User & Access Management
Department roles and district/station scopes are separate from the synthetic demo identities shown below.
Officer provisioning
New accounts have no department access until an authorized administrator assigns district and station scope. Initial administrator provisioning is pending; choosing a demo identity does not grant department permissions.
Read-only: only administrators can change users and policies.
Users
| User | Role | Districts | Stations | MFA |
|---|---|---|---|---|
| K. Lakshmi (District Officer) | District Officer | Krishna | * | pilot requirement |
| S. Prakash (Investigator) | Investigator | Krishna | Vijayawada Central ES | pilot requirement |
| M. Reddy (Supervisor) demo selection | Supervisor | Krishna, Guntur | * | pilot requirement |
| A. Rao (Administrator) | Administrator | * | * | pilot requirement |
Role matrix
| Permission | District Officer | Investigator | Supervisor | Administrator |
|---|---|---|---|---|
| view cases | ✓ | ✓ | ✓ | ✓ |
| view restricted | — | — | ✓ | ✓ |
| upload documents | ✓ | ✓ | — | ✓ |
| correct extraction | ✓ | ✓ | ✓ | — |
| verify entity match | — | ✓ | ✓ | — |
| decide legal | — | ✓ | ✓ | — |
| approve reports | ✓ | — | ✓ | — |
| export reports | ✓ | — | ✓ | ✓ |
| manage users | — | — | — | ✓ |
| view audit | ✓ | — | ✓ | ✓ |
| view model health | — | — | ✓ | ✓ |
Access policies
- • Cases are visible only within the user's district and station scope.
- • Restricted records (informant details) require Supervisor or Administrator.
- • Exports limited to approved documents and authorized roles; every export audited.
- • Pilot: government-approved identity provider, MFA, session timeout 15 min.
- • Encryption in transit (TLS 1.2+) and at rest; protected backups; retention per department policy.
- • Original files immutable (content hash); corrections stored separately with history.