Permissions Matrix

​

Overview

This matrix shows all permissions in Agatabo, what actions they control, and which roles typically have them.

​

Permission Format

Format: resource:action Example: savings:write = permission to write (create/modify) savings records Scopes:

• SELF: Access only own data
• ANY: Access all organization data

---

​

Complete Permissions List

​

Organization Users

​

Savings & Deposits

​

Loans

​

Expenses

​

Fixed Assets

​

Reserves

​

Dividends

​

General Ledger & Accounting

​

Reports

Note: Reports generally don’t have specific permissions. Access depends on underlying data permissions. Examples:

• Balance Sheet: Requires ledger:read (ANY)
• Loans Outstanding: Requires loans:read (ANY)
• Member savings statement: Requires savings:read (SELF or ANY)

​

Settings & Administration

---

​

Common Role Mappings

​

Administrator (Full Access)

Can do: Everything

---

​

Treasurer

Can do: Record deposits, record expenses, view financial reports Cannot do: Create loans, assign roles, change settings

---

​

Loan Officer

Can do: Create/manage loans, record payments, apply penalties Cannot do: Record deposits/expenses, post journal entries, assign roles

---

​

Accountant

Can do: View all financial data, run reports, post adjusting entries, view audit trail Cannot do: Record operational transactions (deposits, loans), assign roles, change settings

---

​

Member (Basic)

Can do: View own savings, loans, account statement, dividends Cannot do: View other members’ data, record transactions, access settings

---

​

Permission Inheritance

Multiple roles:

• If user has multiple roles, permissions are cumulative (union)
• Example: User with both Treasurer + Loan Officer can record deposits AND create loans

Scope precedence:

• If same permission granted with different scopes, ANY scope wins
• Example: User has savings:read SELF from Member role + savings:read ANY from Treasurer role = user gets ANY scope

---

​

Special Cases

​

Self-Service Loan Applications

• Member with loans:write (SELF scope) can submit loan applications
• Requires administrator to configure self-service feature
• Applications still need approval from loan committee

​

Restricted Journal Entries

• ledger:write permission allows creating manual journal entries
• Some entry types may be restricted (e.g., closing entries) even with permission
• System prevents creating entries in closed periods regardless of permission

​

Organization-Level Settings

• settings:write is powerful - grants ability to change currency, timezone, etc.
• Should only be given to trusted administrators
• Changes affect entire organization and all users

---

​

Permission Checks in Agatabo

Where permissions are checked:

1. UI: Buttons/menus hidden if insufficient permission
2. API: Server validates permission before executing action
3. Reports: Filtered based on scope (SELF vs ANY)

Error messages:

• “You don’t have permission to perform this action” = Missing permission entirely
• “You can only access your own data” = Have permission but with SELF scope, trying to access others’ data

---

​

Need Help?