Enterprise RBAC
Permission engine for hospital roles — templates, custom roles, groups, inheritance, department/location/record scopes, API & UI auth, simulator, export/import (ADR-025)
Hospital tenant RBAC (not MeevaMed HQ). REST: /api/rbac · /api/rbac/actions. Live JWT enforcement remains Blocked — use `/rbac-enforce`.
Templates
15
Hospital roles
Custom
0
Cloned roles
Groups
17
Permission groups
Effective perms
20
Doctor
Role templates & custom
Clinical documentation and orders.
Parent: none · Depts: DEPT-OPD, DEPT-IPD · Locations: all
Record rules: patient:assigned
Department / location scope
Permission groups
- Patient group · 7 perms
- Visit group · 7 perms
- Appointment group · 7 perms
- Order group · 7 perms
- Prescription group · 7 perms
- Bill group · 7 perms
- Pharmacy stock group · 7 perms
- Lab result group · 7 perms · on role
- Radiology study group · 7 perms · on role
- Inventory item group · 7 perms
- Staff group · 7 perms
- Payroll group · 7 perms
Effective permissions (engine)
Direct ∪ groups ∪ inherited parents.
lab_result.administer · lab_result.approve · lab_result.create · lab_result.delete · lab_result.export · lab_result.read · lab_result.update · order.approve · order.create · patient.read · prescription.create · radiology_study.administer · radiology_study.approve · radiology_study.create · radiology_study.delete · radiology_study.export · radiology_study.read · radiology_study.update · visit.create · visit.update
UI / API authorization
UI allow
API allow
Permission simulator
Export / import
Audit
| When | Actor | Action | Summary |
|---|---|---|---|
| 2026-08-15T14:50:59 | system | seed | Enterprise RBAC seeded with 15 role templates |