Multi-Tenant RBAC & Security Matrix

Cora enforces a granular Role-Based Access Control (RBAC) engine that isolates tenant workspaces while giving studio directors precise control over who can view financials, edit contracts, or dispatch gear.

1. Role Hierarchy

2. 30-Point Capability Matrix

Each role inherits specific capabilities evaluated server-side in PHP via cora_user_can($capability):

// Example: Checking permission before rendering financial data
if ( ! cora_user_can( 'cora_manage_financials' ) ) {
    wp_send_json_error( array( 'message' => 'Unauthorized financial access.' ), 403 );
}

Key Capabilities

• cora_view_dashboard: Access main analytics overview.
• cora_manage_bookings: Create and reschedule shoot calendar bookings.
• cora_manage_financials: Generate GST tax invoices, record payments, and export ledger.
• cora_manage_vault: Upload and send legally binding SHA-256 contracts.
• cora_dispatch_crew: Generate and send automated WhatsApp call sheets.
• cora_manage_gear: Check out camera lenses and log maintenance condition reports.
• cora_manage_ai_settings: Configure Gemini API keys and RAG memory contexts.

3. Creating Custom Studio Roles

Studio owners can create specialized roles (e.g. *Post-Production Lead*, *Junior Gaffer*, *Retainer Accountant*) in Settings Suite → Roles Matrix:

1. Click + Create Custom Role.
2. Select parent template to inherit baseline permissions.
3. Toggle individual granular permissions (e.g. Enable *Media Hub Access* while disabling *Financial Invoicing*).
4. Save to apply instantly across all active sessions.

4. Tamper-Evident Audit Trails

Every state mutation in the workspace (contract signature, invoice cancellation, token rotation, gear checkout) is written to wp_cora_audit_log with:

• Timestamp (UTC)
• User ID & IP Address
• Target Module & Entity ID
• Previous State vs. New State JSON diff