Understanding roles and permissions
What a role is, why access is granted by capability rather than by job title, and how to decide what each person sees.
Last reviewed
A role is a set of things a person is allowed to do. You assign people to roles, and the role decides what they can see and change, not their job title, and never anything the browser claims about them.
Capabilities, not job titles
FlyerOS grants access by capability. "Can view training records" is a capability; "instructor" is a role that has some capabilities and not others. This means two schools can call the same job different things and still control access precisely.
Access is always checked on the server against the person's real membership of your organisation. A page never trusts a role sent from the browser, so a link someone was not meant to have does not work if they follow it.
Scoping
Some roles see everything; some see only what is theirs. An instructor sees the students assigned to them; an accountable manager sees the whole organisation. The underlying record, who signed what, and when, is the same in both cases; the difference is how much of it a person is shown.
Deciding what each role can do
Start from the question "what does this person need to finish their work?" and grant that, rather than starting from "what should we hold back". Fewer, clearer roles are easier to reason about than many overlapping ones.
You can change what a role can do later. Because access is derived from the role at the time a page loads, a change takes effect the next time the person opens the screen.