delete	read, update	read, create — only own rows (via requested_by)		read
Sub-department	read, create, update, delete	read, create, update, delete	read	read	read