# Roles By Module

This file maps roles to the modules where they receive permissions during seeding.

Sources:

- `src/Core/Database/Seeders/InstitutionRolePermissionSeeder.php`
- `src/Modules/Pos/Database/Seeders/PosPermissionSeeder.php`
- `src/Modules/Hr/Database/Seeders/HrPermissionSeeder.php`
- `src/Modules/Procurement/Database/Seeders/ProcurementPermissionSeeder.php`
- `src/Modules/Finance/Database/Seeders/FinancePermissionSeeder.php`

## Common/Core

Core permissions use the `common.*` permission namespace.

Roles with broad common/core access:

- `Institution Owner`
- `Institution Admin`
- `Branch Admin`

Roles with focused common/core access:

- `HR Manager` - users, roles, schedules, calendars, departments, and locations
- `Finance/Accounts` - reports, price books, and cash accounts
- `Operations Manager` - schedules, departments, locations, tasks, and reports
- `Compliance/Auditor` - audit logs and reports
- `IT Support` - integrations, devices, printers, institution configuration, and branch configuration

## Inventory

Inventory permissions use the `inventory.*` permission namespace.

Roles with full inventory access:

- `Institution Owner`
- `Institution Admin`
- `Branch Admin`
- `Operations Manager`
- `Inventory Manager`

Roles with focused inventory access:

- `Compliance/Auditor` - inventory view and list permissions
- `Procurement Officer` - item and stock view/list permissions
- `Storekeeper` - item view/list plus stock, batch, lot, store, location, cycle count, and alert permissions

## POS

POS permissions use the `pos.*` permission namespace.

Roles with full POS access:

- `Institution Owner`
- `Institution Admin`
- `Branch Admin`
- `Operations Manager`
- `administrator`

Roles with focused POS access:

- `Cashier`
- `cashier`

## HR

HR permissions use the `hr.*` permission namespace.

Roles with full HR access:

- `Institution Owner`
- `Institution Admin`
- `administrator`
- `HR Administrator`

Roles with focused HR access:

- `HR Officer` - all HR permissions except `hr.settings.manage`
- `Branch Manager` - HR dashboard, employees, attendance, schedules, leave approval, reports, team calendar, and POS attendance comparison
- `Employee` - self-service, attendance clocking, schedules, and leave requests

## Procurement

Procurement permissions use the `procurement.*` permission namespace.

Roles with full procurement access:

- `Institution Owner`
- `Institution Admin`
- `Branch Admin`
- `Operations Manager`
- `administrator`
- `Procurement Officer`

Roles with focused procurement access:

- `Compliance/Auditor` - procurement view and list permissions
- `Storekeeper` - goods receipt permissions

## Finance

Finance permissions use the `finance.*` permission namespace.

Roles with full finance access:

- `Institution Owner`
- `Institution Admin`
- `Branch Admin`
- `Finance/Accounts`
- `administrator`

Roles with focused finance access:

- `Finance Officer` - finance dashboard, accounts, journals, invoices, payments, expenses, and reports
- `Compliance/Auditor` - finance view and list permissions
- `Cashier` - invoice view/list, payment collection/view, and refund issue permissions

## Analytics

Analytics permissions use the `analytics.*` permission namespace. There is no `src/Modules/Analytics` folder at the time of writing; these permissions are seeded from the core role catalog.

Roles with full analytics access:

- `Institution Owner`
- `Institution Admin`
- `Branch Admin`

Roles with focused analytics access:

- `HR Manager` - workforce view
- `Finance/Accounts` - overview, financial, sales, branch/department comparison, drill-down, and analytics report permissions
- `Operations Manager` - overview, inventory, procurement, sales, workforce, branch/department comparison, drill-down, and analytics report permissions
- `Compliance/Auditor` - audit, drill-down, and report export permissions
- `Inventory Manager` - inventory view and report export
- `Procurement Officer` - procurement view and report export