MANSOQ Access & roles
Roles and Permission
Definition A role in MANSOQ is a named set of permissions. A permission allows one action, for example to register a patient. MANSOQ builds every permission into the product, so you cannot create or change a permission. You group permissions…
3.1 · versioned documentation · 3 min read
Definition
A role in MANSOQ is a named set of permissions. A permission allows one action, for example to register a patient. MANSOQ builds every permission into the product, so you cannot create or change a permission. You group permissions into a role, and then you give the role to a user.
Note: Roles and permissions belong to MANSOQ's access control. FHIR R5 has no resource for them, so this concept has no FHIR reference.
You reach roles from the Admin sidebar. Select RBAC, then select Roles. To see the permissions of every role, select RBAC, then select Permissions.
Note: Only a super administrator can create, change, or clone a role.
Key Attributes
| Components | What it captures |
|---|---|
| Name | The name of the role. The name is required and must be unique. |
| Description | A short text that explains the purpose of the role. The description is optional. |
| Contexts | The places where you can assign the role. Select one or more contexts. |
| Permissions | The actions that the role allows. Select one or more permissions. |
Contexts
A context tells MANSOQ where a role applies. A role has one or more of these contexts:
- Facility — you can give the role to a user who works in a facility.
- Government Organization — you can give the role to a user in a government organization.
- Responsibility — you can give the role to a user in a responsibility organization.
System roles
MANSOQ includes system roles. A system role shows a System badge and a lock icon in the roles list. You cannot edit or delete a system role. To start from a system role, clone it into a new custom role, and then change the clone.
The system roles are Volunteer, Doctor, Nurse, Staff, Pharmacist, Administrator, Facility Admin, and Admin.
MANSOQ also includes three system roles for the Responsibility context: Admin, Manager, and Member.
The permissions matrix
The Permissions page shows a read-only matrix. Each row is a permission. Each column is a role. A green check mark shows that the role holds the permission. A red cross shows that the role does not hold the permission. To change what a role allows, edit the role.
How a user gets a role
A user gets a role when you add the user as a member of one of these:
- An organization
- A facility, through its root department
- A responsibility
- A department
Each membership carries exactly one role. That role decides what the user can do in that scope.
MANSOQ protects access in two ways:
- You can assign only a role with permissions that you also hold. You cannot give a user more access than you have.
- MANSOQ keeps the last Facility Admin in the root department of a facility. You cannot change the role of that user. You also cannot remove the last user from the root department.
Related
- Flow: Create a role
- Flow: Edit or clone a role
- Flow: View the permissions matrix
- Flow: Assign a role to a user
- Flow: Change or remove a user's role
- Concept: Organisation
- Concept: Supplier
- Concept: Responsibility
- Concept: User
Source evidence
References are pinned to the private MANSOQ source repository. Repository access is required to open these links.