Permissions

Orgo Permissions is the role-based access control system within Orgo that governs which features and data users can access, based on permission domain (ADMIN, HR, FINANCIAL, EVENT, COMMUNICATION) and scope level (organization, regional, or local). Built for organizations that delegate admin work across chapters, regions, or committees, including professional associations, alumni networks, trade unions, and faith communities that need different people to manage different areas at different levels of the organization. Replaces shared admin logins and informal trust-based access for routine, ongoing responsibilities, not for one-off exceptions, where direct permission assignment to a single user profile is still the documented approach. Unlike organizational roles, permissions directly grant access to features and data.

Looking for how to create positions like “President” or “Secretary”? See Roles for organizational structure.

Permission Domains Overview

Orgo has 6 permission domains, each controlling a specific area of the platform:

Domain	Purpose	Key Capabilities
ADMIN	Full platform control	All settings, billing, integrations, user management
HR	Member management	Profiles, adhesions, resignations, imports, badges
HR_ASSISTANT	Support tasks	Identity validation, GDPR requests, gamification
FINANCIAL	Money matters	Products, fees, payments, financial reports
EVENT	Event management	Create events, manage attendance, reports
COMMUNICATION	Messaging	Newsletters, discussion moderation

ADMIN is the highest permission - users with ADMIN have access to everything, including all other domains.

Domain Comparison

What Can Each Permission Do?

This table shows which features each permission domain controls:

Feature	ADMIN	HR	HR_ASSISTANT	FINANCIAL	EVENT	COMMUNICATION
Organization Settings	✅	❌	❌	❌	❌	❌
Billing & Subscription	✅	❌	❌	❌	❌	❌
Module Configuration	✅	❌	❌	❌	❌	❌
API & Integrations	✅	❌	❌	❌	❌	❌
Local Center Settings	✅	❌	❌	❌	❌	❌
User Permission Management	✅	❌	❌	❌	❌	❌

View/Edit Member Profiles	✅	✅	❌	❌	❌	❌
Process Adhesions	✅	✅	❌	❌	❌	❌
Handle Resignations	✅	✅	❌	❌	❌	❌
Member Imports	✅	✅	❌	❌	❌	❌
Manage Badges	✅	✅	❌	❌	❌	❌
Official Gazette	✅	✅	❌	❌	❌	❌
Export Members	✅	✅	❌	❌	❌	❌

Identity Validation	✅	✅	✅	✅	❌	❌
GDPR Data Requests	✅	✅	✅	✅	❌	❌
Gamification / Hours	✅	✅	✅	✅	❌	❌

Manage Products	✅	❌	❌	✅	❌	❌
Configure Fees	✅	❌	❌	✅	❌	❌
Process Payments	✅	❌	❌	✅	❌	❌
Financial Reports	✅	❌	❌	✅	❌	❌
Stripe Configuration	✅	❌	❌	✅	❌	❌

Create/Edit Events	✅	❌	❌	❌	✅	❌
Manage Attendees	✅	❌	❌	❌	✅	❌
Event Check-in (QR)	✅	❌	❌	❌	✅	❌
Event Reports	✅	❌	❌	❌	✅	❌
Courses	✅	❌	❌	❌	✅	❌

Create Newsletters	✅	❌	❌	❌	❌	✅
Moderate Discussions	✅	❌	❌	❌	❌	✅
Manage Discussion Categories	✅	❌	❌	❌	❌	✅

Detailed Domain Descriptions

ADMIN - Full Platform Control

Who needs it: Executive team, IT administrators, platform managersWhat it controls:

All organization settings and configuration
Billing, subscription, and payment gateway setup
Feature flags and module activation
API access and integrations
User permission assignment
Local center creation and settings

Important: ADMIN permission grants access to everything. Users with ADMIN can do anything that HR, FINANCIAL, EVENT, or COMMUNICATION can do.

Be careful assigning ADMIN. These users have access to all organization data, financial information, and can modify any settings.

HR - Member Management

Who needs it: HR staff, membership officers, secretariesWhat it controls:

View and edit member profiles
Process membership adhesions (applications)
Handle member resignations
Import members in bulk
Manage badges and gamification
Access Official Gazette
Export member data
View birth dates and personal information

Includes: HR permission automatically includes HR_ASSISTANT capabilities.

HR_ASSISTANT - Support Tasks

Who needs it: Volunteers helping with membership, identity validatorsWhat it controls:

Identity document validation
GDPR data requests processing
Gamification and training hours tracking
View (not edit) member information

Note: This is a lighter permission for users who need to help with specific HR tasks without full member management access.

FINANCIAL - Money Matters

Who needs it: Treasurers, finance officers, accountantsWhat it controls:

Create and manage products
Configure membership fees
Process payments and refunds
View financial reports and statistics
Manage Stripe integration
Export financial data

Includes: FINANCIAL permission automatically includes HR_ASSISTANT capabilities (for viewing member info related to payments).

EVENT - Event Management

Who needs it: Event coordinators, activity managersWhat it controls:

Create and edit events
Manage event attendees
Check-in participants (QR scanning)
Generate event reports
Manage courses and training sessions
Configure event ticketing

Does NOT include: Financial event settings (ticket pricing) require FINANCIAL permission.

COMMUNICATION - Messaging

Who needs it: Communications officers, community managersWhat it controls:

Create and send newsletters
Moderate discussion forums
Manage discussion categories
Pin/delete discussion posts
Send announcements

Permission Hierarchy

Permissions have a hierarchy where higher permissions include lower ones:

ADMIN ─────────────────────────────────────────────────
   │                                         (highest)
   ├── HR ──────────────┬── HR_ASSISTANT
   │                    │
   ├── FINANCIAL ───────┘
   │
   ├── EVENT
   │
   └── COMMUNICATION

Automatic Inclusions

If user has…	They automatically get…
ADMIN	All permissions (HR, FINANCIAL, EVENT, COMMUNICATION, HR_ASSISTANT)
HR	HR_ASSISTANT
FINANCIAL	HR_ASSISTANT

Example: A user with HR permission can also validate identities and manage gamification (HR_ASSISTANT features) without needing a separate assignment.

Scope Levels (TENANT / PARENT_LOCAL / LOCAL)

Each permission domain can be assigned at different scope levels that control what data the user can access:

Scope	Suffix	What data can they access?
Organization	`_TENANT`	All data across the entire organization
Regional	`_PARENT_LOCAL`	Parent local center + all its child centers
Local	`_LOCAL`	Only their assigned local center

How it works

The same permission at different scopes gives access to the same features, but limited to different data:

Permission	Features	Data Access
`HR_TENANT`	Member management	All members in organization
`HR_PARENT_LOCAL`	Member management	Members in parent center + children
`HR_LOCAL`	Member management	Members in own local center only

Key principle: _TENANT permission automatically covers all _PARENT_LOCAL and _LOCAL data within that domain.

Visual Example

National Organization (TENANT)
├── Region North (PARENT_LOCAL)
│   ├── Branch A (LOCAL)
│   ├── Branch B (LOCAL)
│   └── Branch C (LOCAL)
└── Region South (PARENT_LOCAL)
    ├── Branch D (LOCAL)
    └── Branch E (LOCAL)

HR_TENANT      → Can manage members in ALL branches
HR_PARENT_LOCAL (Region North) → Can manage members in A, B, C only
HR_LOCAL (Branch A) → Can manage members in Branch A only

Complete Permission Reference

All Available Permissions

Permission	Domain	Scope	Level
`ADMIN_TENANT`	Admin	Organization	100
`ADMIN_PARENT_LOCAL`	Admin	Regional	95
`ADMIN_LOCAL`	Admin	Local	90
`HR_TENANT`	HR	Organization	83
`HR_PARENT_LOCAL`	HR	Regional	75
`HR_LOCAL`	HR	Local	70
`FINANCIAL_TENANT`	Financial	Organization	82
`FINANCIAL_PARENT_LOCAL`	Financial	Regional	55
`FINANCIAL_LOCAL`	Financial	Local	50
`HR_ASSISTANT_TENANT`	HR Assistant	Organization	81
`HR_ASSISTANT_PARENT_LOCAL`	HR Assistant	Regional	35
`HR_ASSISTANT_LOCAL`	HR Assistant	Local	30
`EVENT_TENANT`	Event	Organization	80
`EVENT_PARENT_LOCAL`	Event	Regional	50
`EVENT_LOCAL`	Event	Local	10
`COMMUNICATION_TENANT`	Communication	Organization	80
`COMMUNICATION_PARENT_LOCAL`	Communication	Regional	50
`COMMUNICATION_LOCAL`	Communication	Local	10

Level indicates permission strength. Higher level permissions can assign lower level permissions to other users.

Assigning and auditing

Recommended assignments, how to grant permissions, how to test them with impersonation, and how to see who currently holds what are all in Assigning Permissions.

Roles - Organizational positions and role management
User Types - Membership categories
Role Groups - Automatic role assignment

Home

Organization

Users & Profiles

Groups

Communication

Events

Payments & Fees

Governance

Resources

Support

Customization

Developers

Permissions

Permission Domains Overview

Domain Comparison

What Can Each Permission Do?

Detailed Domain Descriptions

Permission Hierarchy

Automatic Inclusions

Scope Levels (TENANT / PARENT_LOCAL / LOCAL)

How it works

Visual Example

Complete Permission Reference

All Available Permissions

Assigning and auditing

​Permission Domains Overview

​Domain Comparison

​What Can Each Permission Do?

​Detailed Domain Descriptions

​Permission Hierarchy

​Automatic Inclusions

​Scope Levels (TENANT / PARENT_LOCAL / LOCAL)

​How it works

​Visual Example

​Complete Permission Reference

​All Available Permissions

​Assigning and auditing

​Related Documentation

Permission Domains Overview

Domain Comparison

What Can Each Permission Do?

Detailed Domain Descriptions

Permission Hierarchy

Automatic Inclusions

Scope Levels (TENANT / PARENT_LOCAL / LOCAL)

How it works

Visual Example

Complete Permission Reference

All Available Permissions

Assigning and auditing

Related Documentation