RBAC Matrix
Deny-by-default role permissions across Concourse modules.
Role-Based Access Control matrix — defines what each role can see and do.
↓ From:System defaults+County Admin overrides·↑ Feeds:Every action, every page, every API call
| Role | admin config | admin rbac | approvals | audit | batches | cash receipts | checks | combined daily | equipment | exports | help | imports | integrations | inventory | invoices | jobs | onboarding | physical counts | rates | reports | support console | vendors | vouchers | work orders |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
office manager | ||||||||||||||||||||||||
data entry clerk | ||||||||||||||||||||||||
county admin | ||||||||||||||||||||||||
shop supervisor | ||||||||||||||||||||||||
foreman | ||||||||||||||||||||||||
patrol superintendent | ||||||||||||||||||||||||
bhm support | ||||||||||||||||||||||||
bhm support lead | ||||||||||||||||||||||||
auditor | ||||||||||||||||||||||||
regional staff denied |
Regional staff are explicitly denied county data access (county_isolation rule).