Access control by role.
Decide what a receptionist, a doctor or an accountant can see. Permissions are stored as explicit grants rather than assumed from a job title, and every action lands in the audit log.
- Roles & permissions
- TOTP two-factor
- Audited
- One active phone
What each person can reach
Grant what each role needs and nothing else.
Roles, and what they may do
Permissions are records of their own and a role is a set of them, so access can be narrowed without inventing a new job title.
Staff get a role, not a login
Staff are managed from one screen, given a role, and can be deactivated without deleting their history.
Every action is attributed
Because each change is logged against the person who made it, access control and the audit log are the same story told twice.
Two-factor, from the first login
A new staff account is walked through TOTP enrolment on its first login and asked for a code on every one after that. An admin can reset a colleague's enrolment when a phone is lost.
One phone at a time
Signing in on a new phone revokes the session on the old one, and the old session records why it ended. A login does not quietly live on two handsets.
What it does not do
- Permissions scoped to a specialty