How access is controlled

Enforced where the data is

Every table has row-level security. What you can read and write is decided by the database each time you ask, not by which pages the interface offers you.

This matters because interfaces can be bypassed. A crafted request that skips the page still meets the same policy.

Organisation roles

Inside an organisation, a member holds one role and, optionally, extra named permissions granted individually.

• Owner — full control of the organisation.
• Manager — properties, leasing, maintenance and the team.
• Leasing officer — listings, viewings and applications.
• Accountant — accounting and financial records.
• Maintenance manager and maintenance staff — work orders and vendors.
• Viewer — read only.

Capabilities, not job titles

Policies ask a capability question, such as whether you may write accounting records for this organisation, rather than checking your title. Owners and managers hold every capability in their organisation; other roles hold sensible defaults; anything else can be granted to an individual member explicitly.

Only owners and managers can manage the team. That one is not grantable to other roles.

Membership status

A membership is invited, active, suspended or removed, and only an active membership carries any permission at all. Suspending a member removes their access without deleting the record of what they did.