System Roles (by priority)

#	Role	Priority	Description
1	SUPER_ADMIN	1	Platform super admin (Societee team)
2	SOCIETY_ADMIN	2	Society president/secretary
3	COMMITTEE_MEMBER	3	Managing committee member
4	TREASURER	4	Financial operations
5	SECRETARY	5	Administrative operations
6	ESTATE_MANAGER	6	Facility/property manager
7	ACCOUNTANT	7	Accounting operations
8	SECURITY_SUPERVISOR	8	Security team lead
9	RESIDENT_OWNER	9	Flat owner
10	RESIDENT_TENANT	10	Flat tenant
11	GUARD	11	Security guard (lightweight access)
12	VENDOR	12	External service vendor
13	STAFF	13	Society employee
14	MEMBER	14	Basic community member
15	CUSTOM	15	Custom role (per-society)

Permission Categories (67 total)

Category	Permissions	Examples
billing	8	billing.view, billing.create, billing.approve, billing.delete
accounting	8	accounting.view, accounting.journal, accounting.gst, accounting.tds
finance	6	finance.invoices, finance.payments, finance.receipts, finance.ledger
complaints	5	complaints.view, complaints.create, complaints.assign, complaints.resolve
visitors	5	visitors.view, visitors.approve, visitors.check_in, visitors.check_out
documents	6	documents.view, documents.upload, documents.delete, documents.letter_approve
facilities	5	facilities.view, facilities.book, facilities.cancel, facilities.manage
governance	7	governance.view, governance.meeting, governance.vote, governance.resolution
security	7	security.view, security.blacklist, security.gate, security.sos
admin	8	admin.society, admin.members, admin.roles, admin.features, admin.settings
reports	4	reports.financial, reports.operational, reports.compliance, reports.export

Database Tables

role_definitions (15 system + custom per-society)
  └── role_permissions (role_id + permission_key + grant/deny)

permission_definitions (67 permissions, 11 categories)

user_role_assignments (user_id + society_id + role_id, with expiry)
  └── KV-cached: key = "rbac:{userId}:{societyId}" → Set of permissions

Usage in Code

// Middleware: require specific permission
app.get('/v1/accounting/chart-of-accounts',
  authMiddleware,
  requirePermission('accounting.view'),
  async (c) => { ... }
);

// In handler: check permission dynamically
const canApprove = c.get('user').permissions.includes('billing.approve');

// Frontend hook
const { hasPermission } = useAuth();
if (hasPermission('reports.export')) {
  // Show export button
}

ABAC Overlay

ABAC (Attribute-Based Access Control) adds context-aware rules on top of RBAC. Evaluates conditions based on:

• User attributes: role, persona, flat_id, trust_score
• Resource attributes: society_id, ownership, status
• Environment: time of day, request origin, IP range
• Action: read, write, delete, approve