Roles & access
Civicore's role model, scopes, and how access is enforced.
Civicore uses scoped role-based access control (RBAC). Every role membership is bound to a scope, which determines what data a user can see and what actions they can take.
Roles
| Role | Primary jobs |
|---|---|
| ASPIRANT | Publish profile, manage campaign, view personal analytics |
| PARTY_ADMIN | Manage party profile, roster, announcements, party analytics |
| CAMPAIGN_MANAGER | Run daily ops - tasks, events, volunteer assignments |
| COORDINATOR | Geo-scoped coordination, local announcements, field reporting |
| VOLUNTEER | Register, view assignments, log activity, RSVP to events |
Scopes
Memberships are bound to a scope:
- National - Presidential races, national party leadership
- Party - Party-wide administration
- County - Governor, Senator, Women Rep races
- Constituency - MP races
- Ward - MCA races
- Campaign - Campaign-specific team roles
- Aspirant - Aspirant-personal team roles
How authorisation is enforced
Authorisation is enforced on the backend, on every protected endpoint. The UI is a hint, not a
gatekeeper. If a user is not authorised, the API returns 403 regardless of what the UI shows.