Users & Roles

SanctuaryOS uses a role-based access control (RBAC) system to determine what each user can see and do. Every user account is assigned one or more roles, and each role grants access to specific modules and operations. This section covers how to create users, assign roles, and understand the permission matrix.

Role Tiers

Roles are organized into three tiers based on their level of access:

Tier 1 — System

• Super Admin — Full system access across all modules and campuses. Maximum 2 per tenant.
• Campus Admin — Full campus management. Can assign Tier 2 and Tier 3 roles at their campus.
• Lead Pastor — Full Flock, read-only Steward, plus Gather, Circles, and Care. Campus-scoped.

Tier 2 — Finance & Pastoral

• Finance Admin — Full Steward module access with Flock read access for donor lookup. Mandatory MFA.
• Finance User — Session entry and posting only. Designed for counting volunteers.
• Reporting Only — Read-only access to reports. No data entry.
• Pastor — Full Flock, read-only Steward, Gather, Circles, and Care. Campus-scoped.
• Elder — Flock, Gather, Circles, and Care. No financial data access.

Tier 3 — Ministry & Volunteer

• Flock Leader — Flock scoped to assigned members only.
• Small Group Leader — Circles scoped to their assigned group(s).
• Team Leader — Serve scoped to their assigned team(s). Full schedule and roster access.
• Worship Leader — Full Serve module access including setlists and service plans.
• Volunteer — Serve scoped to their assigned team. Can view schedule and confirm availability.
• Care Minister — Care module scoped to assigned ministry area.
• Care Read Only — Read-only access to Care module.

Key Concepts

• Campus scoping — Many roles are scoped to specific campuses. A Pastor at the Toronto campus cannot see Montreal campus data.
• Module access — Each role maps to one or more modules with a specific access level (Full, Read-only, Scoped, or None).
• Scope types — Tier 3 roles have scope types: flock (assigned members), group (assigned circles), team (assigned serve teams), or ministry (assigned care areas).

Pages in This Section