DAC Academy — RBAC Matrix

1. ROLE DEFINITIONS

Role	Constant	Description	Typical User
`admin`	`USER_ROLE.ADMIN`	Full system access. Manage users, settings, all data.	Academy Director, Admin Staff
`counselor`	`USER_ROLE.COUNSELOR`	Admissions & fee management. Cross-branch read access.	Admission Counselor
`warden`	`USER_ROLE.WARDEN`	Hostel management. Scoped to assigned hostel.	Hostel Warden
`parent`	`USER_ROLE.PARENT`	Self-service portal. Only own children's data.	Parent/Guardian

Feature / Route	Admin	Counselor	Warden	Parent
Dashboard
`/dashboard` (Staff)	✅ View	✅ View	✅ View	❌
`/parent/dashboard`	❌	❌	❌	✅ View
Leads (CRM)
`/leads` (List)	✅ View, Create, Edit	✅ View, Create, Edit	❌	❌
`/leads/new`	✅ Create	✅ Create	❌	❌
`/leads/[id]`	✅ View, Edit	✅ View, Edit	❌	❌
Admissions
`/admissions`	✅ View	✅ View	❌	❌
`/admissions/new`	✅ Create	✅ Create	❌	❌
Students
`/students`	✅ View	✅ View	✅ View (hostel only)	❌
`/students/[id]`	✅ View	✅ View	✅ View (hostel only)	❌
`/students/[id]/edit`	✅ Edit	✅ Edit	❌	❌
Fees
`/fees` (Ledger)	✅ View	✅ View	❌	❌
Record/Edit/Void Payment	✅	✅	❌	❌
`/manual-receipts`	✅ Create	✅ Create	❌	❌
Hostel
`/hostel`	✅ View	❌	✅ View	❌
Medical Requests	✅ View	❌	✅ View (scoped)	❌
System
`/users`	✅ Manage	❌	❌	❌
`/settings`	✅ Manage	❌	❌	❌
`/audit-log`	✅ View	❌	❌	❌
`/whatsapp-log`	✅ View	❌	❌	❌
`/announcements`	✅ Create/Edit/Delete	❌	❌	❌
Parent Portal
Parent Dashboard	❌	❌	❌	✅ View
View Receipts	❌	❌	❌	✅ View (own)
Request/Cancel Outing	❌	❌	❌	✅ (own)
Medical Requests	❌	❌	❌	✅ (own)
Warden Portal
`/warden/students`	✅	❌	✅	❌
`/warden/medical`	✅	❌	✅	❌

Operation	Admin	Counselor	Warden	Parent
Branch Scope	All branches	All branches (read); own branch (write)	Own branch only	N/A
Hostel Scope	All hostels	N/A	Own hostel only	N/A
Student Scope	All students	All students	Hostel-opted only	Own children only

Every state-changing action generates an audit log entry with before/after state snapshots.

Action	Admin	Counselor	Warden	Parent
Login/Logout	✅	✅	✅	✅
Lead Create/Status Change	✅	✅	❌	❌
Admission Submit	✅	✅	❌	❌
Student Update/Lifecycle	✅	✅	❌	❌
Fee Payment/Void	✅	✅	❌	❌
Outing Request	❌	❌	❌	✅
Outing Review	✅	❌	✅	❌
Medical Request/Acknowledge	✅	❌	✅	❌
Medical Complete/Reject	✅	❌	✅	❌
Announcement/Session/Setting	✅	❌	❌	❌

Operation	Admin	Counselor	Warden
Read (list queries)	All branches	All branches	Own branch only
Write (mutations)	All branches	Own branch only	Own hostel only

Counselors have cross-branch READ access — can see all branches in lists, but write operations enforce their assigned branch
Wardens derive branch from hostel — their branch is resolved from linked hostel, not from user record
Parents can be staff — a user can simultaneously be a parent and have a staff role
Admin can impersonate warden — can access all warden routes and see all hostels
No role has DELETE permission — all deletions are soft deletes via isDeleted flag or voiding