Functional contract

RBAC

The role and action catalog is global, owned by SuperUsers. Organization and Location administrators only assign or revoke those roles on Staff.

Catalog and assignment shipped Location switcher shipped

Catalog vs assignment

Layer	Who	What
Catalog	SuperUser at `/admin/roles` and `/admin/actions`	CRUD roles, CRUD actions, attach/detach actions on a role
Assignment	Organization and Location administrators at `/app/settings?tab=users` (`GET /app/staffs` redirects)	Assign or revoke catalog roles on Staff
Invite	Organization administrator at the same tab (`POST /app/staffs`)	Create a pending Staff (and a User when the email is new). Resend or withdraw pending invites. Disable/enable memberships without changing the User

Tenants never mutate the catalog. SuperUsers are gated by session, not by a tenant action key. Impersonating a staff User from /admin/users uses that User’s Staff RBAC; it does not grant catalog or elevated tenant rights.

Model

RbacAction (global key, resource, verb, scope, system) Role (global key, scope organization|location, system) └── RoleAction Staff (User + Organization) └── StaffRoleAssignment (role, optional location)

Organization-scoped role: location_id nil; every Location in the Organization.
Location-scoped role: Location required; that site only.
Staff may hold several assignments.
System roles and actions cannot be destroyed. organization_administrator always keeps staff.roles.assign.

Rbac.sync! seeds the catalog. Organization.provision! assigns the founder org-wide Organization administrator.

Who may assign

Actor	May
SuperUser	Mutate the catalog only
Organization administrator	Assign or revoke any catalog role in the Organization. Invite, resend, withdraw, disable/enable staff
Location administrator	Location-scoped roles only, at Locations they admin. Cannot assign org-scoped roles. Cannot invite, resend, withdraw, or disable
Everyone else	No assignment UI

The last Organization administrator in an org cannot be removed.

Default roles

Role	Scope	Grants
Organization administrator	Organization	All tenant actions, including `staff.roles.assign`
Organization manager	Organization	Org-wide reads and `reports.organization`
Location administrator	Location	Site ops, `catalog.override`, `soap.manage`, location-scoped role assignment
Receptionist	Location	Appointments, visits, patients, billing, reports.read (SOAP read only)
Veterinarian	Location	patients.manage, appointments.read, visits, `soap.manage`, catalog.read, inventory.read

Location-scoped actions include patients.*, appointments.*, visits.*, soap.manage, inventory.*, billing.*, checkout.*, invoices.*. Clinic invoices use invoices.*; SaaS Settings billing keeps billing.*. Full action list and acceptance: docs/functional/rbac.md. Access rules: Staff access.