Skip to main content

Personas & roles

Who uses the system and what they do. The disciplinary domain has a rich cast; the PoC models them as an app_role enum but (tacitly) enforces almost none of the distinctions — see the caveat at the end.

The cast (as the domain intends)​

Role (app_role)PT labelWhat they do in a case
super_adminSuper AdminPlatform operator; manages all companies (cross-tenant)
hr_adminAdmin RHRuns the company's HR; opens cases, invites users, manages settings
case_managerGestor de ProcessosDay-to-day owner of a case; drives it through the phases
instructor_internalInstrutor InternoAppointed to investigate — runs diligências, writes the relatório
instructor_externalInstrutor ExternoSame, but an outside instructor (e.g. a lawyer)
legal_reviewerRevisor JurídicoReviews the Nota de Culpa / legal soundness
deciderDecisorApproves the final decision — the one enforced gate
employeeTrabalhador (Arguido)The person under investigation (portal, not login)
witnessTestemunhaGives evidence in a diligência
external_counselMandatário/AdvogadoThe employee's lawyer (portal access)

Legacy roles from the whistleblower pivot — company_admin, case_handler, viewer — still exist in the enum and are aliased to the new ones. See Role model.

The separation of duties the domain wants​

The roles exist to encode separation of duties, which is itself a fairness safeguard:

  • the instructor investigates and proposes (proceed vs archive) but does not decide;
  • the legal reviewer independently checks the accusation;
  • the decider makes the final call — and is the only role the workflow actually gates on (FINAL_REPORT→CLOSED needs decision_approval by a decider).

This separation is the legally meaningful part of the role model, and a rebuild should make it real.

Two audiences, two surfaces​

   INTERNAL (authenticated app)              EXTERNAL (token portal, no login)
   ┌────────────────────────────┐           ┌──────────────────────────────┐
   │ hr_admin, case_manager,    │  invites  │ employee (arguido),          │
   │ instructor, legal_reviewer,│──────────▶│ external_counsel             │
   │ decider, super_admin       │  portal   │                              │
   │                            │  link     │ • view visible documents     │
   │ • run the 8 phases         │◀──────────│ • submit response + files    │
   │ • produce documents        │ submission│   (during RESPONSE_WINDOW)   │
   │ • export the dossier       │           │ • every action logged        │
   └────────────────────────────┘           └──────────────────────────────┘

The tacit caveat (important)​

Despite this rich cast, the running app is effectively binary: isSuperAdmin vs everyone-else. Nav, permissions, and destructive actions gate on one or two booleans, not on the specific role; and the database's RLS enforces company membership, not the role matrix. So the separation-of-duties above is aspirational in the PoC, not enforced.