# Access Control Matrix

## Account structure

| Role | Active account limit | Scope |
|---|---:|---|
| Super Admin | 1 | Full application and administration access, including user lifecycle and audit events |
| Approver | 2 | Full operational access and all approval/payment transitions, excluding administration and audit events |
| Quote Creator | 2 | Customer/catalog management plus creation, editing, export, and submission of their own BOMs and quotes |

Inactive accounts do not consume an active role slot. The sole active Super Admin cannot disable or demote their own account. Disabling any account revokes its database sessions and API tokens.

## Quote Creator boundaries

Allowed:

- create and maintain customers, contacts, sites, catalog categories, items, and customer-specific prices;
- own bill-of-materials register, structured BOM creation/editing, private files, PDF/Excel export, duplication, and submission for review;
- own quote list, creation, draft editing, viewing, PDF download, and submission for review.

Denied:

- dashboard and financial metrics;
- other creators' quotes, including direct URLs and PDFs;
- BOM or quote approval/rejection, BOM conversion, quote sending/acceptance/closing, or invoice conversion;
- proformas, invoices, payments, receipts, certificates, costs, HR, attendance, payroll, reports, audit events, and user administration.

## Approver boundaries

Approvers receive every operational permission and may approve BOMs and quotes created by other users, then convert approved BOMs into draft quotes. Creators cannot decide their own BOM or quote. Approvers cannot list, add, edit, suspend, or assign system users and cannot access security audit events.

## Enforcement

Controls are enforced in route middleware, controller ownership checks, transactional workflow services, role-capacity validation, and navigation filtering. Menu visibility is a usability layer and is not treated as authorization.