Roles and permissions

FlaskTrack applies organization-scoped role checks to both the interface and server requests. The interface may hide actions a user cannot perform, but server-side authorization remains authoritative.

Organization administrators manage membership and role assignments from the organization area.

Standard roles

Role	Typical use
Owner	Organization control, billing, security, membership, and high-risk administration.
Admin	Day-to-day administration, reviews, controlled configuration, and operational oversight.
Scientist	Scientific authoring, execution, data review, and reporting.
Technician	Assigned execution, observations, evidence capture, and routine updates.
Viewer	Read-only review for collaborators, quality personnel, or auditors.

Exact permissions can change with the selected action, entity state, compliance policy, and deployment configuration.

Practical assignment guidance

• Keep the number of Owners small.
• Assign Admin only to people who manage organization-wide configuration.
• Use Scientist for protocol and workflow authors who do not need membership or billing control.
• Use Technician for operators who execute approved work.
• Use Viewer for read-only access; do not use shared viewer accounts.

Sensitive actions

Operations such as approving controlled records, releasing a batch, publishing a molecular sequence, exporting validation evidence, changing roles, or managing integrations may require a specific role, an electronic signature, or both.

Access reviews

Review membership regularly and whenever responsibilities change. Deactivate or remove users who no longer require access, revoke unused API keys, and terminate sessions that are no longer recognized.

See organization management, access requests, and account security.