Understanding Iarap Account Roles

Iarap uses roles as templates, not as the access boundary itself.

The role hierarchy

| Role | Scope | | ---- | ----- | | SUPER_ADMIN | Everything. Cannot be restricted. | | ADMIN | Everything except system ownership and developer execution. | | MANAGER | Oversees editors, approves content. | | EDITOR | Creates and drafts content across all types. | | NEWS_EDITOR | News module only. | | CONTENT_MANAGER | Tutorials, guides, knowledge base, educational content. | | PRODUCT_MANAGER | Product database and brands. | | COMPARE_MANAGER | CompareHub specifications and templates. | | TOOLS_MANAGER | Tools catalogue and tool SEO. | | AI_MANAGER | AI providers, models, prompts, limits. | | SEO_MANAGER | Metadata, redirects, sitemaps. | | MEDIA_MANAGER | Media library. | | FINANCE_MANAGER | Subscriptions, payments, revenue. | | SUPPORT | Contact messages and user assistance. | | MODERATOR | Comments and community reports. | | ANALYST | Read-only analytics and reporting. | | VIEWER | Read-only across modules. | | TESTER | Read-only plus diagnostics. |

Roles are only the starting point

Assigning a role pre-selects its default permissions. An administrator can then add or remove individual capabilities for that specific person.

Effective access is:

(role permissions ∪ custom grants) \ custom denies

A deny always wins over a grant.

A worked example

Two people both hold EDITOR:

• Priya has the default EDITOR set, plus seoMetadata.edit granted.
• Sam has the default EDITOR set, minus news.publish denied.

Same role, different capabilities — and neither required a new role to be created.

Super Admin is special

SUPER_ADMIN bypasses permission checks entirely. Its permission list cannot be edited, because the system would not honour the restriction anyway. The last Super Admin account also cannot be demoted, to prevent a permanent lockout.