Roles & Permissions
Your Quality Assurance director needs read-only access to audit findings across all sites, your Production managers need to escalate actions during TIER meetings, and your Maintenance team leaders need to enter KPIs but not modify board structures. ProBeya's multi-role RBAC system is designed for exactly this: pharma organizational hierarchies where one person often wears multiple hats.
Architecture Overview
ProBeya uses a multi-role RBAC system with 13 predefined roles organized into five categories. Each user can hold multiple roles simultaneously -- the effective permissions are the union of all assigned roles. The system evaluates the most privileged role via checkMultiRolePermission, ensuring cross-functional users get the access they need without over-provisioning.
Role Hierarchy
Roles are organized with a numeric hierarchy level (lower number = more privileged). A user can only assign or modify roles below their own hierarchy level. This prevents privilege escalation -- a team_leader (level 40) cannot promote someone to tenant_admin (level 5).
Administration Roles
| Role | Level | Pharma Context | Permissions Summary |
|---|---|---|---|
| org_owner | 0 | CIO / VP IT | All 23 permissions. Billing, deletion, ownership transfer. One per org. |
| tenant_admin | 5 | IT Director / System Administrator | All permissions except billing. Members, SSO, settings, templates. |
| site_admin | 10 | Site IT Lead / Local Administrator | Operational permissions + site settings. No billing, no member management at org level. |
Operational Excellence Roles
| Role | Level | Pharma Context | Permissions Summary |
|---|---|---|---|
| opex_coordinator | 20 | OpEx Director / Lean Six Sigma Lead | KPIs, templates, analytics, boards, escalation, action verification. |
| department_manager | 30 | Production Manager / Engineering Manager | Boards, actions, escalation, verification, resource management. |
| team_leader | 40 | Shift Supervisor / Line Manager | Items, KPIs, basic actions, escalation, analytics. |
Project Management Roles
| Role | Level | Pharma Context | Permissions Summary |
|---|---|---|---|
| pmo_manager | 20 | Head of PMO | Templates, analytics, projects, portfolio, resources, gate approvals. |
| portfolio_manager | 30 | Portfolio Director | Analytics, projects, portfolio management, gate approvals. |
| project_manager | 40 | Project Manager / Tech Transfer Lead | Boards, items, KPIs, actions, analytics, project management. |
| sponsor | 50 | Executive Sponsor / VP R&D | Analytics and gate approvals (read-heavy, decision-oriented). |
Quality & Access Roles
| Role | Level | Pharma Context | Permissions Summary |
|---|---|---|---|
| quality_manager | 30 | QA Manager / Compliance Officer | Items, KPIs, actions, verification, analytics, document control. |
| team_member | 60 | Operator / Technician / Analyst | Create/edit items, enter KPIs, create/edit actions. |
| guest | 70 | External Auditor / Consultant | Analytics view only. No create, edit, or delete permissions. |
Segregation of Duties for GxP
In regulated environments, segregation of duties (SoD) is a critical control. ProBeya's role structure supports the following GxP-relevant separations:
| SoD Requirement | Enforced By | Regulatory Reference |
|---|---|---|
| Action creator cannot verify their own action | verify_action permission excluded from team_member role | 21 CFR Part 11.10(k) |
| Billing management separated from operational access | manage_billing restricted to org_owner only | SOC 2 CC6.1 |
| Template management separated from daily use | manage_templates restricted to admin + opex_coordinator + pmo_manager | GAMP 5 Category 4 |
| Gate approval separated from project execution | approve_gates restricted to pmo_manager, portfolio_manager, sponsor | PMI Stage-Gate methodology |
| Member management separated from document control | manage_members restricted to admin roles (level <= 10) | 21 CFR Part 11.10(d) |
For validated systems, document your role assignments in the User Requirements Specification (URS) and verify them during Installation Qualification (IQ). The permission matrix below should be referenced in your CSV validation protocol.
Multi-Role Assignment
Users can hold multiple roles simultaneously via the roles[] array on the membership record. The system evaluates the union of all assigned roles' permission sets using getEffectivePermissions().
Example: A site Quality Manager who also leads tech transfer projects:
- Roles:
quality_manager+project_manager - Effective permissions: document control + project management + action verification + analytics
The role categories in the UI are grouped as follows during assignment:
- Administration --
tenant_admin,site_admin - Operational Excellence --
opex_coordinator,department_manager,team_leader - Project Management --
project_manager,portfolio_manager,pmo_manager,sponsor - Quality --
quality_manager - Access --
team_member,guest
The org_owner role cannot be assigned through the standard invitation flow. Ownership is set during organization creation and can only be transferred by the current owner via Settings > Organization > Danger Zone.
Full Permissions Matrix (23 Permissions)
Board & Item Operations
| Permission | org_owner | tenant_admin | site_admin | opex_coord | dept_mgr | team_leader | proj_mgr | quality_mgr | team_member | guest |
|---|---|---|---|---|---|---|---|---|---|---|
| create_board | Yes | Yes | Yes | Yes | Yes | -- | Yes | -- | -- | -- |
| edit_board | Yes | Yes | Yes | Yes | Yes | -- | Yes | -- | -- | -- |
| delete_board | Yes | Yes | Yes | -- | -- | -- | -- | -- | -- | -- |
| create_item | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | -- |
| edit_item | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | -- |
| delete_item | Yes | Yes | Yes | -- | -- | -- | -- | -- | -- | -- |
KPI & Action Operations
| Permission | org_owner | tenant_admin | site_admin | opex_coord | dept_mgr | team_leader | proj_mgr | quality_mgr | team_member | guest |
|---|---|---|---|---|---|---|---|---|---|---|
| edit_kpi | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | -- |
| delete_kpi | Yes | Yes | Yes | Yes | -- | -- | -- | -- | -- | -- |
| create_action | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | -- |
| edit_action | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | -- |
| escalate | Yes | Yes | Yes | Yes | Yes | Yes | Yes | -- | -- | -- |
| verify_action | Yes | Yes | Yes | Yes | Yes | -- | -- | Yes | -- | -- |
Administration & Analytics
| Permission | org_owner | tenant_admin | site_admin | opex_coord | dept_mgr | pmo_mgr | sponsor | quality_mgr | team_member | guest |
|---|---|---|---|---|---|---|---|---|---|---|
| manage_templates | Yes | Yes | Yes | Yes | -- | Yes | -- | -- | -- | -- |
| manage_members | Yes | Yes | -- | -- | -- | -- | -- | -- | -- | -- |
| manage_automations | Yes | Yes | Yes | -- | -- | -- | -- | -- | -- | -- |
| manage_billing | Yes | -- | -- | -- | -- | -- | -- | -- | -- | -- |
| manage_settings | Yes | Yes | Yes | -- | -- | -- | -- | -- | -- | -- |
| view_analytics | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | -- | Yes |
PPM Operations
| Permission | org_owner | tenant_admin | site_admin | pmo_mgr | portfolio_mgr | proj_mgr | sponsor | dept_mgr |
|---|---|---|---|---|---|---|---|---|
| manage_projects | Yes | Yes | Yes | Yes | Yes | Yes | -- | -- |
| manage_portfolio | Yes | Yes | -- | Yes | Yes | -- | -- | -- |
| manage_resources | Yes | Yes | Yes | Yes | -- | -- | -- | Yes |
| approve_gates | Yes | Yes | -- | Yes | Yes | -- | Yes | -- |
| manage_documents | Yes | Yes | Yes | -- | -- | -- | -- | -- |
Permission Enforcement
Permission checks are enforced server-side in the tRPC layer using createRoleProtectedProcedure. Key enforcement points:
| Permission Token | Required Role Level | Used By |
|---|---|---|
manage_settings | Admin (level <= 10) | Organization settings, API keys, SSO, webhooks |
manage_members | Admin (level <= 10) | Inviting, role changes, removal |
manage_billing | Owner (level 0) | Plan changes, payment methods |
The canAssignRole function verifies that the caller's highest role level is numerically lower (more privileged) than the role they are trying to assign. The canModifyMember function applies the same check when changing or removing an existing member.
Custom Roles (Enterprise)
Enterprise plan customers can create custom roles with granular permissions:
- Navigate to Settings > Roles.
- Click + Create Role.
- Enter a role name, hierarchy level, and description.
- Toggle individual permissions from the 23-permission set.
- Click Save.
Custom roles integrate with the same enforcement engine as built-in roles. They can be assigned at both organization and workspace levels.
Workspace-Level Roles
Workspace-level roles override organization roles for a specific workspace, enabling fine-grained access control:
| Role | Description | Pharma Use Case |
|---|---|---|
| Workspace Admin | Full control within the workspace | Site OpEx coordinator managing a single site workspace |
| Workspace Member | Create and edit content | Production operators entering daily data |
| Workspace Viewer | Read-only access | Cross-site auditors reviewing another site's boards |
Enterprise Role Design Patterns
Pattern 1: Multi-Site Pharma with Central PMO
org_owner → CIO (1 person)
tenant_admin → IT Directors (2-3 people)
site_admin → Site IT Leads (1 per site)
pmo_manager → Head of PMO
opex_coordinator → OpEx Directors (1 per site)
department_manager → Production/Engineering/QC Managers
quality_manager → QA Managers
team_leader → Shift Supervisors
project_manager → Tech Transfer / Capital Project Leads
team_member → Operators, Technicians, Analysts
guest → External Auditors, Consultants
Pattern 2: Contract Manufacturing Organization (CMO)
org_owner → COO
tenant_admin → Operations Director
site_admin → Site Managers
quality_manager → Client QA Representatives (per-client workspace)
team_leader → Line Supervisors
team_member → Operators
guest → Client Auditors (workspace-scoped)
Recovery Procedures
| Scenario | Resolution |
|---|---|
| Admin accidentally removed from org | org_owner re-invites with the appropriate role(s) |
| Privilege escalation detected | Review audit log, revoke excess roles, file a deviation report |
| User needs temporary elevated access | Assign additional role, set a calendar reminder to remove it, document in change control |
| Role assignment blocked ("insufficient privilege") | A higher-level admin must perform the assignment |
Best Practices
- Follow the principle of least privilege -- assign the minimum role needed for each person's responsibilities.
- Use multi-role assignment for cross-functional access instead of over-provisioning a single high-privilege role.
- Conduct quarterly access reviews in Settings > Members to verify role assignments remain appropriate.
- Use the Audit Log to monitor all role assignment changes.
- Document role-to-job-function mappings in your CSV User Requirements Specification.
Related Features
- Inviting Members -- Assign roles during the invitation process.
- Guest Access -- Configure limited board-only access for external stakeholders.
- Security Settings -- Enforce 2FA and session policies.
- Audit Log -- Track role assignment changes.