Roles matrix
10 roles · 34 humans · permissions follow responsibility, not seniority — the CTO can't approve refunds and the Head of Retail can't mint roles
Roles
10
0 orphaned permissionsHumans
34
+ 3 invites pendingSuper-admins
2
1 is sealed break-glassMFA coverage
100%
hardware key for super-admin4-eyes actions
7
refunds >$500, tax, roles…Matrix · core grants (full editor per role opens from the role name)
| Permission | super-admin | retail-admin | catalogue-editor | support-agent | finance-viewer | counsel |
|---|---|---|---|---|---|---|
| Catalogue · view | ||||||
| Catalogue · publish | ||||||
| Orders · view + fulfil | ||||||
| Refunds · approve ≤ $500 | ||||||
| Refunds · > $500 (4-eyes) | ||||||
| Customers · PII masked | ||||||
| Customers · unmask (reason logged) | ||||||
| Exports · PII columns | ||||||
| Coupons & campaigns · approve | ||||||
| CMS · publish home/pages | ||||||
| CMS · legal pages (terms/privacy) | ||||||
| Reports · margin columns | ||||||
| Tax & GST settings (4-eyes) | ||||||
| Roles, keys, flags, billing |
Note the deliberate gaps: super-admin holds the platform keys but no retail money moves — separation of duties is the point, not an inconvenience.
Role inventory
| Role | Humans | Sensitive grants | Last review |
|---|---|---|---|
| super-admin | 2 (1 sealed) | roles · keys · flags · billing · break-glass | 12 Aug · Dan + external audit |
| retail-admin | 4 | refunds ≤$500 · publish CMS · unmask w/ reason | 12 Aug · Priya |
| catalogue-editor | 6 | publish products · price rules draft | 12 Aug · Priya |
| support-agent | 11 | refunds ≤$500 · unmask w/ reason · goodwill ≤$20 | 12 Aug · CX lead |
| support-lead | 2 | macros · queue rules · agent QA | 12 Aug · CX lead |
| fraud-reviewer | 2 | holds · script F-2 · chargeback pack | 12 Aug · finance |
| ops-lead | 2 | carrier lanes · delay flags · stocktake | 12 Aug · ops |
| finance-viewer | 3 | margin · BAS pack · refunds >$500 (4-eyes half) | 12 Aug · CFO |
| counsel | 1 | legal pages · T&Cs copy · APP responses | 12 Aug · counsel |
| campaign-editor | 1 | draft campaigns/CMS · no approve | 12 Aug · Priya |
How roles stay honest
Least privilege by default. New joiners start one notch below their team's role; upgrades need a sponsor + reason.
Joiner-mover-leaver SLA 24h. Leaver suspensions are same-hour; the Sep 9 blocked contractor login is the drill working.
Quarterly recertification. Every sponsor re-attests each human; silence = auto-suspend, not auto-keep.
Break-glass sealed. Opened once (Jun 14, payment outage); seal checked daily by job, opened = page everyone + counsel pack.