Roles and permissions

Who can create, read, update, delete and execute in each module.

Assign roles to existing usersNew role

This screen answersUS-45 US-46 OP-5 OP-7 OP-8

Acceptance criteria

US-45 RBAC: Named Roles + CRUD Matrix HIGHEST NEW SCREEN

As an administrator, I want named roles with enforced CRUD permissions, so that each user type can only perform the actions appropriate to their job.

Ship named roles: admin, receptionist, insurance approval officer, claims officer, A/R, A/P.
CRUD permissions per role enforced on module actions (create/read/update/delete gated per role).
A user's role determines which modules/actions are visible and permitted.
Buttons/actions scope only (for row-level data isolation see US-52b).

US-46 User Migration + Default-Role Assignment HIGHEST NEW SCREEN

As an administrator, I want all existing users assigned a role when RBAC goes live, so that no one is locked out at rollout.

Every existing user assigned a role at RBAC go-live, no lockouts.
A safe default role defined for unmapped users.
Migration is reversible/auditable.

OP-5 Viewer and Auditor roles P1 OPERATIONAL REVIEW

As an administrator, I need two read-only roles, so management and compliance can look without acting.

Viewer is the go-live default for users nobody mapped (US-46). It never gets create, update, delete or run.
Auditor reads the audit log, users, roles and security settings at group scope, and nothing else is changed by it.
The legacy viewer role maps to Viewer, not to Receptionist.

OP-7 Permission matrix fixes P1 OPERATIONAL REVIEW

As an administrator, I need the permission matrix to match daily work, so people can do their job and no more.

A/R can read the status checker and reply on messages linked to a claim it chases.
Delete means a draft of your own, never a submitted record. Submitted records are cancelled.
An override above a threshold needs a second person in a later release. The override screen says so.

OP-8 Several roles per user and admin scope P1 OPERATIONAL REVIEW

As an administrator, I need one user to hold several roles and an administrator to work for one facility, so small teams and groups both fit.

A user can hold several roles at the same or different organization nodes. A list shows them all.
Administrator is never combined with a transactional role. The screen blocks it and says why.
Administrator has two scopes: group (roles, security, API, integrations, quarantine, codes) and facility (users, unlock, two-step reset for that facility).

Wireframe state

DefaultAdmin scopesMatrix notes

Read only. You are an Auditor: read only. You can read and export this page. Changes need an administrator.

Default roles. Eight roles ship with the portal: the six named in US-45 plus Viewer and Auditor, both read only. What a user can see and do follows their role. Buttons a role cannot use are shown disabled. Which facility they see is set separately, see Data scope. Adding your own roles needs approval first.

New role

Roles

Role	Today's portal role	Users	Scope
Administrator US-45Configures the portal: users, roles, organization, security, audit and API access. Reads every module for troubleshooting. Works at group scope or, as a facility administrator, for one facility only.	admin	2	All facilities	Edit
Receptionist US-45Front desk. Checks eligibility, finds patients and follows the worklist.	provider, operations	4	Per facility	Edit
Insurance approval officer US-45Requests and follows prior authorizations, answers Advanced Authorization and payer questions.	preauth, clinical	3	Per facility	Edit
Claims officer US-45Prepares and submits claims and batches, resubmits rejected ones and answers payer questions.	billing	4	Per facility	Edit
Accounts receivable (A/R) US-45Follows what payers owe: claim status, payment reconciliation and chasing rejections. Can work across several facilities.	finance	2	Per facility	Edit
Accounts payable (A/P) US-45Records payment notices and checks them against reconciliation. Often the same person as A/R (two roles on one user).	finance	2	Per facility	Edit
Viewer (read-only) AddedLooks, never acts. The safe default at go-live (US-46) for management, trainees and anyone nobody mapped. Never creates, changes or sends anything.	viewer	6	Per facility	Edit
Auditor (read-only) AddedCompliance and privacy review. Reads the audit log, users and roles across the group. Cannot change or delete anything, so the person who grants access is not the person who audits it.	(new)	1	All facilities	Edit

Administrator scopes

Open a facility administrator

	Group administrator	Facility administrator
Works at	The Al Raneem Group node and everything below it	One facility node, for example Facility A
Can do	Organization and structure, roles and permissions, users in any facility, security policy, API access, integrations, ICD-10 codes, audit log	Users of that facility, unlock accounts, two-step reset for those users
Cannot do	Cannot be combined with a transactional role on the same account	Cannot change roles, security policy, API access or the organization. Cannot see other facilities
Reads for troubleshooting	Every module, across all facilities	Every module, in its own facility
Assigned by	Raneem IT at go-live, then another group administrator	A group administrator, from the user page

Never combined with a transactional role. An administrator never works claims, authorizations or payments on the same account. Give the person a second account with a transactional role. At least one active group administrator is always required.

Reading the matrix

A/R has a status checker and replies on messages linked to a claim they chase. Prior authorization messages stay with the approval officer.
D on Eligibility, Prior Authorization and Claims means drafts only: you can delete your own drafts, never a sent request.
Override of a calculated financial value needs a second approver. The override and both names go in the audit log.
Viewer and Auditor only ever hold R. Nobody can add C, U, D or X to them.

Permission matrix

Module	Admin	Receptionist	Approval officer	Claims officer	A/R	A/P	Viewer	Auditor
Everyone
Home	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX
Inbox	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX
Journeys	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX
Work
Worklist	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX
Patients	CRUDX	CRUDX	CRUDX	CRUDX	None	None	CRUDX	CRUDX
Eligibility	CRUDX	CRUDX	CRUDX	CRUDX	None	None	CRUDX	CRUDX
Prior Authorization	CRUDX	CRUDX	CRUDX	CRUDX	None	None	CRUDX	CRUDX
Advanced Auth	CRUDX	None	CRUDX	CRUDX	None	None	CRUDX	CRUDX
Claims	CRUDX	None	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX
Claim Batch	CRUDX	None	None	CRUDX	CRUDX	None	CRUDX	CRUDX
Finance
Payments	CRUDX	None	None	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX
Communications
Communications	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX
APA Communication	CRUDX	None	CRUDX	None	None	None	None	None
Tools
Poll NPHIES	CRUDX	None	CRUDX	CRUDX	None	None	None	None
Status and cancel	CRUDX	None	CRUDX	CRUDX	CRUDX	None	None	CRUDX
Administration
Data sources	CRUDX	None	None	None	None	None	None	None
Data source changes	None	None	None	None	None	None	None	CRUDX
Organization	CRUDX	None	None	None	None	None	None	CRUDX
Users	CRUDX	None	None	None	None	None	None	CRUDX
Roles and permissions	CRUDX	None	None	None	None	None	None	CRUDX
Security policy	CRUDX	None	None	None	None	None	None	CRUDX
Audit log	CRUDX	None	None	None	None	None	None	CRUDX
API access	CRUDX	None	None	None	None	None	None	None
Go-live readiness	CRUDX	None	None	None	None	None	None	CRUDX
Integrations	CRUDX	None	None	None	None	None	None	None
Quarantined responses	CRUDX	None	None	None	None	None	None	None
ICD-10 codes	CRUDX	None	None	None	None	None	None	None
Account
Profile	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX	CRUDX

C CreateR ReadU UpdateD DeleteX Execute (poll, cancel)