Roles and permissions

What each role can do on each entity. Rows marked "only own" or "scope" are filtered by the core on every list, read, update and delete.

Roles

Role	Description
sfc:admin	Configures services, fees, purposes and staff scopes; sees and acts on every application
sfc:verifier	Works the Pending queue: verifies education, documents and recipients, raises corrections, confirms with colleges, rejects or holds
sfc:signatory	Works the Verified queue: generates and digitally signs the certificate or letter
sfc:printer	Works the Print and Printed queues for documents that go out on paper
sfc:dispatcher	Dispatches by courier, hands over at the counter or emails documents; keeps the outward register
sfc:accounts	Sees payments, confirms offline challans, handles payment issue reports
sfc:agent	Education agent who applies on behalf of students assigned to them
sfc:student	Applies for documents and services, pays, tracks and downloads own applications

Access by entity

Entity	sfc:admin	sfc:verifier	sfc:signatory	sfc:printer	sfc:dispatcher	sfc:accounts	sfc:agent	sfc:student
Agent	read, create, update, delete						read, create, update — only own rows (via user)
Agent Student	read, create, update, delete						read, create — only own rows (via agent)
Application	read, create, update, delete	read, update	read, update	read, update	read, update	read, update	read, create, update — only own rows (via agent)	read, create, update — only own rows (via student)
Application Status Event	read	read, create	read, create	read, create	read, create	read, create		read — only own rows (via student)
Delivery / Dispatch	read, create, update, delete	read		read	read, create, update			read — only own rows (via student)
Uploaded Document	read, create, update, delete	read, update	read	read			read, create, update — only own rows (via entered_by)	read, create, update — only own rows (via student)
Education Record	read, create, update, delete	read, update	read	read			read, create, update — only own rows (via entered_by)	read, create, update — only own rows (via student)
Feedback	read							read, create, update — only own rows (via student)
Issued Document	read, create, update, delete	read	read, create, update	read	read			read — only own rows (via student)
Issue Report	read, create, update, delete	read				read, update		read, create — only own rows (via student)
Outward Register Entry	read, create, update, delete		read, create	read, create	read, create
Purpose / Recipient Type	read, create, update, delete	read	read	read	read	read	read	read
Recipient (Purpose)	read, create, update, delete	read, update	read	read	read		read, create, update — only own rows (via entered_by)	read, create, update — only own rows (via student)
Service (Document Type)	read, create, update, delete	read	read	read	read	read	read	read
Service Delivery Option	read, create, update, delete	read	read	read	read	read	read	read
Service Fee Rule	read, create, update, delete	read				read	read	read
Staff Scope	read, create, update, delete	read — only own rows (via user)	read — only own rows (via user)	read — only own rows (via user)	read — only own rows (via user)	read — only own rows (via user)
Transcript Subject	read, create, update, delete	read, create, update	read				read, create, update	read, create, update
WES Applicant Form	read, create, update, delete	read, update	read				read	read, create, update — only own rows (via student)
WES Upload Attempt	read		read, create		read, create			read — only own rows (via student)