Roles & Permissions
MQUAD uses a sophisticated Permission-based Access Control system. While users are assigned roles for convenience, their actual capabilities are determined by a list of granular permission strings.
Technical Implementation
Unlike traditional role systems that rely on boolean flags (like is_admin), MQUAD checks for specific permission identifies in the user's session:
super:admin— Global platform control.host:manage_tenants— Ability to create and manage workspaces.full:access— Unrestricted access within a tenant.
Role Hierarchy
The following roles provide sets of permissions for common tasks:
| Role | Scope | Description |
|---|---|---|
| Super Admin | Global | Full platform access. Identified by the super:admin permission. |
| Host Admin | Global | Workspace management. Identified by the host:manage_tenants permission. |
| Workspace Admin | Tenant | Full control within a single workspace. |
| Survey Admin | Tenant | Full control over specific assigned surveys. |
| Survey Editor | Tenant | Can modify survey content and responses but cannot publish or delete. |
| Member | Tenant | Standard user who can create surveys and view data. |
| Guest | Tenant | Read-only access to specific surveys or dashboards. |
Default Permission Matrix
| Permission String | Super Admin | Host Admin | Workspace Admin | Member |
|---|---|---|---|---|
super:admin | ✓ | - | - | - |
host:manage_tenants | ✓ | ✓ | - | - |
tenant:manage_settings | ✓ | ✓ | ✓ | - |
survey:create | ✓ | ✓ | ✓ | ✓ |
user:manage | ✓ | ✓ | ✓ | - |
data:export | ✓ | ✓ | ✓ | ✓ |
Assigning Permissions
Permissions are assigned via the User Management screen. When a role is selected, the corresponding permission set is automatically applied to the user's profile.
Custom Roles & Permissions
Advanced users can create custom roles that pick and choose individual permissions. This is useful for roles like "Data Auditor" or "Field Supervisor" who need specific access without full administrative rights.
- Navigate to Admin > Roles.
- Click Create Role.
- Select the required permissions from the comprehensive list.
- Assign the new role to any user.
Changes to permissions take effect immediately upon the next user action or session refresh.