Roles & permissions reference
These are the default templates. An engagement lead can change any role’s
permissions, or add a custom role, on the engagement’s Manage access screen.
PlatformAdministrator holds everything unconditionally and isn’t in the table.
Default permissions by role
Section titled “Default permissions by role”| Permission | Engagement Lead | Consultant | Client EA Lead | Client Exec Sponsor |
|---|---|---|---|---|
| Read each graph layer (business, application, data, motivation, implementation, technology, finance) | all | all | business, application, motivation, implementation | motivation |
| Write each graph layer | all | all | — | — |
| Approve Tier 1 / Tier 2 / Tier 3 candidates | ✓ | ✓ | — | — |
| Resolve conflicts | ✓ | ✓ | — | — |
| Generate deliverables | ✓ | ✓ | — | — |
| Export deliverables | ✓ | ✓ | — | — |
| Approve deliverables | ✓ | — | — | — |
| Configure the engagement | ✓ | — | — | — |
| Manage the team / create roles | ✓ | — | — | — |
| Advance a phase | ✓ | — | — | — |
| Record client commitment | ✓ | — | ✓ | ✓ |
| Contribute to the standards library | ✓ | ✓ | — | — |
| Portal — read | ✓ | ✓ | ✓ | ✓ |
| Portal — comment / act | ✓ | — | ✓ | — |
A pack-provided downstream role, where a domain pack supplies one, typically holds read on every layer plus deliverable read/export and portal read — read-only, for the team that implements the design. The default deployment has no such role.
How enforcement works
Section titled “How enforcement works”Most of the model is enforced by named permission on the server — every graph layer’s read and write, plus deliverable, portal, tier-2/3-approval, and most engagement-management actions. A few operations (tier-1 auto-approval, conflict resolution, role creation, phase advance) still fall back to a coarser “is this person on the engagement” check. The Security page has the current detail.