Access journeys
Table of Contents
An account holds no permission directly. It holds roles, each role bundles permissions, and every capability a person exercises arrives through that chain. These journeys follow the chain from both ends: the member reading it, and the administrator changing it.
The role catalogue is the third journey, because a role is only useful once somebody has decided what it contains. The Qt client listed a role's permissions read-only and shipped no editor for them, so this journey is new ground.
1. Journeys
| Journey | Actor | Gist |
|---|---|---|
| Know what I may do | member | See the roles I hold and the permissions they carry |
| Change someone's access | tenant administrator | Grant and revoke a colleague's roles |
| Shape the role catalogue | tenant administrator | Define roles and the permissions each one bundles |