Permission matrix
This is the source-of-truth matrix for who can do what. The same matrix is encoded in src/application/permissions.ts and mirrored into Postgres RLS policies.
✓ = allowed. — = denied. (self) = allowed only on records the user owns or is assigned to.
The six roles, in order of privilege: admin, manager, supervisor, cutter, member, viewer.
Inventory
| Action | admin | manager | supervisor | cutter | member | viewer |
|---|---|---|---|---|---|---|
| View inventory | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Manage rolls (create / quarantine / receive PO) | ✓ | ✓ | — | — | — | — |
| Edit roll dimensions | ✓ | — | — | — | — | — |
| List offcuts | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Manage material types | ✓ | ✓ | — | — | — | — |
| Manage suppliers | ✓ | ✓ | — | — | — | — |
| Manage pricing | ✓ | — | — | — | — | — |
| Set reorder rule | ✓ | ✓ | — | — | — | — |
Purchase orders
| Action | admin | manager | supervisor | cutter | member | viewer |
|---|---|---|---|---|---|---|
| Draft PO | ✓ | ✓ | — | — | — | — |
| Send PO | ✓ | ✓ | — | — | — | — |
| Receive PO | ✓ | ✓ | — | — | — | — |
| Cancel sent PO | ✓ | — | — | — | — | — |
Jobs
| Action | admin | manager | supervisor | cutter | member | viewer |
|---|---|---|---|---|---|---|
| Create job | ✓ | ✓ | — | — | — | — |
| Assign roll | ✓ | ✓ | ✓ | ✓ | — | — |
| Set priority | ✓ | ✓ | — | — | — | — |
| Assign cutter | ✓ | ✓ | ✓ | — | — | — |
| Cancel job | ✓ | ✓ | — | — | — | — |
| View own job | ✓ | ✓ | ✓ | (self) | ✓ | ✓ |
Cutting engine
| Action | admin | manager | supervisor | cutter | member | viewer |
|---|---|---|---|---|---|---|
| Access cutting engine | ✓ | — | — | ✓ | — | — |
| Run Auto Nest | ✓ | — | — | ✓ | — | — |
| Run Free-roam | ✓ | — | — | ✓ | — | — |
| Commit cut | ✓ | — | — | ✓ | — | — |
| Approve cut | ✓ | — | ✓ | — | — | — |
| View cut history | ✓ | ✓ | ✓ | ✓ | — | — |
| Void cut | ✓ | — | — | — | — | — |
Analytics
| Action | admin | manager | supervisor | cutter | member | viewer |
|---|---|---|---|---|---|---|
| Access analytics | ✓ | ✓ | ✓ | — | — | — |
| View current consumption | ✓ | ✓ | ✓ | — | — | — |
| View period consumption | ✓ | ✓ | — | — | — | — |
| View material usage | ✓ | ✓ | ✓ | — | — | — |
| View cost reports | ✓ | ✓ | — | — | — | — |
| View trends | ✓ | ✓ | — | — | — | — |
| View reports | ✓ | ✓ | ✓ | — | — | — |
Users + workspace
| Action | admin | manager | supervisor | cutter | member | viewer |
|---|---|---|---|---|---|---|
| Invite user | ✓ | — | — | — | — | — |
Promote up to supervisor | ✓ | — | — | — | — | — |
Promote to manager | ✓ | — | — | — | — | — |
Promote to admin | ✓ (two-step) | — | — | — | — | — |
| Demote user | ✓ | — | — | — | — | — |
| Edit workspace settings | ✓ | — | — | — | — | — |
| Edit workspace branding | ✓ | — | — | — | — | — |
Audit
| Action | admin | manager | supervisor | cutter | member | viewer |
|---|---|---|---|---|---|---|
| Read admin activity log | ✓ | — | — | — | — | — |
| Read cut history | ✓ | ✓ | ✓ | ✓ | — | — |
| Export cut history | ✓ | ✓ | — | — | — | — |