Roles & Capabilities · 4 min read
Creating a custom role
A custom role is how you shape access to your own structure. You combine the granular capabilities the role should carry with the branch scope over which they apply, so the role fits a real job at your institution rather than a generic template.
Two things define a role
A role is the pairing of what a person can do (its capabilities) with where they can do it (its branch scope). Both matter: a collections capability scoped to one branch is a very different grant from the same capability scoped across every branch.
Building the role
- 1Name the role for the jobGive it a name that reflects the actual function, so the person assigning it later knows what it confers.
- 2Add the capabilitiesSelect each granular capability the role needs. Because access is fail-closed, leaving a capability off simply means that feature stays invisible to holders of the role.
- 3Set the branch scopeScope the role to a single branch, a set of branches, or the whole institution, depending on how far the person's authority should reach.
- 4Assign and reviewAssign the role to staff. The assignment itself is recorded, so it is clear who granted which access and when.
A worked example
| Capability | In this role? | Branch scope |
|---|---|---|
| View borrower records | Yes | Kariakoo branch |
| Record a cash repayment | Yes | Kariakoo branch |
| Approve loans under TSh 2,000,000 | Yes | Kariakoo branch |
| Post a manual journal entry | No | — |
| Grant staff roles | No | — |
Sensitive grants still need a second person
Even with the capability to manage roles, granting a sensitive permission is not a solo action — it runs through maker-checker dual-control.