User setup, org hierarchy, the permission matrix & RBAC
Who someone is, where they sit, and what they may see — commvita treats access as first-class, tamper-evident configuration. Set up users and organisations, model the hierarchy (line management + clinical supervision), and govern access through an editable 18-role × 16-domain permission matrix with scope-only groups, delegations and a hash-chained access audit.
Identity → structure → permission
A role decides what you can do; your organisation scope decides whose records you can see. The two are separate on purpose — so a receptionist and a consultant at the same practice see the right things, and neither sees another practice's patients.
Set up users & orgs
Create accounts, assign a role, and link each user to one or more organisation ODS codes; manage jurisdictions and legal entities in Org Admin / HR & Finance; provision via OIDC/SSO where the org runs single sign-on.
Model the hierarchy
The Staff Hierarchy Builder holds care groups and a dual-layer org chart — line management and clinical supervision — with supervision-gap detection and a staff-assignment editor. Team leads inherit scope through delegations.
Govern permissions
An editable 18-role × 16-domain matrix with policy scenarios and a DSPT export; User Groups grant scope only, never a role (ADR-015); delegations and group memberships expire; every role/scope change is written to a SHA-256 hash-chained login audit.
| Role | Patient record | Mental / sexual health | User admin |
|---|---|---|---|
| read_only (reception) | own org only | denied | denied |
| care_coordinator | org-scoped | allowed | denied |
| clinician | org-scoped | allowed | denied |
| admin | unrestricted | allowed | allowed |
Role and scope are separate
effective_role(user) comes only from an explicit role assignment; effective_scope(db, user) is the union of the user's own, delegated and group organisations. A group can never grant a role — only scope (ADR-015).
Delegation & groups, with expiry
Team leads inherit a colleague's org scope through a delegation; users join scope-only groups; both can carry an expiry — expired grants yield no access, and lapses are recorded once to the audit chain.
Every change is tamper-evident
Role assignments, group membership changes and every login land on a SHA-256 hash-chained audit (prev_hash → row_hash), re-verified on read — no silent privilege elevation, and a DSPT-ready access-monitoring trail.
See it in the product
Two live screens from the RBAC module: the permission matrix — every role × every data domain, with each domain carrying a sensitivity label — and the policy scenarios that encode the real access rules (break-glass, locum, home-visit, research) with their trigger, policy reference and audit requirement.
Where it lives in commvita
| Capability | Route | Model / API | Status |
|---|---|---|---|
| User management | /user-management | User · UserOrganisation | ● Live |
| Org & entity setup | /org-admin · /hr-finance | API /hr/ (legal entities, contracts) | ● Live |
| Staff Hierarchy Builder (dual-layer) | /hierarchy-builder | API /hierarchy/ (care-groups, tree) | ● Live |
| RBAC permission matrix (18×16) | /rbac | API /rbac/matrix · scenarios · export | ● Live |
| Team-lead delegations (scope inherit) | /rbac | API /rbac/delegations · UserDelegation | ● Live |
| User Groups (scope-only, expiry) | /rbac | API /rbac/user-groups · UserGroup · expires_at | ● Live |
| Effective-access viewer | /rbac | API /rbac/users/{id}/effective-access | ● Live |
| Login / access audit (hash-chained) | /login-audit | API /auth/login-audit · LoginAuditEvent | ● Live |
| OIDC / SSO provisioning | /oidc-settings | OIDC · SCIM | ☉ Demonstrated |