Role-Based Access Control

Every person who signs in — hospital administrator, dietary staff, clinical reviewer, feedback manager, patient, or platform operator — is limited to the screens and data their role is permitted to touch. This page describes how that separation is enforced, for your security or compliance review.

How access is checked

Permission checks run on the server on every request against the real signed-in session, not just in the navigation menu, so a staff member cannot reach a restricted page by guessing its address; the request is rejected. If a role isn’t recognized as having a given permission, access defaults to denied rather than allowed.

Access is also scoped per hospital: a staff member working across multiple hospitals only ever sees the data for the hospital they’ve currently selected. Every sign-in link or redirect is checked to make sure it points back into the application rather than to an external site.

What this means for your review

This role separation is enforced consistently across the staff, operator, and patient areas of the product, and is verified by an automated test suite that checks both what each role can do and what it is correctly blocked from doing. For a record of who did what and when, see Append-Only Audit Log.