Roles and permissions
Five preset roles, custom roles, the two modules isolated on purpose, and how to build one without locking somebody out.
Each member holds exactly one role. A role is a grid: feature areas down the side, actions across the top.
The actions
| Action | Notes |
|---|---|
| View | See it at all. |
| Create | Add new records. |
| Edit | Change existing ones. |
| Delete | Remove one record. |
| Bulk delete | Separate from delete — so you can allow removing one record but not clearing a list. |
| Export | Separate from view — so reading is not the same as taking a copy out of the building. |
Those last two splits are the ones worth using. Most damage done to a clinic's records is not malicious; it is a bulk action taken by someone who did not realise what was selected.
The two isolated modules
- Clinical records — examinations, charts, prescriptions and everything else with legal weight.
- Sensitive finance — the fields you would not want on a shared screen.
They are separate modules rather than part of patients and finance precisely so a role can have the everyday work without the sensitive part. A secretary books appointments all day and never needs an examination note.
Own versus all
A module can be scoped to own, meaning the member sees only records they created or that are assigned to them.
Example
A visiting clinician who works Thursdays
- Patients — view, edit, scope: own
- Clinical records — view, create, edit, scope: own
- Appointments — view, scope: own
- Export — off
- They can do their whole job and cannot browse your patient list.
Building a custom role
- Start from the closest preset and duplicate it.
- Take permissions away rather than adding them up from nothing.
- Check export and bulk delete explicitly — those are the two people forget.
- Assign it to one person and have them do a normal day before you roll it out.
Building a role up from an empty grid usually ends with somebody unable to do their job at 8am on a Monday. Subtracting from a working preset fails safe.
The presets
Owner, admin, doctor, secretary and accountant cannot be edited or deleted. That is deliberate — they are the fallback that is always sane, and a clinic that has broken its own custom roles needs somewhere to land.
Common questions
- Can someone have two roles?
- No — one role each. If somebody genuinely does two jobs, make a role that describes the union of them.
- Does a role change require them to sign out?
- No. It takes effect on their next request.
- Who can edit roles?
- The roles module is the highest permission in the product. In practice, keep it with the owner.