Roles and permissions

What each role can do on each entity. Rows marked "only own" or "scope" are filtered by the core on every list, read, update and delete.

Roles

Role	Description
payments:admin	Manages settlement accounts, payment links, refunds and all payments of the university
payments:finance	Reconciles payments, records offline payments, runs split payouts and refunds
payments:viewer	Read-only access to payments, settlements and reports
payments:payer	Pays online and sees own payment orders and payments

Access by entity

Entity	payments:admin	payments:finance	payments:viewer	payments:payer
Gateway Refund	read, create, update	read, create, update	read
Payment Link	read, create, update	read, create, update	read
Payment Order	read, update	read, update	read	read — only own rows (via student)
Payment	read, create, update	read, create, update	read	read — only own rows (via student)
Settlement (Payout)	read, update	read, update	read
Settlement Account	read, create, update, delete	read	read
Split Payout	read, create, update	read, create, update	read