User roles¶

A person's role decides what they can do in the archive. Every protected action checks the user's role against a minimum required role. Roles are strictly ordered, so a higher role can do everything a lower one can.

The role hierarchy¶

Roles are ranked by privilege level. A request is allowed when the user's level is greater than or equal to the level the action requires.

Ownership rules¶

For object-level actions, role is combined with ownership of the resource:

_

A locked object is exempt from these rules: once locked, only a Supervisor (or higher) can edit or delete it, regardless of ownership. See Object flags.

Permissions by resource¶

Minimum role required per operation. Public means no authentication is required (anonymous access).

Account & settings¶

Authentication is stateless: the archive trusts a bearer token issued by your organization's login provider, so there are no in-app sessions or passwords. See Authentication for the technical model.

Items¶

Item sets¶

Media¶

Vocabularies, classes & properties¶

Metadata values¶

Comments¶

Staff can leave internal comments on objects (Items, Item Sets, Media).

Object flags¶

Two boolean flags can be set on any object (Item, Item Set, Media):

Triage¶

External links¶

Extracted metadata¶

Activity log¶

Each user sees their own activity-log entries. In addition, every object exposes an audit trail: the changes made to that object by any user, including field-level before/after values. Both are read-only.

System logs¶

User administration¶

Any signed-in user can read their own profile. Reading another user's profile needs Supervisor. List all is open to Researcher so admin owner pickers can resolve names, while paginated list, full read, and stats stay Supervisor.

System & migration¶