# Permission matrix

The authoritative permission catalog and exact seeded assignments are in `database/seeders/RolesAndPermissionsSeeder.php`. This handover matrix summarizes intended access; administrators must review the actual role screen after every seed or customization.

Legend: **M** manage/approve, **O** operational update, **V** view/report, **—** no default access.

| Default role | Admin/users | Flights/dispatch | Fleet | Maintenance/inventory | Finance/fuel | Crew | Reports/audit |
|---|---|---|---|---|---|---|---|
| Super Administrator | M | M | M | M | M | M | M |
| Airline Administrator | M | M | M | M | M | M | M |
| Operations Manager | — | M | O | V | O/V | V | V |
| Flight Dispatcher | — | M | O/V | V | O/V | V | — |
| Fleet Manager | — | V | M | M | V | — | V |
| Maintenance Manager | — | — | O | M | V | — | V |
| Engineer | — | — | V | O | — | — | — |
| Finance Manager | — | — | V | V/M purchasing | M | — | V |
| Accountant | — | — | — | V | O/M | — | V |
| Crew Manager | — | V | — | — | — | M | V |
| Pilot | — | V | V | — | — | V/self-service where configured | — |
| Cabin Crew | — | V | V | — | — | V/self-service where configured | — |
| Ground Operations | — | O | O/V | V | O fuel | V | — |
| Auditor | V | V | V | V | V | V | V/audit |
| Executive Viewer | V | V | V | V | V | V | V/executive |

Permissions use `module.action`, including view/create/edit/manage/approve/pay/release/assign/export forms. Server middleware and services enforce them. Navigation visibility is not a security boundary.

## Administration rules

- Grant the least privilege and required airline bases only.
- Separate entry, approval, and payment/release duties where staffing allows.
- Do not grant log, session, integration credential, role, or settings permissions to operational viewers.
- Audit role assignments and permission changes; review privileged roles quarterly.
- Custom roles are airline-scoped. Never copy role rows across airlines without recreating scoped assignments.