[docs] Roles and permissions concept and access governance flows

[github-actions]

Ezhuthachan

Closes the request in #60 (/document Access & Governance/Roles & Permissions).

The request named a domain and a topic rather than a domain/slug. I mapped it to the existing access-governance domain and the existing concept page concepts/access-governance/access-control.mdx, which is titled Roles & Permissions. <doc-types> was omitted, so I wrote a concept plus the flows for the resource. References for role, permission, and permission-association already exist and are accurate to the code, so I did not change them.

Files

Added, in version-3.0 and mirrored byte-identical to version-3.1:

• flows/access-governance/create-a-role.mdx
• flows/access-governance/assign-a-role-to-a-user.mdx
• flows/access-governance/_category_.json

Rewritten (whole file replaced), in both versions:

• concepts/access-governance/access-control.mdx — the previous page predated the concept template. It used What it represents / How a grant works / How access cascades / Standard roles / Permissions / Related, and it put permission slugs (can_create_organization) and context literals (GENERIC, FACILITY) in user-facing text. It now follows the template — Definition, Key Attributes with sub-sections, Permissions, Related — and uses the labels the user sees.

Changed:

• versioned_sidebars/version-3.0-sidebars.json and versioned_sidebars/version-3.1-sidebars.json — the flow sidebar is a manual list, so both new flows are added under a new Access & Governance flow category.

The slug access-control is kept, because concepts/access-governance/organization.mdx and concepts/access-governance/user.mdx already link to it.

Traced to

• care/security/roles/role.py — the 11 system roles, their descriptions, and their RoleContext values.
• care/security/permissions/constants.py — the PermissionContext values.
• care/security/permissions/organization.py, care/security/permissions/user.py — permission display names and the default role lists.
• care/security/api/viewsets/roles.py — permissions_controller: list and retrieve are open to any authenticated user; create, update and delete require a super user. validate_destroy blocks deleting a system role.
• care/security/api/viewsets/permissions.py — permissions are read-only over the API.
• care/emr/resources/role/spec.py — unique name, at least one permission, system roles rejected on write.
• care/emr/api/viewsets/organization.py (authorize_create / authorize_update / authorize_destroy / authorize_retrieve, validate_data) and care/security/authorization/organization.py (can_manage_organization_users_obj, check_role_subset) — the link/change/remove rules, including the "you cannot grant a role above your own" rule and the one-link-per-branch rule.
• care_fe/src/pages/Admin/Roles/RolesIndex.tsx, RoleForm.tsx, src/components/ui/sidebar/admin-nav.tsx, src/types/emr/role/role.ts — the Administration → RBAC → Roles screen, the Add Role panel, Clone, Select All / Clear, and the context labels.
• care_fe/src/pages/Organization/components/LinkUserSheet.tsx, EditUserRoleSheet.tsx — the Link User and Edit User Role panels, and the toast messages.
• care_fe/public/locale/en.json — every user-facing label and message, including role_context__role_org = Responsibility.

Left out

• The role expiry date. RoleAssociation.expiry exists in care/security/models/permission_association.py, but I found no UI that sets it, so the concept mentions it in one sentence only and no flow documents it.
• The Permissions admin screen (/admin/rbac/permissions) has no flow, because it is a read-only matrix with no user task.
• Facility department roles (EditFacilityUserRoleSheet.tsx) — the request was about roles and permissions themselves, so I kept the flows to the role list and the organization grant.

Build: npm run build is green for en and ml, and the corruption scan returns nothing.

Generated by Ezhuthachan for #60 · opus50 · 345.5 AIC · ⌖ 19.1 AIC · ⊞ 14.4K · ◷
_{Comment /document to run again}

[cloudflare-workers-and-pages]

Deploying coredocs with    Cloudflare Pages

Latest commit:	d5ef042
Status:	✅  Deploy successful!
Preview URL:	https://a8106dca.coredocs.pages.dev
Branch Preview URL:	https://docs-roles-and-permissions-6.coredocs.pages.dev

View logs