Understanding capability-based roles
Ustawi does not gate access by job title. A role is a set of granular capabilities — individually assignable permissions like “approve loans under an amount” or “post a manual journal entry” — so what a person can do is exactly the sum of the capabilities their role carries, and nothing more.
Why capabilities, not titles
A fixed title like “Branch Manager” means different things at different institutions, and it bundles permissions that not every manager should have. Building roles from granular capabilities lets you grant precisely the access a person needs — no more, no less — and change it without inventing a new title every time responsibilities shift.
Fail-closed by design
Access in Ustawi is fail-closed. A user without a matching capability does not see a greyed-out button they cannot press — they never see the feature at all. Unauthorized functionality is invisible, not merely disabled, so a missing capability cannot be probed or worked around from the interface.
What a capability controls
- Whether a feature is visible to the user at all (fail-closed visibility).
- Whether a sensitive action can be performed, or only viewed.
- The branch scope over which the capability applies — see “Creating a custom role.”
Capability-based roles are what every other app enforces against. A capability granted here is what lets someone approve a loan, resolve a screening alert, or close an accounting period elsewhere in Ustawi.