Organisation · Permissions

Roles & permissions

Roles are templates of permissions. System templates are immutable.

Key * Machine key, e.g. club_treasurer Name *

Description

Federation administrator

federation_admin

🔒 System template
District administrator

district_admin

🔒 System template
Club administrator

club_admin

🔒 System template
Competition director

competition_manager

🔒 System template
Club treasurer

club_treasurer

Custom role

Assign a role to a principal in a scope. Roles are additive.

Principal type * Principal-id * Role * Scope type *

Scope-id Enter an OrgNode or resource id. Hidden when scope = Federation.

anna.lindberg@malmobk.se

Club administrator · org_node · MALMO
0b1d-…-service

Competition director · tenant
agent://ranking-bot

District administrator · org_node · SKANE

Requests for role assignment. The approval flow is handled in Cases.

Role * Scope type *

Scope-id (OrgNode/resource) Hidden when scope = Federation. Justification (optional)

Club treasurer

org_node · MALMO

🕘 Pending Open in Cases →
Competition director

tenant

✓ Approved Open in Cases →
District administrator

org_node · GBG

✕ Rejected Open in Cases →

Show:

Club treasurer

🔒 System template (read-only)

Tick permissions per namespace. The whole set is saved (replaces the previous).

tenant-config.manage Manage the federation's structure, levels and configuration
tenant-config.read Read the federation's configuration

admin.roles.manage Create/edit roles and permissions
admin.members.manage Manage members and licences

org-node.move Move nodes in the hierarchy
org-node.dissolve Dissolve nodes
org-node.suspend Pause / reactivate nodes

competition.create Create competitions
competition.sanction Sanction competitions
competition:* Wildcard — everything in the competition namespace (all current and future)

Saved ✓ A system template cannot be changed — the button is disabled.

An unknown permission at save gives an error (no silent swallowing).

Time-limited roles end on their own — e.g. competition director for a single event.

Principal (email) * Role * Scope * Scope-id * Valid from Valid until * The role is revoked automatically at the time

Competition director · karin.akesson@almvikpk.se

Event · Sommarslaget 2026 · until 16 Aug 2026 23:59

Active
Secretariat · johan.berg@nordvikbk.se

Event · DM Skåne · until 6 Jul 2026 20:00

Active
Competition director · sara.holm@sjostadpk.se

Event · The Spring Meet · until 12 May 2026

Expired

Delegation of authority — let an assistant act in your place, time-limited or until further notice. Everything the assistant does is logged on both.

Delegate to (email) * Scope * Valid from Valid until Leave empty for until further notice

Justification

Federation administrator (you) → assistent@svenskboule.se

Member cases + licences · 1 Jul – 31 Aug 2026 (holiday)

Active
District admin West → vice@bdvast.se

Sanctioning in the district · Until further notice

Active

Duplicate protection: the same delegation twice gives an error instead of a silent copy.

An answer to "why may/may not this person do this?" — without guessing.

CHECK ACCESS

Principal (email) * Permission * E.g. competition.sanction or admin.members.manage Scope Scope-id

✓ ALLOWED

Granted via Club administrator (assigned in OrgNode MALMO) — the role inherits competition.sanction from the template.

✕ DENIED

None of the person's roles grant the permission in that scope. Closest: Club administrator in NORDVIK (wrong OrgNode). Everything is denied until something explicitly allows (deny by default).

ROLE TREE WITH INHERITANCE

Federation administrator
├─ inherits District administrator
│ ├─ inherits Club administrator
│   │   └─ admin.members.manage · competition.create
│   └─ competition.sanction · org-node.suspend
└─ tenant-config.manage · admin.roles.manage

⚠ A missing or circular inheritance reference is marked in the tree instead of hidden. Wildcards (e.g. competition:*) are shown expanded so you see exactly what they cover.