# Permissions Matrix Checklist

Use this checklist after importing `install.sql` and before creating non-admin users.

## Admin

Admin bypasses module permissions, but still verify the `modules` table includes all expected slugs.

## Recommended role access

| Role | Recommended access |
|---|---|
| RP | All GDP/QMS modules, read/write approval workflows, reports, dashboard |
| RP Assistant / QA | GDP/QMS modules, training, premises/equipment, audits, gap analysis |
| Warehouse | Goods receiving, batch/stock, dispatch, returns, defective stock, premises checks, cleaning, temperature/cold-chain imports |
| Accounts | Accounts & Tax, payment tracker, VAT, credit notes, accountant export, contact directory; read-only customer/supplier as needed |
| Auditor | Read-only: dashboard, reports, GDP gap analysis, audits, SOPs/documents, activity log |
| Driver | Dispatch/collection evidence only if used |
| Cleaning Staff | Cleaning logs and limited premises checks |

## Slugs to verify in permissions table

- `dashboard`
- `suppliers`
- `customers`
- `products`
- `stock_batches`
- `sales_orders`
- `dispatches`
- `purchase_requests`
- `goods_receivings`
- `deviations`
- `capas`
- `change_controls`
- `sops`
- `document_controls`
- `forms_templates`
- `risk_assessments`
- `complaints`
- `recalls`
- `falsified_medicines`
- `defective_stock`
- `audits`
- `gdp_gap_analysis`
- `training_matrix`
- `sop_signoffs`
- `training_records`
- `premises_equipment`
- `premises_checks`
- `cleaning_logs`
- `pest_control_logs`
- `fire_safety_records`
- `accounts_finance`
- `credit_notes`
- `contact_directory`
- `communication_logs`
- `technical_agreements`
- `returns`
- `qualifications`
- `mhra_inspections`
- `account_reopenings`
- `company_sites`
- `accounting_integrations`
- `advanced_tools`
- `cold_chain_imports`
- `system_health`

## Direct-post/security reminder

The UI hiding a button is not enough. Confirm a non-authorised user cannot directly POST to restricted create/edit URLs.
