7. System Administration

Role-based Access Control (RBAC)

The application defines access levels using hierarchical configurations.

VIEWER: Limited to Read-Only (GET) actions.
USER: Allowed Standard interactions (POST, PATCH for assigned assets).
SOCIAL MEDIA: Scoped to the Social Media dashboard only. Members see that one section in the sidebar (plus the user manual and their own profile); any other URL redirects back to /social, and every other API route rejects the role. Within Social Media they run the roster: adding and editing accounts, filing logs and recording metrics. Deleting an account and revealing a stored password remain ADMIN-only.
ADMIN: Omni-access configuration.

Navigate /admin/users; only accessible to existing ADMIN roles.
Review the data table.
Toggle the role selector from USER to ADMIN.
Outcome: Privileges update synchronously; user may need to re-authenticate for backend JWT tokens to inherit new metadata.