Roles and what they can do
eavantage separates the work so that no one person both drafts a deliverable and approves it. Access is role-based. Each role has a set of named permissions — per architecture layer (read / write), plus permissions for candidate approval, deliverables, the client portal, and engagement management.
The roles below are the starting templates. On an engagement’s Manage
access screen (/engagements/{id}/team), an engagement lead can adjust each
role’s permissions, or create a custom role.
Delivery-side roles
Section titled “Delivery-side roles”People at the firm running the engagement.
Engagement Lead
Section titled “Engagement Lead”Owns the engagement end to end. By default, holds every permission in the engagement.
- Can: configure the engagement; review and approve candidates at any tier; approve deliverables; manage the team and create roles; move a phase forward once its gate is met; contribute to the standards library.
- Can’t: be the only sign-off at closure — closure needs the client side too, and sealing the engagement is a platform-administrator action.
Consultant
Section titled “Consultant”Does the delivery work. By default, holds full read/write on every layer and can review candidates at every tier — a firm that wants tighter control tunes this on the Manage access screen.
- Can: upload artifacts, curate the model, score maturity, draft recommendations, review and approve candidates, generate and export deliverables, contribute to the standards library.
- Can’t: approve deliverables, manage the team, create roles, or advance a phase. This is the segregation-of-duties rule — a consultant who drafts a deliverable cannot be the one who approves it.
Downstream implementation role (pack-provided)
Section titled “Downstream implementation role (pack-provided)”Where a domain pack provides one (the AI-readiness and general-IT packs do not), a read-only role lets the team that will implement the design consume it.
- Can: read every layer of the model, and download and export the artifacts and deliverables.
- Can’t: change anything.
Without such a pack role, a downstream implementer can be given a scoped account with portal-read access to the handover package.
Platform Administrator
Section titled “Platform Administrator”Configures the platform itself, across engagements. Not an engagement-delivery role — access is unconditional (a flag on the account, not an engagement role).
- Can: everything, including standards-library governance, AI quality thresholds, user accounts, closure approval, and AI-usage analytics.
Client-side roles
Section titled “Client-side roles”These people work in the client portal, not the full application. The portal is the least-developed part of eavantage today (see The client portal).
Client EA Lead
Section titled “Client EA Lead”- Can: contribute documents, accept problem framings, record commitment decisions, provide one half of the closure sign-off, and read the higher-level parts of the model (capabilities, applications, motivation, implementation) through the portal. View and act.
- Can’t: edit the working model, or act in the full application.
Client Executive Sponsor
Section titled “Client Executive Sponsor”- Can: read the motivation layer, record commitment decisions, and provide the second half of the dual closure sign-off. Mostly view-only.
- Can’t: contribute documents or curate the model.
About permission enforcement
Section titled “About permission enforcement”eavantage enforces role-based access and the segregation-of-duties rule above. Beneath the roles, most of the permission model is enforced individually: every layer of the architecture model has its own read and write permission, and deliverable, client-portal, approval, and most engagement-management actions are each checked by permission. A few operations (tier-1 auto-approval, conflict resolution, role creation, phase advance) still fall back to a check that you’re staffed on the engagement. An engagement lead can set each role’s permissions from the Manage access screen on the engagement’s team page. The Security page has the full picture.