Roles & access
Civicore's role model, scopes, and how access is enforced.
Civicore uses scoped role-based access control (RBAC). Every role membership is bound to a scope, which determines what data a user can see and what actions they can take.
Roles
| Role | Primary jobs |
|---|---|
| ASPIRANT | Publish profile, manage campaign, view personal analytics |
| PARTY_ADMIN | Manage party profile, roster, announcements, party analytics |
| CAMPAIGN_MANAGER | Run daily ops — tasks, events, volunteer assignments |
| COORDINATOR | Geo-scoped coordination, local announcements, field reporting |
| VOLUNTEER | Register, view assignments, log activity, RSVP to events |
Scopes
Memberships are bound to a scope:
- National — Presidential races, national party leadership
- Party — Party-wide administration
- County — Governor, Senator, Women Rep races
- Constituency — MP races
- Ward — MCA races
- Campaign — Campaign-specific team roles
- Aspirant — Aspirant-personal team roles
How authorisation is enforced
Authorisation is enforced on the backend, on every protected endpoint. The UI is a hint, not a
gatekeeper. If a user is not authorised, the API returns 403 regardless of what the UI shows.