Role Assignment

All data visibility, navigation surfaces, and API permissions derive from the assigned role. Assigning the wrong role creates immediate security risks: a Peer Mentor with Coordinator access could approve their own activities; a Coordinator missing elevated access cannot perform proxy registrations their workflow requires. For organizations managing large volunteer cohorts, efficient role management during onboarding, promotions, and restructures reduces operational overhead and eliminates reliance on manual support processes. Role changes that are immediate and audited maintain access hygiene across the platform lifecycle.

Role assignment is implemented as a widget in UserDetailPage, calling PATCH /api/v1/users/{id}/role. The backend validates the caller's Org Admin membership and permitted role set. Changes invalidate cached claims; next token refresh returns updated role claims, enabling near-instant permission propagation without forced logout. The mobile RBAC service rebuilds the module registry from new JWT claims. The admin portal enforces role constraints server-side on every request - no client-side check is authoritative. All changes are recorded in the audit log with before/after state, acting admin, and timestamp.