Users

Everyone who can sign in to the portal for your organization. Users are deactivated, never deleted. Export the list for an access recertification.

Add user

This screen answersUS-55 US-54 OP-6 OP-10

Acceptance criteria

US-55 Deactivate (not delete) User HIGHEST NEW SCREEN

As an administrator, I want to deactivate rather than delete users, so that account history is retained for audit while access is revoked.

Users deactivated, not hard-deleted; history retained for audit.
Deactivated users cannot authenticate.

US-54 Account Lockout + Admin Unlock HIGHEST NEW SCREEN

As an administrator, I want the ability to manually unlock accounts, so that locked users can be recovered under control.

Lockout policy: threshold (failed attempts before soft-lock): 5, Lock duration (auto-unlock): 15 mins, Counter Reset: after every successful login.
Admin can manually unlock a locked account.
Given an account soft-locks 3 times within 24 hours, when the 3rd lock occurs, then it becomes a hard lock requiring admin unlock (no auto-unlock).
Given a hard lock or a suspicious pattern (multiple accounts locking, or one account from many sources), when detected, then an admin is notified via in-app alert and email.
Given a hard lock, when the admin reviews it, then the failed-attempt history (from the audit log) is visible to support the decision.

OP-6 CSV export and print P1 OPERATIONAL REVIEW

As a desk user, I need to export a list to CSV and print a result, so I can hand it to finance or file it with the patient.

Every list has Export with CSV. The export says how many rows it holds and is logged.
Eligibility, authorization and claim results have Print or save as PDF.
A role that cannot read a list cannot export it.

OP-10 Audit coverage and break-glass P1 OPERATIONAL REVIEW

As a compliance owner, I need every sensitive action logged and a sealed emergency account, so nothing happens unseen.

The audit log also records cancel, quarantine replay, assign, take over, export and an administrator opening a clinical or finance record.
An administrator cannot change their own role. The attempt is blocked and logged.
Signing in with the break-glass account raises a security alert and an email to the other administrators.

Wireframe state

DefaultLocked onlyConfirm deactivateMulti roleBreak glassExported

Read only. You are an Auditor: read only. You can read and export this page. Changes need an administrator.

Deactivate Maha Al-Mutairi?

She can no longer sign in. Her history stays for audit, and nothing is deleted. You can reactivate her later and she gets a new temporary password.

Written to the audit log with your name. Open her account on User detail to check her role first.

CancelDeactivate

CSV downloaded. users-and-roles-2026-10-05.csv is ready: 17 rows, with the filters you set. The export is logged in the audit log.

For access recertification. The file lists each user, role, facility and status, so an access recertification can be signed off. Handle it like the audit log.

Several roles on one account. One person can hold several roles, each at its own place in the organization. Faisal Al-Dosari is A/R for all three facilities and A/P for Facility A. Administrator is never one of several.

Break-glass administrator. The break-glass account is for emergencies only. It is sealed by Compliance, it is never listed for deactivation, and every sign in raises a security alert to the other administrators.

See the alert

Active

can sign in

Locked

need attention

Deactivated

history kept

Waiting for first sign in

temporary password issued

Locked accounts. 2 accounts are locked. Turki Al-Anazi is hard locked and needs you. Review locked accounts

User	Role	Facility	Status	Last sign in
Hadeel Al-Qahtanih.alqahtani@alraneem-hospital.example	Administrator	All facilities	Active	Today 08:12	Open
Layla Al-Harbil.alharbi@alraneem-hospital.example	Receptionist	Facility A	Active	Today 07:58	Open
Omar Al-Zahranio.alzahrani@alraneem-hospital.example	Insurance approval officer	Facility A	Active	Today 08:40	Open
Reem Al-Otaibir.alotaibi@alraneem-hospital.example	Claims officer	Facility A	Active	Today 08:31	Open
Faisal Al-Dosarif.aldosari@alraneem-hospital.example	Accounts receivable (A/R)	Facility A	Active	Yesterday 16:20	Open
Noura Al-Shehrin.alshehri@alraneem-hospital.example	Accounts payable (A/P)	Facility A	Active	Yesterday 15:02	Open
Sami Al-Ghamdis.alghamdi@alraneem-hospital.example	Receptionist	Facility B	Active	Today 07:45	Open
Maha Al-Mutairim.almutairi@alraneem-hospital.example	Insurance approval officer	Facility B	Active	3 Oct 2026	Open
Turki Al-Anazit.alanazi@alraneem-hospital.example	Claims officer	Facility A	Locked	4 Oct 2026 17:44	Open
Dalal Al-Rashidd.alrashid@alraneem-hospital.example	Receptionist	Facility B	Locked	Today 08:47	Open
Khalid Al-Subaiek.alsubaie@alraneem-hospital.example	Claims officer	Facility A	Deactivated	12 Aug 2026	Open
Sara Al-Mutairis.almutairi@alraneem-hospital.example	Viewer (read-only)	Facility A	Active	Yesterday 11:30	Open
Khalid Al-Anazik.alanazi@alraneem-hospital.example	Auditor (read-only)	All facilities	Active	Today 08:02	Open

User	Roles and where each applies	Status	Last sign in
Hadeel Al-Qahtanih.alqahtani@alraneem-hospital.example	Administrator, Group	Active	Today 08:12	Open
Layla Al-Harbil.alharbi@alraneem-hospital.example	Receptionist, Facility A	Active	Today 07:58	Open
Omar Al-Zahranio.alzahrani@alraneem-hospital.example	Approval officer, Facility A	Active	Today 08:40	Open
Reem Al-Otaibir.alotaibi@alraneem-hospital.example	Claims officer, Facility A Approval officer, Facility B	Active	Today 08:31	Open
Faisal Al-Dosarif.aldosari@alraneem-hospital.example	A/R, Facilities A, B, C A/P, Facility A	Active	Yesterday 16:20	Open
Noura Al-Shehrin.alshehri@alraneem-hospital.example	A/P, Facility A A/R, Facility A	Active	Yesterday 15:02	Open
Sami Al-Ghamdis.alghamdi@alraneem-hospital.example	Receptionist, Facility B	Active	Today 07:45	Open
Maha Al-Mutairim.almutairi@alraneem-hospital.example	Approval officer, Facility B	Active	3 Oct 2026	Open
Turki Al-Anazit.alanazi@alraneem-hospital.example	Claims officer, Facility A	Locked	4 Oct 2026 17:44	Open
Dalal Al-Rashidd.alrashid@alraneem-hospital.example	Receptionist, Facility B	Locked	Today 08:47	Open
Khalid Al-Subaiek.alsubaie@alraneem-hospital.example	Claims officer, Facility A	Deactivated	12 Aug 2026	Open
Sara Al-Mutairis.almutairi@alraneem-hospital.example	Viewer, Facility A	Active	Yesterday 11:30	Open
Khalid Al-Anazik.alanazi@alraneem-hospital.example	Auditor, All facilities	Active	Today 08:02	Open

User	Role	Facility	Status	Last sign in
Break-glass administratorSealed by Compliance	Emergency access only	All facilities	Sealed	Never	Every sign in raises an alert
Hadeel Al-Qahtanih.alqahtani@alraneem-hospital.example	Administrator	All facilities	Active	Today 08:12	Open
Layla Al-Harbil.alharbi@alraneem-hospital.example	Receptionist	Facility A	Active	Today 07:58	Open
Omar Al-Zahranio.alzahrani@alraneem-hospital.example	Insurance approval officer	Facility A	Active	Today 08:40	Open
Reem Al-Otaibir.alotaibi@alraneem-hospital.example	Claims officer	Facility A	Active	Today 08:31	Open
Faisal Al-Dosarif.aldosari@alraneem-hospital.example	Accounts receivable (A/R)	Facility A	Active	Yesterday 16:20	Open
Noura Al-Shehrin.alshehri@alraneem-hospital.example	Accounts payable (A/P)	Facility A	Active	Yesterday 15:02	Open
Sami Al-Ghamdis.alghamdi@alraneem-hospital.example	Receptionist	Facility B	Active	Today 07:45	Open
Maha Al-Mutairim.almutairi@alraneem-hospital.example	Insurance approval officer	Facility B	Active	3 Oct 2026	Open
Turki Al-Anazit.alanazi@alraneem-hospital.example	Claims officer	Facility A	Locked	4 Oct 2026 17:44	Open
Dalal Al-Rashidd.alrashid@alraneem-hospital.example	Receptionist	Facility B	Locked	Today 08:47	Open
Khalid Al-Subaiek.alsubaie@alraneem-hospital.example	Claims officer	Facility A	Deactivated	12 Aug 2026	Open
Sara Al-Mutairis.almutairi@alraneem-hospital.example	Viewer (read-only)	Facility A	Active	Yesterday 11:30	Open
Khalid Al-Anazik.alanazi@alraneem-hospital.example	Auditor (read-only)	All facilities	Active	Today 08:02	Open