13 — Role Matrix (draft v0.1)

Status: draft for BA review (2026-10-30). Built from the 162 use cases (12-use-cases.md), the BA chart and the proposal. Role codes are our proposal; the use cases name roles in Thai. Counts = number of use cases the role takes part in. The objective role × module participation counts are generated in use-cases/role-module-matrix.md. Access rights per data domain are in 14-security-matrix.md.

1. How a role is assigned (proposed model)

A user gets permissions through role assignments. Each assignment has:

Part	Values	Source
Role	One of the codes below	—
Org scope	University: `CENTRAL` · `CAMPUS:<id>` · `FACULTY:<id>` · `MAJOR:<id>` (สาขา) · `PROGRAM:<id>` (หลักสูตร). Sports school: `SCHOOL:<id>` · `GRADE:<id>` (ระดับชั้น) · `SPORT:<id>` (ชนิดกีฬา). Plus `DORM:<id>`	ORG unit tree from the BA draw.io page "โครงสร้างหน่วยงานของระบบ" (see 03-modules.md); W-117, W-36 "approve per OrgUnit level"
Relationship scope (instead of org scope for some roles)	`OWN` (self) · `RELATION` (guardian ↔ learner) · `SECTION` (courses taught) · `ADVISEE` · `CLASS` (homeroom) · `SQUAD` (coach) · `CARE` (clinical care relationship) · `CASE` (assigned case) · `SESSION` (exam or skill-test session)	W-14, W-22, W-39, W-127
Validity	From / to dates; term-based roles expire at term rollover	W-122 ("หมดอายุ role ราย term"), W-139
Origin	`DIRECT` · `ACTING` / `DELEGATED` signing authority · `SPONSORED` external account · `JIT` privileged elevation	W-123, W-139, W-124

Implementation note [inferred]: RBAC for the role, plus ABAC checks on scope, relationship, consent and data category. The use cases already require ABAC for guardians (W-127).

2. Role catalog

Legend: Ch = main channel (App = student/guardian mobile or PWA/LIFF, Web = portal, BO = staff backoffice, Tab = judge tablet, Exec = executive dashboard). Lv = education level (U = university, S = sports school, U/S = both). #UC = number of use cases.

A. Learners, guardians and alumni

Code	Thai (use cases)	Ch	Lv	Scope	#UC	Main duties
`APPLICANT`	ผู้สมัคร	App/Web	U/S	OWN	19	Apply, upload documents, pay application fee, confirm offer, appeal results
`STUDENT`	นักศึกษา (also นักเรียน)	App/Web	U/S	OWN	80	Register, pay, file requests and leave, view grades, consent decisions, report incidents
`GUARDIAN`	ผู้ปกครอง	App (LIFF/PWA)	U/S	RELATION	28	Sub-types `LEGAL`, `CAREGIVER`, `LOCAL_GUARDIAN`, `OBSERVER`, `EMERGENCY_CONTACT`, `PICKUP` (see 04). Co-sign when the DMN rule requires it, approve leave passes, pay, receive incident calls
`ALUMNI`	ศิษย์เก่า	Web	U	OWN	4	Update profile, request replacement documents, surveys
`FORMER_STUDENT`	อดีตนักศึกษาที่ไม่สำเร็จการศึกษา	Web	U	OWN	1	Request records after leaving

B. Teaching, advising and assessment

Code	Thai	Ch	Lv	Scope	#UC	Main duties
`LECTURER`	อาจารย์ผู้สอน	BO	U	SECTION	17	Attendance, scores, submit grades (W-01), approve sick leave (W-53), approve own-request makeup exams (W-05); acknowledges competition leave and does not approve it
`ADVISOR`	อาจารย์ที่ปรึกษา	BO	U	ADVISEE	19	Approve study plan and add/drop, endorse withdrawal, leave of absence, T2/T3 competition leave, cross-campus registration
`THESIS_ADVISOR`	อาจารย์ที่ปรึกษาวิทยานิพนธ์	BO	U	ADVISEE	6	Endorse proposal, similarity report and final revisions
`SS_TEACHER`	ครูผู้สอนโรงเรียนกีฬา	BO	S	SECTION	2	Teaching, scores, ปพ.5
`HOMEROOM_TEACHER`	ครูประจำชั้น	BO	S	CLASS	6	First guardian contact, verify caregivers by home visit, welfare input to retention reviews
`PRACTICUM_SUPERVISOR`	อาจารย์นิเทศก์	BO	U	ADVISEE	1	Supervise teaching practicum
`EXAM_PROCTOR`	กรรมการคุมสอบ	BO	U	SESSION	2	Run exams, report misconduct
`SKILL_JUDGE`	กรรมการสอบทักษะ	Tab	U/S	SESSION	10	Score skill tests (multi-judge), re-check on appeal (cannot edit locked scores)

C. Academic management and committees

Code	Thai	Ch	Lv	Scope	#UC	Main duties
`DEPT_HEAD`	หัวหน้าภาค (also ประธานหลักสูตร, ประธานกรรมการคัดเลือก)	BO	U	DEPT/PROGRAM	30	Review grade distribution, approve grade corrections (after SoD check), มส. list, makeup exams, internships; certify admission results; sponsor external accounts
`DEAN`	คณบดี	BO	U	FACULTY	30	Batch-approve grades (e-signature), approve withdrawals, transfers, T3 competition leave, batch leave per faculty, course-offering plan, faculty announcements, misconduct rulings
`GRAD_SCHOOL`	บัณฑิตวิทยาลัย	BO	U	CENTRAL	8	Graduate admission, committees, qualifying and comprehensive exam results
`ACADEMIC_COUNCIL`	สภาวิชาการ (also สภามหาวิทยาลัย)	BO (secretary)	U	CENTRAL	9	Approve degrees, curricula, PolicySet changes, calendar. Resolution numbers are recorded manually with 4-eyes until an e-Meeting system exists (W-06)
`SS_DIRECTOR`	ผู้อำนวยการ (`sschool_dir`)	BO/Exec	S	SCHOOL	11	Approve admission criteria and results, grades, graduation, promotion, transfers, caregiver certification, retention decisions, crisis communication

D. Administrative staff

Code	Thai	Ch	Lv	Scope	#UC	Main duties
`REGISTRAR`	นายทะเบียน (central, campus and school registrar office)	BO	U/S	CENTRAL/CAMPUS/SCHOOL	54	Student records and status, reporting-in, publish grades, calendar overrides, term rollover sign-off, eligibility lists, name changes, transcripts; data owner for grades and status
`ADMISSIONS`	งานรับสมัคร	BO	U/S	CAMPUS/SCHOOL	21	Configure rounds, verify documents, walk-in entry, clearing overrides (SoD-14), accommodation plans
`FIN_OFFICER`	การเงิน (maker / checker)	BO	U/S	CAMPUS	30	Invoices, receipts, reconciliation, refunds, cash advances, payouts
`FIN_HEAD`	การเงิน (หัวหน้างาน, approver by amount limit)	BO	U/S	CAMPUS	—	Approve refunds, instalments, receipt cancellation, fee schedules (SoD-05, SoD-10); data owner for finance
`SCHOLARSHIP_OFFICER`	งานทุน	BO	U	CAMPUS	2	Scholarship rounds and committees
`SLF_OFFICER`	เจ้าหน้าที่ กยศ.	BO + DSL	U	CAMPUS	4	กยศ. checks in DSL (maker ≠ checker)
`DORM_STAFF`	หอพัก (incl. ครูหอพัก, ครูเวร)	BO/App	U/S	DORM	12	Room allocation, check-in/out, leave pass, night roll call, ตม.30, escalations
`STUDENT_AFFAIRS`	กิจการนักศึกษา	BO	U	CAMPUS	10	Orientation, activities and volunteer hours, discipline, military deferment, insurance
`DISABILITY_SERVICES`	หน่วยบริการนักศึกษาพิการ	BO	U	CAMPUS	3	Accommodation plans for exams and study
`INTL_OFFICE`	งานนักศึกษาต่างชาติ	BO	U	CENTRAL	2	Foreign applicants, visa letters
`PR`	ประชาสัมพันธ์	BO	U/S	CAMPUS/CENTRAL	6	Announcements, publishing criteria, crisis communication lock
`RECORDS_OFFICE`	งานสารบรรณ	BO	U/S	CAMPUS	3	Official documents, retention and destruction
`PLANNING`	กองแผน	BO	U	CENTRAL	5	Admission plan, regulatory reports, employment survey
`FACILITIES`	งานอาคารสถานที่	BO	U/S	CAMPUS	2	Approve venue bookings
`PRACTICUM_CENTER`	ศูนย์ฝึกประสบการณ์วิชาชีพ	BO	U	CENTRAL	1	Practicum placements
`HR`	บุคลากร	BO	U/S	CENTRAL	5	Staff data, background checks, staff clearance
`COMPLAINTS_CENTER`	ศูนย์รับเรื่องร้องเรียน	BO	U/S	CENTRAL	4	Intake of complaints and tips
`LEGAL`	นิติกร	BO	U/S	CENTRAL	4	Appeals, degree revocation, official-information requests
`DOC_VERIFIER`	ผู้ตรวจสอบเอกสาร	BO	U	CAMPUS	1	Verify prior-education documents

E. Executives

Code	Thai	Ch	Lv	Scope	#UC	Main duties
`PRESIDENT`	อธิการบดี (or delegate)	Exec/BO	U/S	CENTRAL	9	Sign dismissal orders and replacement degrees, approve regulatory submissions, ITA/OIT, document destruction, write-offs above campus limit
`VP_FUNCTION`	รองอธิการบดีฝ่าย (วิชาการ; ดิจิทัล/CIO)	Exec/BO	U/S	CENTRAL	3	Endorse PolicySet and calendar (academic); 2nd approver for break-glass (CIO)
`CAMPUS_VP`	รองอธิการบดีประจำวิทยาเขต (`campusvp`)	Exec/BO	U	CAMPUS	10	Approve admission rounds and overrides, scholarships, refunds and write-offs above limit, safeguarding measures, P0 emergency announcements, access recertification

F. Sports, health and welfare

Code	Thai	Ch	Lv	Scope	#UC	Main duties
`COACH`	โค้ช	App/BO	U/S	SQUAD	19	Rosters, training, selection decisions, certify team membership, first-aid incident records; sees readiness status only (D-05)
`SPORTS_HEAD`	หัวหน้างานกีฬา (`sportshead`)	BO	U/S	CAMPUS	12	Certify rosters, submit batch competition leave, approve trips and selection, talent-pathway committee
`SPORT_SCIENTIST`	นักวิทยาศาสตร์การกีฬา	BO	U/S	SQUAD	5	Testing, development input
`LAB_STAFF`	เจ้าหน้าที่ห้องปฏิบัติการวิทยาศาสตร์การกีฬา	BO	U/S	CAMPUS	1	Lab bookings (LAB is a separate contract, 2574+)
`SPORT_NUTRITIONIST`	นักโภชนาการการกีฬา	BO	U/S	CARE	2	Nutrition referrals, weight management
`SPORT_PSYCHOLOGIST`	นักจิตวิทยาการกีฬา	BO	U/S	CARE	1	Psychology referrals
`PHYSICIAN`	แพทย์ (incl. `physician.lead`)	BO	U/S	CARE	9	Clinical records, clearances, return-to-play, concussion release; the lead physician is 1st approver for health break-glass
`NURSE`	พยาบาล	BO	U/S	CARE	9	Medical alerts, medication for minors, review first-aid records within 24 h; may set temporary UNAVAILABLE only
`PHYSIO`	นักกายภาพบำบัด	BO	U/S	CARE	2	Injury records, set readiness status, rehab
`PSYCHOLOGIST`	นักจิตวิทยา	BO	U/S	CARE	3	Mental-health crisis referral, transition support
`SAFEGUARD_LEAD`	ผู้รับผิดชอบด้านคุ้มครองเด็ก (`athlete_welfare_officer`)	BO	U/S	CASE	8	Safeguarding intake within 24 h, ContactRestriction, approve court-order restrictions and background checks, external referral

G. Governance, data and IT

Code	Thai	Ch	Lv	Scope	#UC	Main duties
`DPO`	DPO	BO	U/S	CENTRAL	7	2nd approver for health break-glass and sensitive exports, data-subject requests, retrospective reviews
`DATA_OWNER`	เจ้าของข้อมูล (per domain, e.g. registrar for grades/status, finance head for finance)	BO	U/S	domain	8	Approve data fixes, exports, e-Form publishing, JIT access to business data; certify sensitive roles
`DATA_STEWARD`	Data steward	BO	U/S	CENTRAL	1	Regulatory data snapshots and quality checks
`INTERNAL_AUDIT`	ผู้ตรวจสอบภายใน	BO	U/S	CENTRAL	7	Read-only review of recertification, finance and access reports
`MODULE_CONFIG_ADMIN`	ผู้ดูแลการตั้งค่าโมดูล	BO	U/S	CENTRAL	2	Draft PolicySet changes and e-Forms (cannot publish own change, SoD-06)
`PLATFORM_ADMIN`	ผู้ดูแลแพลตฟอร์มส่วนกลาง	BO	—	CENTRAL	2	Change freeze, capacity, platform operations
`IAM_ADMIN`	ผู้ดูแล IAM	BO	—	CENTRAL	1	Accounts and role assignments
`SECURITY_ADMIN`	ผู้ดูแลความมั่นคงปลอดภัย (`security_admin`)	BO	—	CENTRAL	3	Approve JIT/PAM and break-glass (1st), 2nd approver for data fixes on asm/rec/fin, MFA reset for sensitive accounts
`CAMPUS_IT`	IT วิทยาเขต	BO	—	CAMPUS	2	2nd approver for MFA reset (non-sensitive accounts)
`HELPDESK`	Helpdesk L1/L2	BO	—	CENTRAL	2	Tickets; L2 drafts data-fix requests
`DBA`	DBA	—	—	CENTRAL	2	Review data-fix scripts on staging; no direct production edits

H. External parties (sponsored accounts with expiry, W-139)

Code	Thai	#UC	Notes
`EXTERNAL_PERSON`	บุคคลภายนอก	4	Short-course participants, official-information requesters, complainants
`SPORTS_ASSOCIATION`	สมาคมกีฬา	1	Athlete-quota admission input
`PRACTICUM_SCHOOL_ADMIN`	ผู้บริหารสถานศึกษาที่รับนักศึกษาฝึกสอน	1	Host school for teaching practicum
`MENTOR_TEACHER`	ครูพี่เลี้ยง	1	Practicum mentor
`HOST_ORG`	สถานประกอบการ	1	Internship host
`INSURER`	บริษัทประกันภัยคู่สัญญา	1	Accident-insurance claims
`EMPLOYER_VERIFIER`	(นายจ้าง, W-67)	1	Verifies degrees through the public verification service; no account needed [inferred]

ระบบ (system) appears as an actor in most use cases. It is automation, not a role.

Roles in the BA chart or proposal without a use case yet

Kitchen / nutrition staff (SS-08), gate or security guard (SS-07.3 exit and return log), and an executive-dashboard viewer as a separate role (the proposal's ผู้บริหาร is covered by PRESIDENT, VP_FUNCTION, CAMPUS_VP, DEAN and SS_DIRECTOR).

3. Approval authority matrix

Who approves what, from the use cases. "→" = sequence; "limit" = amount-based delegation (values to be configured by the university).

Decision	Approval chain	UC
Admission round (university)	`ADMISSIONS` drafts → `DEPT_HEAD` checks rubric → `DEAN` endorses → `CAMPUS_VP` approves and e-signs	W-69, W-72
Admission round and results (sports school)	`SS_DIRECTOR` approves round; `SS_DIRECTOR` certifies results	W-83
Admission results (quota)	Selection committee chair (`DEPT_HEAD`) certifies (scores locked)	W-70, W-71
Admission overrides / appeals	`ADMISSIONS` override with reason (SoD-14); appeal: `DEPT_HEAD` → `CAMPUS_VP` (2nd approver), capped by AccreditedIntakeCap	W-74, W-18
Graduate admission	`GRAD_SCHOOL` certifies and decides to open program	W-84
Reporting-in / student status	`REGISTRAR`	W-44, W-78
Grades (university)	`LECTURER` submits → `DEPT_HEAD` reviews (skipped if they teach it, SoD-01) → `DEAN` batch e-sign → `REGISTRAR` publishes	W-01
Grade correction	`DEPT_HEAD` checks (requester ≠ approver, SoD-02) → `DEAN` approves	W-02
Grades, graduation, promotion (sports school)	`SS_DIRECTOR`	W-87, W-88, W-94
Withdrawal / credit overload / leave of absence	`GUARDIAN` co-sign if DMN requires → `ADVISOR` → `DEAN`	W-03, W-10
Medical withdrawal, transfer of major, course substitution	`ADVISOR` / `DEPT_HEAD` → `DEAN`	W-161, W-25, W-140
Dismissal	`PRESIDENT` (or delegate) signs the order	W-11
Time extension	`ADVISOR` → `ACADEMIC_COUNCIL` if regulation requires	W-99
Degree conferral	`DEPT_HEAD` certifies → `ACADEMIC_COUNCIL` approves (resolution no., 4-eyes)	W-06
Curriculum revision / closure	`DEAN` (faculty committee) → `ACADEMIC_COUNCIL` + university council	W-08, W-141
PolicySet change	`MODULE_CONFIG_ADMIN` drafts → `REGISTRAR` → `VP_FUNCTION` (academic) → `ACADEMIC_COUNCIL` if substantive; publisher ≠ editor (SoD-06)	W-15
Academic calendar	`REGISTRAR` → `VP_FUNCTION` (academic) → `ACADEMIC_COUNCIL` / `PRESIDENT`	W-117
Fee schedule for new term	`FIN_HEAD` approves; setter ≠ approver (SoD-05)	W-122
Refund, instalment, fee waiver, late-fee waiver	`FIN_OFFICER` → `FIN_HEAD` by limit (SoD-10) → `CAMPUS_VP` above limit	W-09, W-27, W-81, W-102, W-120
Write-off	`CAMPUS_VP` by limit → `PRESIDENT` above campus limit	W-121
Scholarship	Committee (COI declared, SoD-09) → `CAMPUS_VP`	W-07
Competition leave	T1 auto-approved; T2 `ADVISOR`; T3 (or flagged T2) `DEAN`; batch: one `DEAN` approval per faculty	W-04, W-114
Team trip and cash advance	`SPORTS_HEAD` approves trip; `FIN_OFFICER` approves advance; clearing by a different person	W-31, W-115
Team selection	`COACH` decides with reasons → `SPORTS_HEAD` approves and publishes ≥ 14 days ahead; review by a selector not involved first time	W-150
Sports-school athlete retention	Committee led by `SS_DIRECTOR` (not the proposer); guardian may appeal within 10 working days	W-151
Leave pass (sports school)	`GUARDIAN` with leave-pass right; pickup by someone else needs 4-eyes	W-13
Caregiver certification	`HOMEROOM_TEACHER` proposes → `SS_DIRECTOR` + `REGISTRAR` (4-eyes); university: `REGISTRAR` + `STUDENT_AFFAIRS`	W-160
Court-order restriction	`SAFEGUARD_LEAD` approves with end/review date	W-93
Safeguarding measures	`CAMPUS_VP` (with `SS_DIRECTOR` if not involved)	W-22
Health-data break-glass	`PHYSICIAN` lead (≠ requester) → `DPO`; life-threatening: self-activate, reviewed by both within 24 h	W-14
Announcements	`DEAN` / `CAMPUS_VP` by OrgUnit level; P0 emergency needs a 2nd approver	W-36
Regulatory submission, ITA/OIT	`PLANNING` reviews → `PRESIDENT` (or delegate)	W-35, W-136
Bulk personal-data export	`DATA_OWNER` → `DPO` if sensitive	W-138
Data fix	`HELPDESK` L2 drafts → `DATA_OWNER` → `DBA` reviews script → `SECURITY_ADMIN` 2nd approval for asm/rec/fin	W-137
JIT privileged access	`SECURITY_ADMIN` + `DATA_OWNER` when business data is touched	W-124
Break-glass system account	`SECURITY_ADMIN` → `VP_FUNCTION` (CIO), split credentials	W-125
Access recertification	Line manager (`CAMPUS_VP` or delegate) per person; `DATA_OWNER` for sensitive roles	W-126
External account	Sponsor (e.g. `DEPT_HEAD`) requests with role, scope and expiry	W-139
e-Form publishing	`MODULE_CONFIG_ADMIN` drafts → process `DATA_OWNER` approves	W-113
Document destruction	`RECORDS_OFFICE` → `PRESIDENT`	W-40
Guardian access to adult student's data	`STUDENT` per category with expiry	W-128

4. Open points for the BA

Confirm the role list and codes, and which roles exist at sports schools (the use cases are university-centred: e.g. who plays DEAN's role at a school, and is SS_DIRECTOR the only approver?).
Approval amount limits for finance (values configured by the university).
Whether FIN_OFFICER / FIN_HEAD, PHYSICIAN / physician.lead, and central / campus REGISTRAR should be separate roles or one role with different scopes.
Who operates committee roles (ACADEMIC_COUNCIL, selection and scholarship committees) in the system: a secretary account, or each member?
Can a person hold roles in several units at once (e.g. a lecturer who coaches at another campus)?
Roles for SS-08 nutrition and the school gate.