Role RoleManagementRule UserScopedRole Permission ModelCapability
1. Role Operational Scope & Responsibilities
2. Standard Operating Procedures & Model Rules
Users operating under the SuperAdmin role must execute standard operating procedures in accordance with the following model-level rules:
- Role assignments must adhere to the role_management_rules pivot table: parent roles may assign only designated secondary roles.
- Delegated permissions operate within strict tenant/shop scopes (`UserScopedRole`), preventing cross-tenant data leakage.
- Automated privilege expiration: all temporary administrative delegations must carry a hard timestamp expiry not exceeding 30 calendar days.
3. Prohibited Operational Conduct & Model Abuse
The following actions constitute unauthorized privilege abuse or role misconduct, triggering automated Warning and Violation System intervention:
- Attempting to manually set `is_assignable = true` on any Primary role (Seller, Buyer, Franchise, Agency).
- Assigning roles across unequal hierarchy boundaries without explicit SuperAdmin multi-sig override.
- Creating circular role management hierarchies or self-delegating administrative capabilities.
4. Warning & Disciplinary Enforcement Matrix
Specific infractions under this role are mapped directly to disciplinary and operational sanctions:
| Violation Code | Offense Description | Detection Method | Severity Tier | Cure Window | Mandatory Sanction |
|---|---|---|---|---|---|
VIOL-813-01 |
Attempted modification of primary role assignability status in database. | Role Hierarchy Validator Trigger | Tier 4 (Critical) | Immediate | Database transaction aborted, administrative alert logged, role lock enforced. |
VIOL-813-02 |
Unauthorized vertical privilege escalation attempt via API token. | API Scope Authorization Guard | Tier 4 (Critical) | Immediate | API token instantly invalidated, user session frozen, security incident opened. |
VIOL-813-03 |
Failure to review active delegated secondary roles during monthly audit. | Delegation Audit Sweeper | Tier 1 (Advisory) | 48 Hours | Automated expiry notice sent to managing supervisor. |
5. Platform Protection & Regulatory Safe Harbor
Role Fiduciary Responsibility: Operating under the SuperAdmin role creates a strict fiduciary duty to preserve platform confidentiality, data protection compliance, and operational integrity.
Marketplace Skin Protection: ePaisay disclaims all vicarious liability for rogue, ultra vires, or unauthorized actions committed by users exceeding their delegated role permissions.
Audit & Revocation: The platform maintains complete, unalterable telemetry over all model mutations executed by this role. Unilateral suspension or credential revocation will occur upon verified policy non-compliance.