The job of this console
Assign personas to a role, set the default, preview menus, then open Advanced only when a single flag must differ. Do not grant Site Admin to fix one missing page — use persona navigation or a tighter permission.
Admin · Access & approvals
Roles & permissions
Persona-first RBAC: choose which personas a role may use, set the default and switcher, preview page access, and open Advanced for the full module CRUD matrix.
Scenario: Configure role persona access. Org kills and per-page maps: Persona navigation.
Persona-first RBAC
Which personas a role may use — then the fine matrix
Roles & permissions is persona-first RBAC: which personas a role may use, the default and switcher, a preview of page access, and Advanced for the full permission matrix.
Admin → Roles & permissions
Route
/admin/roles
HR Admin · Org Admin
Seat at the table
Administrators. Employees never edit roles. Managers do not self-elevate.
The working rhythm
Pick a role, set personas and default, preview, save, then Advanced if needed. Prove with a test user. Coordinate with persona navigation and flags.
Moments that bring you here
A new HRBP role. Someone stuck without timesheet. After a module launch. When the switcher shows personas they should not assume.
ⓘ
Role.json is the matrix; personas are the lens
Application Config and flags still gate modules. This console does not replace ApprovalAuthority or Employee records.
Interactive data flow
Toggle rbacAdminEnabled, personaModules, Automatic vs configured mode, pagePersonaMap writes, and org kill overrides.
What this screen configures
| Tab / area | Writes to | Purpose |
|---|---|---|
| Persona access | personaModules |
allowedPersonas, defaultPersona, personaSwitchEnabled; Automatic vs explicit list |
| Page preview (on Roles) | Org pagePersonaMap |
Same shared map as Persona navigation → Page access |
| Organization access card | — (link out) | Opens Persona navigation for org-wide kills — not edited on Roles |
| Advanced | hrmsModules, projectModules, CRUD groups |
Module visibility and create/update/delete/archive flags |
Roles attach to org units via ApplicationConfigRoleBar — users inherit through team membership, not direct user assignment. After changes, affected users should re-login to refresh encrypted access.
Evaluation order at runtime
- Role module / menu flags (
*Enabledin hrmsModules, projectModules, …) - Role
personaModules— or Automatic heuristic when never saved - Org
pagePersonaMapwhen an override exists for that route - Org
disabledPersonas,disabledPaths,disabledModules— always win
Menu visibility is not the same as API CRUD permission — backend RBAC enforces actions independently.
How to use
1. Confirm gates
Org
rbacAdminEnabled and your admin role adminModules.rolesEnabled.2. Pick a role template
Start from Site Admin or clone Manager / Employee templates.
3. Persona access
Set allowed personas, default, and switcher — or leave Automatic until you Save explicit personas.
4. Advanced (optional)
Tune module visibility and CRUD groups; disable dangerous flags on custom roles.
5. Assign via Role Bar
Map the role to delivery / HR org units in Application Config.
6. Verify
Sign in as a test user — confirm switcher, sidebar, and deep links.