Global Admin + Fuzion Support
Only Dan, Andy and Prag get Global Admin. The rest of the Fuzion team gets a read-mostly Support role. Not everyone at Fuzion needs API keys or the tenant switcher.
One Admin role, four scoped roles
SBR Admin gets your list plus six items it left out that they need to run a response. Dispatcher, Account Coordinator and Support Coordinator cover the day-to-day work. Board Viewer gives the board visibility without any controls.
Separate workspace, same console
Move Insights and Knowledge to a Library tab in the console header. Don't build a subsite, because it would add a second sign-in and a second place to enforce roles.
Who gets what
Select a role to highlight its column in the matrix below. A person can hold more than one role, and their effective access is the combination of those roles.
Every console item, by role
Items your list left out
Your SBR Admin list covers most of the rail. These items weren't on it. Each one has a recommendation, and the matrix already reflects it. Change any of them before Prag starts.
Today: Overview, Pending review, Flagged
Recommend: include for SBR Admin. Pending review is where new sign-ups and listings wait for approval. It's also where your "new user account requests" role works. If SBR Admins can't see it, a Fuzion person has to approve every rancher and hauler.
Truck loads and Duty roster
Recommend: include. Both are part of dispatch. A dispatcher who can see the board but not the loads or who is on shift can't finish the job.
Rapid Response and All Hands mode
Recommend: SBR Admin authorizes, Dispatcher drafts. These are the most consequential operational actions in the console, and they belong to Fuzion Companies. Put them behind the authorization gate: a Dispatcher prepares the callout and an SBR Admin sends it. All Hands requires a second SBR Admin to confirm.
Admins list
Recommend: SBR Admin can view it and invite people into Fuzion Companies roles only. They can never grant Fuzion Support or Global Admin, and they can't edit Fuzion accounts. The alternative is Fuzion-only provisioning. It's tighter, but every new dispatcher during a fire becomes a Fuzion ticket.
Admin notifications
Recommend: include for SBR Admin. It controls which Fuzion Companies addresses get alert emails. They should own that list.
Disaster archive
Recommend: view only. Past responses are useful for planning and reporting. Only Fuzion archives or restores a response.
Tenant switcher, App releases, System, Design notes
Fuzion only. This matches your call. Fuzion Companies should never see that other tenants exist. That will matter once Halo Relief and Sentinel Overwatch are live next to them.
New: tenant activity log
Recommend: add a Fuzion Companies–scoped activity log under Access control. SBR Admins lose the System audit log. This gives them back who did what inside their own tenant, including any time Fuzion Support opened their data.
Internal Support applications
Recommend: only an SBR Admin approves these. Internal Support is the path into dispatcher and coordinator roles, so it's the one sign-up that leads toward the console. Account Coordinators still approve Donors, Recipients and Haulers. On the Pending review page, Internal Support applications show as read-only for them.
Sign-up creates members. Console roles are assigned.
Volunteers reach the sign-up page from "Support The Mission or Receive Aid" on fuzion-demo.example and choose Donor, Recipient, Hauler or Internal Support. Those four are member roles. None of them opens the admin console. Console roles are never offered on a public page. An administrator grants one to an account that has already been approved.
| Who | How they get an account | Who approves or assigns | Where "Sign in" takes them |
|---|---|---|---|
| Donor · Recipient · Hauler | Public sign-up card | Account Coordinator or SBR Admin, in Pending review | Member app |
| Internal Support | Public sign-up card | SBR Admin only (D9) | Member app until a console role is added |
| SBR Dispatcher · Account Coordinator · Support Coordinator | Start as Internal Support, then an SBR Admin adds the console role to the same account | SBR Admin | Their home page: Dispatch board, Pending review or Support inbox |
| SBR Board Viewer | Invited by an SBR Admin (no public sign-up needed) | SBR Admin | Overview |
| SBR Admin | Invited | Global Admin, or an existing SBR Admin | Overview. Pending review during an active response |
| Fuzion Support · Global Admin | Provisioned by Fuzion. They never use the Fuzion Companies sign-up page | Global Admin | Last tenant used, with the tenant switcher |
One door, routed by role
- Everyone who already has an account uses the same Sign in button. After authentication, the app sends each person to the landing page for their highest role.
- Don't add a separate "Admin login" to the public page. It advertises where the console is and adds nothing, because the role check happens after sign-in either way.
- One person, one login. A rancher who also dispatches holds a Hauler member role and a Dispatcher console role on the same account. A role switcher in the header replaces today's four separate logins per person.
Copy change on the sign-up page
- On the Internal Support card, add: "Dispatchers and coordinators start here. After review, a Fuzion Companies administrator assigns your duties." This tells volunteers that duties come after review, not at sign-up.
- The footer line "a Fuzion Companies administrator reviews every application" stays accurate under the new roles.
Actions gated separately from page access
Being able to see a page doesn't mean being able to do everything on it. Give each of these actions its own permission, confirm it inside the page, and write every use to the audit log.
| Action | Why it's gated | Who can do it |
|---|---|---|
| Publish emergency banner | Every public visitor sees it | Global Admin, SBR Admin |
| Start or stop countdown | Public-facing | Global Admin, SBR Admin |
| Send All Hands | Pages every volunteer at once | SBR Admin, with a second SBR Admin confirming |
| Send Rapid Response callout | Mobilizes drivers | SBR Admin authorizes; Dispatcher drafts |
| Push to all app users | Wide reach and hard to recall | SBR Admin. Dispatcher is limited to haulers on the active response |
| Export CSV | Names, phone numbers and addresses leave the system | Global Admin, SBR Admin |
| Disable, block or re-enable an account | Locks someone out | Global Admin, SBR Admin. Account Coordinator can flag for review |
| Approve an Internal Support application | It's the path toward console roles | Global Admin, SBR Admin |
| Assign roles | Can escalate access | Only roles at or below your own, inside your own tenant |
| Create or close a response | Changes what the whole console shows | Global Admin, SBR Admin |
Three workspaces in one console
Today's rail has more than 40 items. A dispatcher working the Ross Fire needs about ten of them. Roles remove most of what they shouldn't see. Workspaces separate live operations from reference material. Add a tab switcher in the header next to Live map and Full map, and keep one sign-in, one session and one permission check.
Run the response
- Today
- Operations
- Accounts and Access control
- Mobile apps
- Communications (without Volunteer impact)
- Site controls
Plan, report, learn
- Insights: Reporting, Milestones & alerts, Volunteer impact (moved here)
- Knowledge: Lessons learned, Risk register, Disaster archive, Partner directory, Training, Documents
Run the software
- Licensed organizations, Roles & permissions, Support access sessions
- System: Error logs, Database status, Map & API keys, Audit log
- App releases
- Design notes
- Tenant switcher
For SBR roles the tab doesn't render and the routes are refused.
Why not a subsite
- It adds a second sign-in and session, and a second place where role checks can drift
- Tenant isolation has to be rebuilt and retested there
- It's another deploy for Prag to maintain
What it costs
- Reporting is one extra click during an active event. Pinning covers that, since pins already exist.
- Training and Documents may later belong in the member app too, read-only for haulers and volunteers. Decide that separately.
Implementation notes
- Permissions as capability keys, roles as bundles. For example
dispatch.assign,emergency.publish,accounts.export. Store roles per tenant membership as(user_id, tenant_id, role). The matrix above becomes a seed table rather than scatteredif (isAdmin)checks. - Enforce at the data layer, not the rail. Hiding a menu item is cosmetic, and hash routes can be typed into the address bar. Extend row-level security (already on profiles, tickets and block lists) to every table the console reads, and check every write on the server.
- Take the tenant from the session token, never from the client. The tenant switcher is a Fuzion convenience. The server must not trust it for anyone else.
- Rail badges and search results are data too. Don't return counts for hidden sections. Error logs 100 and Admins 23 shouldn't reach an SBR Dispatcher's browser. Scope global search to the sections the role can see.
- Assignment ceiling. A role can grant only roles at or below its own, inside its own tenant. Only a Global Admin can create another Global Admin.
- MFA required for Global Admin, Fuzion Support and SBR Admin.
- Fuzion Support access to a tenant is time-boxed and logged, and it appears in that tenant's activity log (D8).
- Least privilege by default. A new console account starts as SBR Board Viewer until someone upgrades it.
Moving today's admins
Fuzion Companies
- Keep SBR Admin to 3–5 people. The founders (Lisa Holliday, Monica Mariscal, Angie Dotson) plus an operations lead is a reasonable starting point. Confirm the names with Fuzion Companies.
- Every other current SBR admin moves to Board Viewer on cutover day, then gets upgraded to Dispatcher or Coordinator as Fuzion Companies names people.
- The test-cycle groups map as follows: SBR Admins become SBR Admin, SBR Support Managers become Support Coordinator, and Dashboard Testers and Mobile Testers are retired.
Fuzion
- Global Admin: Dan, Andy, Prag. This matches the Fuzion Team Permissions Log.
- Fuzion Support: everyone else on the Fuzion team who needs console access.
- This settles the open question from the 8/26 workbook about which sheet is authoritative: the Permissions Log.
- Rotate the shared passwords on live admin accounts, if they're still shared, at the same time as the role cutover.