Roles and permissions

The three personas EPMS administration recognises, what each one may do, and the full action matrix behind the navigation. The matrix is computed from the shipped code, so it cannot drift from it. Changing a cell records a request; it does not change what the running application enforces.

Personas: 5
Actions governed: 54
Cells in the matrix: 270
Overrides recorded: 0
Open questions answered: 0
Pending changes: 0

Personas

What each persona is for, what it may and may not do, and which screens it reaches.

Administrator

Owns the configuration of EPMS. Reaches every area of this application and may change anything that is not mastered elsewhere.

Allowed

Configure reference data, project types, gate templates, approval chains and routing rules
Configure the organisation — regions, country teams and the scope profile for each business persona
Grant one person access to one project, and revoke it
Grant and remove EPMS access, and grant only the personas they hold themselves
Administer external access and the access policy
Change platform settings, notification templates and feature flags

Not allowed

Edit CRM-mastered lists such as growth pillars
Edit a gate template version that has live projects on it
Read secured rate and margin values
Remove the last remaining administrator
Give a scope profile an edit or approve level wider than its read level
Make an approval depend on one named person, or set a pool below two people
Change the restriction kind on a project — that is mastered by the CRM

Screens

All screens

Finance administrator

Owns cost, charge and margin configuration. Sees the money columns nobody else sees, and stays out of access administration.

Allowed

Read and change cost rates, charge rates, margin and overhead values
Read secured columns wherever they appear, including change history
Configure resourcing, capacity and reference data
Change platform settings

Not allowed

Reach internal user administration, external access or the access policy
Reach CRM field mapping or the integration log
Grant EPMS access to anyone

Screens

Reference data, Project types, Gate templates, Approval chains, Routing rules, Feedback form, Resources, Capacity, Cost rates, Notifications, Tutorials, Settings, Business rules, Roles & permissions, Changelog

IT Support

Spec role R8. Same rights as Administrator in this prototype, including adding and removing Manual project team members. A review persona only: the live personas stay at the eight the All Users app holds until All Users and Platform 1 add it.

Allowed

Everything the Administrator can do
Add and remove Manual members on Project teams

Not allowed

Be recorded on a user as a persona yet — it is not in the live persona set
Decide on a change suggestion

Screens

All screens

Read-only auditor

Reads configuration and change history across the whole application and changes nothing anywhere.

Allowed

Open every area of the application
Read configuration, change history and integration events
Export and cite what they see

Not allowed

Create, edit, deactivate or reassign anything
Read secured rate and margin values — those read “(secured)”
Grant or remove access
Decide on a change suggestion

Screens

All screens

Suggestion approver

Owns the decision on a change suggestion. The only persona that may promote one to a business rule, keep it for later, discard it, or move it back to waiting.

Allowed

Promote a change suggestion to a business rule
Keep a suggestion for later, discard it, or move it back to waiting
Raise suggestions, comment on business rules and read the Platform area

Not allowed

Reach configuration, access administration, resourcing or integration
Be read as narrower than it is — holding edit rights so it can still comment also lets it change the other Platform screens it reaches, which is accepted for a review device

Screens

Notifications, Tutorials, Settings, Business rules, Roles & permissions, Changelog

Scope matrix

Read, edit and approve level per persona. These are the scope profiles under Access — one source of truth, edited from either screen.

Scope by persona, read from the scope profiles under Access
Level	Persona	Read	Edit	Approve	Reporting	Profile

Global read with regional edit is Read=Organisation plus Write=Business Unit in one Dataverse security role. Country is a team, not a business unit.

These values are the scope profiles under Access → Scope profiles. Changing one here changes it there; there is no second copy.

Rules that apply to everyone

Constraints that hold whichever persona is acting.

Nothing is deleted. A record is deactivated and keeps its history.
Every change that widens or narrows access is written to the audit trail with the reason given.
A change made here is a recorded request. The running application keeps behaving the way the shipped defaults describe until the change has been built.
No approval may depend on one named person, and no approver pool may fall below two people.
An edit or approve level may never be wider than the read level of the same profile.
CRM-mastered values — growth pillars, strategic accounts and the restriction kind on a project — are read here and changed in the CRM.
Country is a team, not a business unit. A user belongs to exactly one business unit.
Secured rate, margin and overhead values read “(secured)” for every persona but the finance administrator.

Open questions

The security-workshop questions this application is still waiting on. Anyone may record a response; a response does not resolve the business rule waiting on it.

Q14
Does a restriction cover commercial values as well as technical files?
Unanswered
Q15
Does a local NDA block a global responsible from seeing the project detail?
Unanswered
Q16
What is the escalation threshold in days? “Two weeks” was a holiday example, not an SLA.
Also tracked in EPMS All Users, where a response is recorded.
Unanswered
Q18
Which approval loop applies to which project type?
Unanswered
Q19
Is an Area level needed as a fourth scope level, or do three levels plus own records suffice?
Unanswered

Action matrix

Every navigable area and named exception, computed from the shipped code.

Action	Administrator	IT Support	Finance administrator	Read-only auditor	Suggestion approver
Configuration
Open reference data
Change reference data
Open project types
Change project types
Open gate templates
Change gate templates
Open approval chains
Change approval chains
Open routing rules
Change routing rules
Open feedback form
Change feedback form
Publish a new gate template version
Access
Open organisation & scope
Change organisation & scope
Open scope profiles
Change scope profiles
Open cross-country access
Change cross-country access
Open project teams
Change project teams
Open internal users
Change internal users
Open external access
Change external access
Open access policy
Change access policy
Grant or remove EPMS access
Deactivate an internal user and reassign their workload
Resourcing
Open resources
Change resources
Open capacity
Change capacity
Open cost rates
Change cost rates
Integration
Open crm field mapping
Change crm field mapping
Open integration log
Change integration log
Platform
Open notifications
Change notifications
Open tutorials
Change tutorials
Open settings
Change settings
Open business rules
Change business rules
Open roles & permissions
Change roles & permissions
Open changelog
Change changelog
Turn a deferred capability on
Decide on a change suggestion — promote, keep, discard or move back to waiting
Cross-cutting
Read secured rate, margin and overhead values

None of this is enforced server-side in the prototype. Persona switching re-renders navigation and disables controls so the shape of each role can be reviewed; the Power Apps build must re-implement these rows as Dataverse security roles and column security profiles.