Roles & Permissions
Decentralized Role Management (RBAC). Each add-on defines its own roles and capabilities in its own scoped screen, while HR sees every module's roles in one master matrix with a domain filter and override control.
Overview
TotalApp uses Decentralized Role Management: every add-on ships with its own Roles screen — the first icon in its sidebar, right after My Apps — where that add-on's manager creates roles and binds them to capabilities without ever leaving the add-on. A Legal firm administrator opens Legal → Roles and works only with Legal roles and Legal capabilities; they never see Healthcare or Payroll permissions.
All of these roles are written to a single, tenant-scoped store, and every role is tagged with a domain (LEGAL, HEALTHCARE, PAYROLL, …) in the background — the manager never fills in a "type" field. HR then reads that same store as a master matrix in HR → Organization → Roles & Permissions, where an HR admin can see every module's roles at once, filter by domain, and override any of them.
Implicit Domain Tagging
The domain is set from the screen's context, not by the user. Create a role inside the Legal add-on and it is stored with domain: LEGAL automatically. Add-on screens then filter to GLOBAL plus their own domain, so each add-on shows only relevant roles — while HR, the single source of truth, sees the whole set.
Roles vs. Capabilities
A Role is a named bundle (e.g. Paralegal). A Capability is a single fine-grained permission scoped to a domain (e.g. Draft Contracts, Approve Contracts). You bind capabilities to a role once; assigning that role to a person then grants all of its capabilities at once, instead of ticking permissions per person.
Scoped Capability Picker
When a Legal manager builds a role, the capability list shows only Legal (plus any cross-cutting Global) capabilities. This scoping is a security boundary: no add-on can grant another add-on's permissions.
Approver Flag
Some capabilities (e.g. Approve Contracts, Manage Legal Staff) carry approval authority. A role that includes any of them is automatically marked as an Approver role, surfaced with a badge in both the add-on screen and the HR matrix.
Out-of-the-Box Roles
Each add-on seeds sensible default roles the first time its Roles screen is opened, so a customer can start adding staff without defining a single role by hand. Defaults are marked Default; roles you create are marked Custom.
Legal Out-of-the-Box Roles
Installing the Legal add-on seeds three ready-to-use roles:
| Role | Capabilities |
|---|---|
| Senior Partner | All Legal capabilities + approval authority (Approver) |
| Associate Lawyer | Standard Legal capabilities for day-to-day matter work |
| Paralegal | Restricted read/draft capabilities in support of lawyers |
Creating a Custom Role (Add-on)
- Open the add-on's Roles screen (e.g. Legal → Roles).
- Click Add Role.
- Enter a Role Name (e.g. "Trainee Lawyer") and an optional Description.
- Tick the Capabilities this role should grant — only this add-on's (and Global) capabilities are shown.
- Click Save. The role is stored with this add-on's domain tag and appears immediately in the list — and in HR's master matrix.
Edit or delete a role from its row action; deleting asks for inline confirmation first.
HR Master Matrix
In HR → Organization → Roles & Permissions, HR sees every domain's roles in one table. A Domain filter dropdown narrows the view (e.g. "show only Healthcare roles"), and each row shows the role's domain badge, capability count, and whether it's a Default or Custom role. HR can edit or delete any role here — including ones created inside an add-on — giving HR final override control while day-to-day role authoring stays decentralized in each add-on.
Global Search
Each add-on's Roles screen is searchable from the top-bar global search — searching "roles" surfaces the module-qualified result (e.g. Roles (Legal)), so you can jump straight to a specific add-on's roles from anywhere.
Frequently Asked Questions
roles/roles.json), each tagged with its domain. Add-on screens filter that store by domain; HR reads the whole store as a master matrix.