Roles and access

Who uses the system, which workspace they sign in to, what they can see and change, and which decisions wait for their approval.

Responsibility profiles Approval policy Users Open roles and permissions

Staff roles

External roles

Approval types

one central policy, provisional

Sample employees in the prototype

names are invented

Small team, combined roles. One person can hold several roles. In the first months operations lead and learner support may be the same person; the roles stay separate so that they can be split without redesign. The source review described both one role per person and several; this revision resolves it in favour of several assigned roles, each with its own record scope.

People and the roles they hold

Employee, system user and instructor are separate linked records

Person	Record	Sign-in	Roles	Record scope	Workspace

Read from the shared sample data. An employee may have no sign-in; a contract instructor has a sign-in without employment. See data model: people and roles and scenario 6: employee lifecycle.

Six actions

Granted per role and per module

Action	What it allows	Example in the prototype
View	Read records inside the scope	A sales employee reads the plan target allocated to them
Create	Add a new record	Any employee creates a purchase request or a leave request
Edit	Change a record that is not locked	Finance edits a supplier bill before approval
Approve	Decide a request according to the approval policy	The owner approves a plan baseline or a payroll run
Export	Take data out; restricted fields stay masked	An employee directory export without pay columns
Administer	Configure rules, roles and settings of the module	An administrator edits risk triggers or scoring rules

The per-action grid for each role is on roles and permissions. The matrix on the next tab is the short version.

Record scopes

The same action, on fewer or more records

Scope	Records covered	Example
Assigned record	Records the person owns or is assigned to	An account manager’s accounts, tenders, leads and quotations
Team	Records of the people who report to the person	A line manager sees the team’s leave requests and totals
Branch	Records of one location or business unit, where applicable	Not used by the sample data; kept for expansion
Organisation	All records of MALYOMAR	Owner; Finance for financial records
Partner	Records of one partner organisation and the services it is authorised to deliver	A partner user in the partner portal

Scopes per role are listed on the staff roles tab and set per person on responsibility profiles. How one record reaches each role in a detail page, a search result, a notification, an export and an assistant answer is shown there under Restricted information; what each assistant may read and who decides is in the capability register, with the planning and recovery advisor as the worked example. The restriction is demonstrated on those screens and in the staff workspaces; the search box and the assistant drawer in the top bar do not change with the person viewing, and nothing is enforced on a server.

Relevance and permission are separate. A workspace shows what is relevant to a role by default. It grants nothing. A sales employee can monitor a target without being able to edit the approved baseline.

Sensitive fields. Pay, costs, instructor rates and margins are restricted by role and scope. The restriction applies the same way to detail pages, search results, exports, notifications and AI answers.

Static hiding only. The “View as” switch in the back office hides menus and fields for the demonstration. It is not enforced authorization, and a static prototype cannot verify production access control.

Website visitor

Public website

Anyone, not signed in. Engineers looking for a course, training managers looking for a supplier, employers checking a certificate.

Sees: Published courses, academies, paths, public batches, experts, knowledge hub, events.
Can do: Enrol, request a proposal, register for a webinar, ask the chat, verify a certificate by code.
Never sees: Draft or private courses, private corporate batches, other people's data.
Entry: Home, Courses, Verify a certificate

Learner

Learner portal

An engineer with at least one enrolment, paid personally or seated by a company. Sample: Aya Mostafa.

Sees: Own courses, progress, schedule, certificates, CEUs, own orders and invoices, own tickets.
Can do: Study, join sessions, take quizzes, download certificates, request a transfer or refund, open a ticket.
Never sees: Other learners' results; company-paid invoices; classmates' contact details.
Entry: Home, My courses, Certificates

Instructor

Instructor portal

A human expert who delivers batches. May be staff or external. ASME-authorized status is a field on the instructor record and limits which programs can be assigned. An external instructor has a sign-in and an agreement and is not an employee: no payroll, no leave. A person can be both an employee and an instructor, as the owner is in the sample data.

Sees: Own sessions, rosters of own batches, materials of own courses, own payouts.
Can do: Set availability, confirm attendance, mark assessments, upload materials, propose content changes.
Never sees: Prices paid, client contracts, other instructors' payouts, the sales pipeline.
Entry: Home, Roster, Availability

Corporate L&D manager

Corporate portal

The client-side person responsible for a team's training. Sample: Adel Mansour at Sample Gas Pipelines.

Sees: Own company's people, seats, cohort attendance and results, programs, proposals, invoices.
Can do: Assign seats, upload participants, request training, accept a proposal, download invoices and certificates.
Never sees: Other companies; learners' personally paid courses unless the learner shares them.
Entry: Overview, Team and seats, Invoices

Partner user

Partner portal

A person at an approved partner organisation that supplies an instructor, a venue, certification or another service to a joint delivery. Sample: Rasha Tawfik at .

Sees
Can do: Confirm the assigned service, see the roster needed for that service, follow the settlement status of own organisation.
Never sees: Other partners’ terms and settlements, the customer’s price and order, MALYOMAR’s margins, learners outside the authorised delivery.
Entry: Overview, Deliveries and settlements

What is shared with a partner follows the agreement.

Privacy decision for the owners. When a company pays for a seat, the company sees attendance and results for that course. Whether it also sees the learner's other MALYOMAR history is a policy choice; the prototype assumes it does not.

Module rows come from the back-office navigation. The live system refines each level per record and per action on roles and permissions. Columns for HR, Purchasing and Partner and rows for the new modules were added in this revision. Staff cells now agree with the menu each role gets in “View as”; cells that changed are highlighted. Every employee also has their own HR self-service and can raise a purchase request, whatever the module level shown here.

Approval policy

Open the approval policy Tasks and approvals

This table is rendered from the one central matrix that every form, inbox item and permission text reads. It replaces the table that was typed on this page, where the approver and limit for discounts, refunds, payouts and credit terms differed from other screens. The matrix is a draft for management review. Approval types added in this revision have no monetary default: the limit is a setting shown as not set. Every approval is written to the audit log with who, when and what changed.

Operational decisions outside the matrix

Rule-based steps that also wait for a named person

Decision	Requested by	Decided by	Rule in the prototype	Screen
Batch go, merge or cancel		Operations lead	Seats sold below break-even. One deadline rule, measured on one reporting date.	Batch, Booking rules
Publishing a course or price change	Operations, instructor	Owner	Every publish; ASME programs follow ASME content unchanged	Course editor
Certificate issue	System, at batch close	Operations lead	Attendance and assessment rule met; exceptions listed	Issued certificates
Campaign send	Marketing	Marketing lead or owner	Any send to more than 500 contacts; any AI-drafted text	Campaign
Case study or client logo published	Marketing	Owner, with written client permission	Always	Knowledge hub content

These five rows are kept from the earlier table. They carry no monetary threshold. Decisions with a threshold or a second approver are in the policy above and nowhere else.

Segregation of duties. The person who requests a refund or payout is never the one who approves it.

AI never approves. Assistants can draft, score and suggest. Sending, issuing and paying need a named person. See AI layer.

Stand-ins. Each approval type needs a second approver for leave and travel. To be named by the owners. Delegation is part of open decision DEC-03.