User Roles, Multi-Partner Tags & Permissions Guide

Target Role: Organization Admins & Partner Admins

Administrators manage user roles, partner tags, and operational permission profiles under App Sidebar > Team Access (or /org-admin/access-control).

Overview

Dream Center Connect utilizes a role-based access control (RBAC) model enhanced with Multi-Partner Affiliation Tagging and Fine-Grained Operational Profiles. This ensures team members have the exact level of access required for their daily duties while enforcing data isolation between partner facilities.

graph TD
    User["User Identity"] --> PrimaryRole["1. Primary User Role"]
    PrimaryRole --> OrgAdmin["Organization Admin (Global)"]
    PrimaryRole --> PartnerAdmin["Partner Admin (Multi-Site)"]
    PrimaryRole --> Staff["Staff Member"]
    PrimaryRole --> Volunteer["Volunteer (Kiosk Check-In)"]

    Staff --> Profiles["2. Fine-Grained Operational Profiles"]
    Profiles --> SM["Schedule Manager (shifts:manage)"]
    Profiles --> NP["Needs Processor"]
    Profiles --> IS["Intake Staff"]
    Profiles --> PII["PII Reader (pii:read)"]
    Profiles --> DR["Duplicate Resolver"]
    Profiles --> Comms["SMS / Email Communicators"]

---

1. Primary User Roles

User Role	Access Scope	Operational Capabilities
Organization Admin	Global Network	Unrestricted access across all partner locations, tenant onboarding, 10DLC telephony provisioning, global audit logs, user impersonation, and executive reporting.
Partner Admin	Assigned Location(s)	Managing location staff, scheduling volunteer shifts, configuring facility closures, provisioning kiosks, and viewing site impact reports.
Staff	Operational Facility	Conducting intake, managing household records, creating/resolving shared needs, and logging shift hours.
Volunteer	Kiosk Terminal Only	Checking in and out at physical kiosk terminals using their mobile phone number across one or multiple partner programs. No web credentials required.

---

2. Fine-Grained Staff Permission Profiles

When inviting or editing a Staff user, administrators can assign specific operational capabilities:

📅 Schedule Manager

shifts:manage

• Grants staff permission to add volunteers to rosters, plan shift schedules, toggle facility closure blackout dates, and reconcile clock exceptions without requiring full Partner Admin credentials.

📋 Needs Processor

needs_processor

• Grants permission to claim shared needs, reassign staff owners, manage checklist subtasks, and transition need statuses to Resolved.

📝 Intake Staff

intake_staff

• Grants access to the Staff Intake Center to register walk-in or telephone constituents and submit new assistance requests.

🔒 PII Reader

pii:read

• Authorizes staff to click Reveal PII to inspect unmasked constituent phone numbers, personal emails, and residential addresses. All reveal events are logged to the security audit trail.

🤝 Duplicate Resolver

duplicate_resolver

• Authorizes staff to review duplicate matching recommendations, use the Field Conflict Resolver, and execute manual profile merges.

💬 SMS / Email Communicator

comm:sms & comm:email

• Authorizes staff to send direct outbound SMS text messages and transactional emails to constituents from the need detail timeline.

---

3. Multi-Partner Tagging & Affiliations

• Multi-Partner Affiliations: Organization Admins can assign users to multiple partner locations using multi-select partner tag pills in Team Access.
• Cross-Facility Mobility: Staff members holding multi-partner affiliations can switch between partner sites on their dashboard or clock in at different locations.
• Partner Privacy Boundary: Partner Admins can view and manage staff within their assigned location without exposing external organizational affiliations.

---

4. Member Provisioning Workflow

1. Go to App Sidebar > Team Access.
2. Click + Invite Member.
3. Enter First Name, Last Name, and Email Address.
4. Select the primary role (Organization Admin, Partner Admin, Staff, or Volunteer).
5. Assign Partner Location Tags and check desired Operational Profiles (e.g. Schedule Manager, PII Reader).
6. Click Send Invitation. The user receives an onboarding email directing them to complete profile setup and verify their mobile number via SMS OTP.