Role Access Matrix

Overview

Report System access is scope-sensitive. Partner users can work records they are allowed to see or edit. FPH admins can review cross-ban recommendations and network-ban appeals. The UI hides or redirects actions when the user lacks the required role.

Access matrix

Role or condition	Can view	Can edit or decide	Key controls
Partner user with reports capability	Reports Overview, My Reports, own visible detail pages, watchlists, bans, profiles for scope.	File new reports; edit reports allowed by partner/owner rules; submit network-ban appeals for active partner.	New Report, Manage Report, Bans appeal link, Profiles.
Report filer or allowed partner member	Report Detail and Manage Report for editable records.	Status, severity, evidence, action fields, ban scope, cross-ban recommendation.	Manage Report save/revert.
User without edit rights	Visible Report Detail only.	No Manage Report; edit link hidden or manage route redirects.	Detail read-only sections.
FPH admin	All report surfaces plus FPH-admin-only navigation.	Cross-ban approve/deny, network ban scope, appeal approve/deny.	Cross-ban Requests, Ban Appeals.
Non-FPH admin on FPH pages	Access denied.	None.	Cross-ban Requests and Ban Appeals hide content.

Permission workflow

flowchart TD
  route["Open report route"] --> auth["Dashboard auth and partner scope"]
  auth --> visible{"Record visible?"}
  visible -- No --> error["Not found or denied state"]
  visible -- Yes --> edit{"Edit or admin action?"}
  edit -- Report edit --> canEdit{"Partner/owner/Fph rule allows?"}
  edit -- Network decision --> admin{"FPH admin?"}
  canEdit -- Yes --> manage["Show Manage Report"]
  canEdit -- No --> detail["Read-only Detail"]
  admin -- Yes --> decision["Show admin controls"]
  admin -- No --> denied["Access denied"]

Inputs and controls governed by role

Control	Access behavior
Reports subnav Cross-ban Requests	Hidden unless FPH-admin state is detected.
Edit report link	Hidden when the user cannot edit the report.
Manage Report route	Redirects to Detail when edit access fails.
Cross-ban decision controls	Only visible to FPH admins.
Ban Appeals page	Shows access denied to non-FPH admins.
Network Ban Appeal submit/update	Uses the active partner as appellant.
Person profile create	Requires active partner scope.

End-to-end operator runbook

1. Confirm account role: Check whether the task is partner-level or FPH-admin-level.
2. Confirm partner scope: Scope affects visible reports, appeals, and profiles.
3. Use visible controls: If a control is hidden, verify access before assuming a bug.
4. Escalate correctly: Network decisions go to FPH admin; local edits stay with allowed partner staff.
5. Record access issues: Include route, report number, active partner, and expected role.

Common mistakes

Do not ask a partner operator to decide a network ban or network appeal. Those controls are intentionally FPH-admin-only.