# Roles & Permissions {#roles--permissions}


MQUAD uses a sophisticated **Permission-based Access Control** system. While users are assigned roles for convenience, their actual capabilities are determined by a list of granular permission strings.


## Technical Implementation {#technical-implementation}


Unlike traditional role systems that rely on boolean flags (like `is_admin`), MQUAD checks for specific permission identifies in the user's session:
- `super:admin` — Global platform control.
- `host:manage_tenants` — Ability to create and manage workspaces.
- `full:access` — Unrestricted access within a tenant.


## Role Hierarchy {#role-hierarchy}


The following roles provide sets of permissions for common tasks:

| Role | Scope | Description |
|------|-------|-------------|
| **Super Admin** | Global | Full platform access. Identified by the `super:admin` permission. |
| **Host Admin** | Global | Workspace management. Identified by the `host:manage_tenants` permission. |
| **Workspace Admin** | Tenant | Full control within a single workspace. |
| **Survey Admin** | Tenant | Full control over specific assigned surveys. |
| **Survey Editor** | Tenant | Can modify survey content and responses but cannot publish or delete. |
| **Member** | Tenant | Standard user who can create surveys and view data. |
| **Guest** | Tenant | Read-only access to specific surveys or dashboards. |


## Default Permission Matrix {#default-permission-matrix}


| Permission String | Super Admin | Host Admin | Workspace Admin | Member |
|-------------------|:-----------:|:----------:|:---------------:|:------:|
| `super:admin` | ✓ | - | - | - |
| `host:manage_tenants` | ✓ | ✓ | - | - |
| `tenant:manage_settings` | ✓ | ✓ | ✓ | - |
| `survey:create` | ✓ | ✓ | ✓ | ✓ |
| `user:manage` | ✓ | ✓ | ✓ | - |
| `data:export` | ✓ | ✓ | ✓ | ✓ |


## Assigning Permissions {#assigning-permissions}


Permissions are assigned via the **User Management** screen. When a role is selected, the corresponding permission set is automatically applied to the user's profile.


## Custom Roles & Permissions {#custom-roles--permissions}


Advanced users can create custom roles that pick and choose individual permissions. This is useful for roles like "Data Auditor" or "Field Supervisor" who need specific access without full administrative rights.

1. Navigate to **Admin > Roles**.
2. Click **Create Role**.
3. Select the required permissions from the comprehensive list.
4. Assign the new role to any user.

Changes to permissions take effect immediately upon the next user action or session refresh.