Custom Roles in the Existing RBAC

Beautinda already has a role-based permission system. However, the existing roles are currently predefined.

I would like studio owners to be able to create their own roles and configure the respective permissions individually.

For each user-defined role, it should be possible to specify which data and functions employees are allowed to view, edit, or perform.

Examples:

• Show or hide phone numbers

• Show or hide email addresses

• Show or hide addresses

• View customer notes and customer history

• Create, edit, or delete customer data

• Create, edit, or cancel appointments

• View sales, prices, and statistics

• Use cash register and administrative functions

Background

Requirements vary significantly depending on the studio, position, and area of responsibility. Fixed standard roles can only account for these differences to a limited extent.

In our industry, there is also a comparatively high employee turnover rate. Not every employee needs full access to customer data such as phone numbers, email addresses, or mailing addresses. Targeted data masking could significantly hinder unauthorized access to customer data and the potential poaching of customers.

Objective

The existing RBAC should be expanded to include the following capabilities:

• Create custom roles

• Copy existing roles

• Enable or disable permissions individually

• Assign read, edit, and delete permissions separately

• Fully or partially mask sensitive customer data

• Assign roles to individual employees

This would allow studio owners to implement the principle of least privilege and grant each employee only the access rights that are actually necessary for their job.