Responsibility matrix
The matrix shows, in a single table, which permissions each role holds. It is under Settings → Matrix.
Reading it
- One row per permission, grouped by module; one column per active role, in the role's colour.
- A ticked box means the role holds the permission.
- The
ROLE_ADMINcolumn is always full: the administrator has every permission, whatever is ticked. - The bottom of each column gives the role's number of active permissions.
The ticks come from the roles stored in the database, like the Settings → Roles screen. However, the list of rows is hard-coded in the frontend: it only covers part of the permissions (programmes, registry, transfers, grievances, knowledge base, data, monitoring, reports, administration) and contains a few old codes that no longer exist (programmes.bailleurs, registre.menages_doublons, registre.documents, registre.eligibilite). For a complete view of a role, open it under Settings → Roles. Technical permission codes are listed in Roles and permissions.
The matrix Edit mode saves through a route (PUT /api/settings/role-permissions) that does not exist in the backend: saving fails. Until it is fixed, change permissions role by role under Settings → Roles; use the matrix to check the result.
Segregation of duties
Permissions alone do not guarantee that one person cannot do everything. Points to respect when assigning roles:
| Step | Permission | Rule |
|---|---|---|
| Prepare a transfer (cycle) | transferts.cycles_create, transferts.cycles_edit | cash transfer specialist |
| Validate a transfer | transferts.cycles_validate | two validation levels by default; give each level to someone other than the person who prepared the transfer |
| Execute payments | transferts.paiements_execute | separate from the validator |
| Reconcile with the operator | transferts.reconciliation | preferably the finance officer or another unit than the executor |
| Validate a household | registre.menages_validate | separate from the data entry operator |
The system records who validated each level (cycle validation history) but does not prevent one person from validating two levels if they have the right: segregation relies on how roles are assigned.
Scope
The matrix says what each role can do, never on which data. Scope is set account by account (institution, followed projects, national registry access): see Users.
Control
- Every role change and every sensitive action is recorded: Settings → Audit log or Administration → Audits.
- Review the matrix whenever someone joins or leaves the team, and at least once a quarter.