Skip to main content
Version: 3.1

Roles and Permission

Definition​

A role in Care is a named set of permissions. A permission allows one action, for example to register a patient. Care builds every permission into the product, so you cannot create or change a permission. You group permissions into a role, and then you give the role to a user.

Note: Roles and permissions belong to Care's access control. FHIR R5 has no resource for them, so this concept has no FHIR reference.

You reach roles from the Admin sidebar. Select RBAC, then select Roles. To see the permissions of every role, select RBAC, then select Permissions.

Note: Only a super administrator can create, change, or clone a role.

Key Attributes​

ComponentsWhat it captures
NameThe name of the role. The name is required and must be unique.
DescriptionA short text that explains the purpose of the role. The description is optional.
ContextsThe places where you can assign the role. Select one or more contexts.
PermissionsThe actions that the role allows. Select one or more permissions.

Contexts​

A context tells Care where a role applies. A role has one or more of these contexts:

  • Facility — you can give the role to a user who works in a facility.
  • Government Organization — you can give the role to a user in a government organization.
  • Responsibility — you can give the role to a user in a responsibility organization.

System roles​

Care includes system roles. A system role shows a System badge and a lock icon in the roles list. You cannot edit or delete a system role. To start from a system role, clone it into a new custom role, and then change the clone.

The system roles are Volunteer, Doctor, Nurse, Staff, Pharmacist, Administrator, Facility Admin, and Admin.

Care also includes three system roles for the Responsibility context: Admin, Manager, and Member.

The permissions matrix​

The Permissions page shows a read-only matrix. Each row is a permission. Each column is a role. A green check mark shows that the role holds the permission. A red cross shows that the role does not hold the permission. To change what a role allows, edit the role.

How a user gets a role​

A user gets a role when you add the user as a member of one of these:

  • An organization
  • A facility, through its root department
  • A responsibility
  • A department

Each membership carries exactly one role. That role decides what the user can do in that scope.

Care protects access in two ways:

  • You can assign only a role with permissions that you also hold. You cannot give a user more access than you have.
  • Care keeps the last Facility Admin in the root department of a facility. You cannot change the role of that user. You also cannot remove the last user from the root department.