Roles and permissions

The eight roles, scopes, elevated actions and how permission changes are audited.

Role	Primary access
Organisation administrator	Users, roles, settings. No default access to patient-level evidence.
Research operations manager	Trials, cohorts, screening, sites; co-authorises datasets.
Protocol reviewer	Protocol Studio; approves criteria versions.
Research coordinator	Screening for assigned sites.
Site investigator	Candidates referred to them at their site.
Data integration administrator	Data connections and imports; co-authorises datasets.
Compliance / audit reviewer	Audit log and audit exports.
Read-only stakeholder	Aggregate analytics and shared reports.

Scopes

Grants apply at organisation, workspace, trial or site scope. Authentication alone grants nothing.

Every grant, revocation and expiry is an audit event with actor, target, scope and before/after values.