Permissions: role-based access control for review

[markkerzner]

Summary

Permissions — control what each user can see and do, via roles.

Scope

• Role-based access (e.g., admin, reviewer, read-only; separation of duties).
• Scope access per project/case and, where relevant, per document set.
• Governs tagging, redaction, export/production, and admin functions.

Why

Required for multi-user teams (esp. with external members). Supersedes the default admin/admin posture flagged in #68. Maps to FreeEed HECVAT APPL-01 (RBAC) / APPL-05 (separation of duties) — overlaps the Tulane security build.

Related

• [SECURITY] Review web app: default admin/admin credentials over plaintext HTTP #68 (default admin/admin over plaintext HTTP — security), Team-management + Audit-trail issues.

---

Contributed by Marlon Sanguino (Scaia team), recorded 2026-08-23. Part of the team-collaboration / governance cluster; implement later (post current-state release). Source: FreeEedCRM product-feedback.md.