The Seven-Role RBAC Matrix, Maker-Checker & Audit Trail
Understand permissions across Owner, CFO, Admin, Accountant, Analyst, Auditor, and Viewer—enforced by Postgres RLS and Rust APIs.
6 min readVersion 2.0Last updated 2026-11-10
#rbac#roles#maker-checker#audit#governance
Hands-On Practice
Launch in DemoTest Governance & Approvals in Northstar Consulting
Launches an isolated session straight into /approvals.
1. Formal Seven-Role Responsibility Matrix
Deku enforces role checks at UI, Rust route, RPC, and PostgreSQL Row-Level Security levels:
- Owner: Root authority, licence & org settings, member/role assignment, approvals, and full ledger/payroll access.
- CFO: Final financial sign-off, voucher approvals, invitations, payroll runs, budgets, FP&A, and cash flow.
- Admin: Operations configuration, member invitations, department setup, payroll execution, and document management.
- Accountant: Party/Item masters, invoices, purchase bills, draft vouchers, GST returns, inventory, and bank reconciliation.
- Analyst: Read-only financial reporting, cash flow, FP&A ratios, DSO/DPO, and Deku Consultant analytics.
- Auditor: Independent read-only review of audit logs, user activity trails, vouchers, and supporting files.
- Viewer: Passive stakeholder read-only visibility across permitted KPIs and financial statements.
2. Maker-Checker Dual Authorization
When Maker-Checker approval rules are enabled, operational staff create draft vouchers that queue in `/approvals`. Only an authorised Owner, CFO, or Admin can approve and post them, writing immutable records to the audit log.