Super Admin · Governance
Roles & permissions
Define the boundaries between platform operators, customer administrators and end users. This is the proposed policy blueprint, not enforced access control.
Policy draft, not security enforcement. This matrix documents intended access. Hiding links in the interface does not secure data. The backend must enforce every permission and organisation boundary before production.
Least privilege
Give each role only the access needed for its work.
Scope matters
Permissions apply only within assigned platform, customer, site or department scope.
Audit sensitive changes
Record who changed access, what changed and when.
Proposed role access matrix
Use search and filters to explore the draft policy.
| Capability | Super Admin | Provider Admin | Reseller | Organisation Admin | Site Admin | Department Manager | Standard User |
|---|---|---|---|---|---|---|---|
| Platform-wide configuration | Global control | No access | No access | No access | No access | No access | No access |
| Feature flags & emergency controls | Global control | View | No access | No access | No access | No access | No access |
| Tenant / organisation lifecycle | Full | Manage | Scoped manage | View | No access | No access | No access |
| Users & groups | Full | Manage | Scoped manage | Manage | Scoped manage | Scoped manage | Own records |
| Printers & devices | Full | Manage | Scoped manage | Manage | Scoped manage | View | View |
| Print activity & job detail | Full | Manage | View | Manage | Scoped manage | View | Own records |
| Reports & cost analysis | Full | Manage | View | Manage | Scoped manage | View | Own records |
| Billing & subscription plans | Global control | Manage | Scoped manage | View | No access | No access | No access |
| Organisation settings | Full | Scoped manage | Scoped manage | Manage | View | No access | No access |
| Audit logs & security events | Full | View | No access | View | No access | No access | No access |
| Personal settings & own records | Full | Own records | Own records | Own records | Own records | Own records | Own records |
Showing all proposed capabilities.
Scope rules to enforce
- Every customer-owned record must carry a tenant or organisation identifier.
- Site and department roles must be limited to explicitly assigned sites or departments.
- Standard users must not read another user's print jobs, usage or personal settings.
- Super Admin actions must be authenticated, authorised and written to an audit trail.
- Feature availability and role permission are separate checks; both must pass.
Decisions still to confirm
- Can Provider Admins create or suspend reseller accounts?
- Can Organisation Admins see detailed print-job content or only metadata?
- Should department managers see costs, user names, or only totals?
- Which roles can manage billing, quotas, print release and retention policies?
The matrix is a starting proposal. We will refine it before backend authorization is implemented.