Docs/People & authority

Administrative roles and delegation

Screen 2.1 — publish agency administrative role templates, delegation ceilings, combination rules and maximum durations.

PEEK Platform Administrator · PEEK Technical Reviewer

/peek/customers/tenant-a/2-1

Live walkthrough · Administrative roles and delegation

The role catalog defines the administrative capability templates agencies can adopt. Templates are global catalog objects (type role, published with role_catalog.publish through the catalog lifecycle). No individual user is ever assigned here — assignment happens in the agency app, where every grant is checked against the grantor’s delegation ceiling.

Role template content

Agency role: Template name, description and administrative scope.
Capabilities: Agency capabilities such as agency.users.manage, agency.roles.assign, agency.access.review, agency.connections.configure / .rotate / .disable, agency.si.configure / .mode / .credentials, agency.policy.adopt, agency.modules.manage, agency.automation.manage, agency.authority.decide.
Handoff grants: Distinct business capabilities: handoff.submit, handoff.decide (accept or return) and handoff.review_change (changed-input review).
Delegation ceiling: The most this role may grant to others. Grants can never exceed the grantor ceiling.
Combination rules: Roles that may not be held together, each with a reason (separation of duties).
Record authority: Only none or scope_limited_audit_read; anything broader is a blanket grant and is rejected.

2.1 · Administrative Roles & Delegation

Define available administrative roles and delegation ceilings. Open it at /peek/customers/tenant-a/2-1 (any tenant ID you can access works in place of tenant-a). The primary action is Publish role catalog, which requires role_catalog.publish.

How 2.1 works

1. Maintain agency administrative capability templates, delegation ceilings and combination rules
2. Preview resulting authority

Screen 2.1 contract

Fields shown: Role capabilities, scope limits, combination rules, duration
Primary action: Publish role catalog
Required capability: role_catalog.publish
Validation: No template grants blanket business records. Submit, accept/return and changed-input review remain distinct. Grants cannot exceed the grantor ceiling.
Successful outcome: Versioned role catalog is available for agency adoption; no individual user is assigned here.
Screen states: Loading; empty; ready; restricted; stale; error; review pending
Audit event: admin.screen.2.1.action (acceptance test AT-UI-2.1)
Requirements: R02, R03, R04, R05, R06, R28, R29, R34, SYS02, SYS04, SYS06, SYS10, SYS11, SYS20, SYS23, UI-2.1

Boundary — Declare submit, accept or return, and changed-input review as distinct agency capabilities. PEEK role publication cannot perform business acceptance.

Rejected even if the browser allows it — Allow a source-only administrator to assign themselves user or SI administration through a forged request; deny it.

Related guides

Persona templates

Screen 2.2 — release recommended business personas with suggested functions, views and required data scopes.

Catalog lifecycle: draft, review, publish

How every “Publish …” screen works: draft, validation, independent technical review bound to the diff hash, then publish.

Handoff and synchronization governance

Screen 3.11 — publish package submission, human acceptance, immutable accepted versions and changed-input review rules.