Sheaf
Roles and access
Three roles, three rights, and per-section rules on top. Enforced on every request, for people and API keys alike.
Roles
| Role | In short |
|---|---|
| Originator | Starts cases, uploads, runs and files. |
| Underwriter | The same rights; decisions are recorded under this role. |
| Manager | The same, plus the organization itself: people, API keys and webhooks. |
Every role holds the three platform rights: view, upload and edit. The server checks the right on each request. A capability the screen does not offer you is one the server also refuses.
The current table is shown under Settings in the app.
Section rules
On top of the platform rights, each section of an expected document list says per role who sees it and who may add to it. An upload into a section your role may not add to is refused with a 403 that names the section.
Organizations
Everything belongs to exactly one organization. A request for something in another organization answers 404, never 403: from outside, it does not exist.
API keys
A key acts as an Originator of its organization. It cannot reach people, keys, webhooks or passwords. See authentication.