As the platform,

I need to identify every authenticated user's role and determine which features they are allowed to access,

so that users only perform actions permitted for their assigned responsibilities.

---

Business Rules¶

The platform supports the following roles:

• Customer
• Partner
• Supplier
• Super Admin

Every user account must always have exactly one active role.

A user cannot access functionality outside their assigned role.

---

Functional Requirements¶

1. Assign Default Role¶

When a new customer account is created,

The system shall automatically assign the Customer role.

No manual action is required.

---

2. Existing User Login¶

When an existing user signs in,

The system shall identify their assigned role before granting access.

---

3. Missing Role¶

If a user account does not have an assigned role,

The user shall not be allowed to access the platform.

Return the message

We're unable to determine your account permissions. Please contact support.

---

4. Inactive Role¶

If the assigned role is inactive,

The user shall not be allowed to continue.

Display

Your account is currently inactive. Please contact support.

---

5. Feature Authorization¶

Before allowing access to any protected feature,

The system shall verify whether the user's role is permitted to perform the requested action.

---

6. Unauthorized Access Attempt¶

If the user attempts an action outside their permissions,

The request shall be rejected.

Return

You do not have permission to perform this action.

---

7. Role Change¶

When an administrator changes a user's role,

The updated permissions shall be applied the next time the user accesses the platform.

The user shall be required to sign in again.

---

8. Deleted Role¶

If a role has been removed while users are still assigned to it,

Those users shall not be allowed to continue using the platform.

Display

Your account permissions are no longer valid. Please contact support.

---

Business Exceptions¶

User has multiple active roles¶

The system shall reject the account.

Display

Multiple account roles were found. Please contact support.

---

Invalid Role¶

Display

Invalid account permissions detected. Please contact support.

---

Unknown Role¶

Display

We're unable to determine your account permissions. Please contact support.

---

Acceptance Criteria¶

Scenario 1¶

Given a newly created customer

When the account is created

Then the Customer role shall be assigned automatically.

---

Scenario 2¶

Given a Partner logs in

When authentication completes

Then Partner permissions shall be applied.

---

Scenario 3¶

Given a Customer attempts to access an Admin feature

When authorization is evaluated

Then access shall be denied with the message:

You do not have permission to perform this action.

---

Scenario 4¶

Given the user's role has changed

When the user next accesses the platform

Then the updated permissions shall be applied and the user shall be required to sign in again.

---

Scenario 5¶

Given a user has no valid role

When they attempt to access the platform

Then access shall not be granted.

Display

We're unable to determine your account permissions. Please contact support.

---

In Scope¶

• Assign default roles
• Validate assigned role
• Authorize feature access
• Handle invalid or missing roles
• Apply role changes
• Restrict unauthorized actions

---

Out of Scope¶

• Creating new roles
• Configuring permission matrices
• Staff role administration
• Partner approval workflow
• Supplier approval workflow

---