Authorization Guide

Overview

The Authorization module provides role-based access control (RBAC) with two main components:

1. Permissions - Specific actions users can perform (e.g., "manage users")
2. Roles - Collections of permissions assigned to users (e.g., "admin", "trainer")

---

Permissions

Viewing Permissions

Navigate to Resources → Permissions to view all system permissions.

Permissions listing page

Table Columns:

• NAME - Permission identifier (e.g., "manage users", "manage trainings")
• GUARD NAME - Security context (typically "web")

Common Permissions:

• manage_XX
• view_XX
• update_XX
• delete_XX
• create_XX

Actions:

• 👁 View details
• ✏ Edit permission
• 🗑 Delete permission

---

Creating Permissions

Info

Generally there is no need to create new permissions in the system as the system will not be aware of them or how to use them.

Step 1 : Fill Required Fields

Name (Required)

• Use lowercase with underscores
• Start with action verb: manage_, view_, edit_, delete_, create_
• Examples: manage_events, view_reports, edit_profiles

Guard Name (Required)

• Default: web (for standard users)
• Options: web, api, admin

Step 2 : Save

Choose:

• Create Permission - Save and return to list
• Create & Add Another - Save and create another
• Cancel - Discard changes

Naming Best Practices:

✅ Good: manage_events, view_reports, edit_user_profiles
❌ Bad: Events, ViewReports, edit users, del_train_rec

---

Roles

Viewing Roles

Navigate to Authorization → Roles to view all system roles.

Roles listing page

Common System Roles:

Role	Typical Use
admin	Full system access
manager	Team and report management
trainer	Training delivery and management
team manager	Team-specific management
staff	Basic employee access
project manager	Project coordination
user	Minimal end-user access

Actions:

• 👁 View role details
• ✏ Edit role and permissions
• 🗑 Delete role

---

Creating Roles

Step 1: Click "Create Role"

Step 2: Fill Required Fields

Details Tab:

Name (Required)

• Use descriptive, lowercase names
• Examples: trainer, project manager, hr specialist, content editor

Guard Name (Required)

• Default: web
• Options: web, api, admin

Step 3: Assign Permissions (After Creating Role)

After saving, edit the role to assign permissions:

Example Permission Sets:

Admin Role:

☑ manage users
☑ manage roles
☑ manage permissions
☑ manage trainings
☑ manage events
☑ manage schedules

Trainer Role:

☑ manage trainings
☑ manage training sessions
☑ manage training records
☑ view schedules

Manager Role:

☑ view users
☑ manage teams
☑ view reports
☑ manage schedules

User Role:

☑ view own profile
☑ view own trainings
☑ register for events

Step 4: Save

Choose:

• Create Role - Save and return to list
• Create & Add Another - Save and create another
• Cancel - Discard changes

---

Assigning Permissions to Roles

1. Navigate to Resources → Roles
2. Click on role name or pencil icon
3. Find Permissions section
4. Check desired permissions
5. Click Update Role

---

Best Practices

Permission Naming

• Use consistent prefixes: manage_, view_, edit_, delete_
• Be specific: manage_training_records not just manage_trainings
• Use lowercase with underscores

Role Design

• Create roles based on job functions, not individuals
• Follow principle of least privilege (minimal necessary access)
• Use descriptive role names: content_editor not role1
• Document which permissions each role needs

Security

• Regularly audit role permissions
• Don't create overly broad roles
• Separate sensitive permissions (e.g., manage_roles, manage_users)
• Test role access before assigning to users

---

Common Use Cases

1. New Training Department

Create Roles:

• training_coordinator - Full training management
• trainer - Deliver and record trainings
• training_viewer - Read-only training access

Assign Permissions:

training_coordinator: manage_trainings, manage_sessions, manage_records
trainer: manage_sessions, manage_records, view_trainings
training_viewer: view_trainings, view_sessions, view_records

2. Team-Based Access

Create Roles:

• team_lead - Manage specific teams
• team_member - Team participation

Assign Permissions:

team_lead: manage_teams, view_team_reports, assign_tasks
team_member: view_team_data, view_schedules

3. Hierarchical Access

Create Roles:

• super_admin - All permissions
• department_admin - Department-specific management
• staff - Basic operations

---