Access Control & Permissions Reference
This reference document explains how Role-Based Access Control (RBAC) works in AgroOps, how functional permissions control feature access, and provides the complete technical permissions appendix for system administrators.
1. Core Principles of AgroOps Security
When managing user access in AgroOps, keep these essential rules in mind:
- Permissions, Not Job Titles, Control Access: A job title alone (such as "Manager" or "Field Officer") does not automatically grant access to an action. The specific functional permissions assigned to that user account determine what they can see and perform.
- Tenant Scoping (Multi-Tenancy):
- Super Admin operates at the platform level with global oversight across all agribusiness companies.
- Farm Admin (Company Admin) is strictly confined to their own company (
company_id). They cannot view or modify data belonging to other agribusinesses.
- Delegated Administration Guardrails: A Company Admin can only assign permissions within their organization's purchased license tier and delegation boundaries.
- Custom Role Flexibility: AgroOps allows companies to create custom roles (e.g., Junior Field Scout, QC Specialist, Cooperative Clerk) combining exact sets of functional permissions to match their operational hierarchy.
2. Role Collaboration Matrix (RACI)
Agricultural operations involve multiple departments collaborating across the seed-to-field lifecycle. The matrix below defines the primary ownership:
| Activity | Accountable Owner | Supporting Roles | Key Prerequisites |
|---|---|---|---|
| Create Company Tenant | Super Admin | Company Admin | Contract agreement |
| Configure Company Access & Roles | Farm Admin | Department Leads | Employee onboarding |
| Configure Seed Catalog | Farm Admin / Agronomist | Lead Breeder | Varietal release certification |
| Receive & Inspect Seed Stock | Warehouse Manager | QC Lab Officer | Manufacturer lot & test report |
| Register & Verify Farmers | Field Officer (Collect) | KYC Officer (Approve) | Identity & land documents |
| Create Seasonal Crop Plans | Agronomist / Prod Manager | Field Officer | Approved farmer & plot |
| Calculate Seed Requirements | Agronomist | System Calculation | Variety seed rate (kg/acre) |
| Allocate Seeds from Depots | Warehouse Manager | Production Manager | Approved crop plan & unreserved stock |
| Confirm Physical Distribution | Field Officer | Warehouse Dispatcher | Serialized QR scan & delivery slip |
| Confirm Actual Sowing Date | Field Officer | Cultivating Farmer | Physical field sowing event |
| Conduct Field Inspections | Field Officer | Agronomist (Advisory) | Sowing date milestone trigger |
| Monitor Operational Reports | Farm Admin | Production Manager | Real-time system activity |
3. Collaboration Workflow Diagram
4. Functional Permission Categories
| Permission Category | What It Controls in the Application |
|---|---|
| Seed Master | View, create, update, and archive crop varieties, seed rates, and packaging specifications. |
| Seed Inventory | View warehouse stock, inward shipments, record QC decisions, and adjust stock quantities. |
| Farmer Management | Register farmers, update profiles, verify KYC documents, and manage land parcels. |
| Crop Plans | Create seasonal cultivation plans, edit acreage, calculate seed quotas, and publish plans. |
| Seed Allocations | View allocation requests, reserve warehouse lots, approve quotas, and process dispatches. |
| Field Inspections | View inspection schedules, conduct field visits, record pest scouting, and submit reports. |
| Reports & Analytics | View company KPI dashboards, export allocation sheets, and analyze harvest forecasts. |
5. Technical Permissions Appendix (For Administrators & Developers)
The following canonical permission codes are enforced at the backend API layer (Agroops_be/app/constants/permissions.py) and can be assigned to custom roles via the Role-Permission Matrix (/admin/permissions):
Seed Master & Inventory
seed_master:read— View seed products and varietal rates.seed_master:create— Register new crop varieties.seed_master:update— Edit seed rates, packaging, and maturity days.seed_master:archive— Deactivate discontinued varieties.inventory:read— View warehouse stock levels and batch trace views.inventory:create— Inward incoming seed lots.inventory:approve— Record quality inspection (QC) decisions (Approved,Quarantined,Rejected).inventory:dispatch— Authorize physical stock release for delivery.
Farmers & Document Center
farmers:create— Onboard new farmer profiles.farmers:read— View farmer directory and land parcel details.farmers:update— Edit farmer contact details and land holdings.farmer_document:view— View uploaded KYC and land records.farmer_document:upload— Upload photos/PDFs of Aadhaar, PAN, and Khasra.farmer_document:verify— Approve submitted documents as verified.farmer_document:reject— Reject submitted documents with reason notes.farmers:aadhaar_reveal— Sensitive permission: decrypt and view full Aadhaar numbers.farmers:bank_account_reveal— Sensitive permission: decrypt and view full bank account numbers.
Crop Plans & Allocations
crop_plans:read— View seasonal cultivation plans.crop_plans:create— Plan acreage for approved farmers and fields.crop_plans:update— Adjust acreage or planned sowing dates.crop_plans:delete— Cancel or archive draft crop plans.seed_allocations:read— View seed allocation queues and delivery statuses.seed_allocations:create— Create reservation requests against crop plans.seed_allocations:approve— Authorize seed release from warehouse stock.seed_allocations:process— Confirm physical distribution and record actual sowing dates.
Field Inspections & Operations
inspections:read— View scheduled crop inspection calendars.inspections:create— Submit field scouting observations, pest alerts, and crop photos.inspections:approve— Review submitted field reports and issue agronomic prescriptions.reports:read— Access executive dashboards and operational summaries.reports:export— Export farmer, inventory, and allocation rosters to CSV/Excel.