# S·OS — Roles & Access Matrix

Access is granted by **role** (enforced by the API gateway) and scoped by **department**.

| Role | Access level |
|---|---|
| `admin` | **Owner.** Everything: users, roles, services, licences, settings. Never blocked by any gate. |
| `operator` | Operations: services, tasks, tickets, dashboards, health, service APIs. |
| `user` | Standard staff: own tasks, calendar, read own data. |
| `network_engineer` | Network services: scanners, BGP/DPI, network tools. |
| `hlr_admin` | Subscriber / HLR administration. |
| `back_office` | Back-office workflows and records. |
| `support_2nd_line` | Second-line support: tickets and cases. |
| `support_3rd_line` | Third-line support + advanced diagnostics. |
| `network_ops` | Network operations: health and monitoring read access. |
| `finance_staff` | Finances, transactions, reporting. |
| `warehouse_staff` | Warehouse and inventory workflows. |
| `manufacturing_staff` | SAP420 manufacturing modules. |
| `sales_staff` | CRM, leads, sales workflows. |
| `hr_staff` | HR, absence, staff records. |
| `public` | Public pages only — no app access. |
| `case_worker` | Cases and client records. |
| `supervisor` | Team oversight: their department's tasks and reports. |
| `auditor` | Read-only audit access across services. |

## Rules

- `admin` is a superuser — every endpoint, every service UI, every licence decision.
- Services enforce roles automatically; nothing needs manual configuration per service.
- **Admin manages who gets what** — the single administrator is `hello@caringforno1.com`.
- Licences = role + department. Keep this file updated when the company structure changes.