# 13 — Role Matrix (draft v0.1)

> **Status: draft for BA review (2026-10-30).** Built from the 162 use cases ([12-use-cases.md](12-use-cases.md)), the BA chart and the proposal. Role codes are **our proposal**; the use cases name roles in Thai. Counts = number of use cases the role takes part in. The objective role × module participation counts are generated in [use-cases/role-module-matrix.md](use-cases/role-module-matrix.md). Access rights per data domain are in [14-security-matrix.md](14-security-matrix.md).

## 1. How a role is assigned (proposed model)

A user gets permissions through **role assignments**. Each assignment has:

| Part | Values | Source |
|---|---|---|
| Role | One of the codes below | — |
| Org scope | University: `CENTRAL` · `CAMPUS:<id>` · `FACULTY:<id>` · `MAJOR:<id>` (สาขา) · `PROGRAM:<id>` (หลักสูตร). Sports school: `SCHOOL:<id>` · `GRADE:<id>` (ระดับชั้น) · `SPORT:<id>` (ชนิดกีฬา). Plus `DORM:<id>` | ORG unit tree from the BA draw.io page "โครงสร้างหน่วยงานของระบบ" (see [03-modules.md](03-modules.md#a2-organisation-structure-ba-drawio-page-โครงสร้างหน่วยงานของระบบ)); W-117, W-36 "approve per OrgUnit level" |
| Relationship scope (instead of org scope for some roles) | `OWN` (self) · `RELATION` (guardian ↔ learner) · `SECTION` (courses taught) · `ADVISEE` · `CLASS` (homeroom) · `SQUAD` (coach) · `CARE` (clinical care relationship) · `CASE` (assigned case) · `SESSION` (exam or skill-test session) | W-14, W-22, W-39, W-127 |
| Validity | From / to dates; term-based roles expire at term rollover | W-122 ("หมดอายุ role ราย term"), W-139 |
| Origin | `DIRECT` · `ACTING` / `DELEGATED` signing authority · `SPONSORED` external account · `JIT` privileged elevation | W-123, W-139, W-124 |

Implementation note [inferred]: RBAC for the role, plus **ABAC** checks on scope, relationship, consent and data category. The use cases already require ABAC for guardians (W-127).

## 2. Role catalog

Legend: **Ch** = main channel (App = student/guardian mobile or PWA/LIFF, Web = portal, BO = staff backoffice, Tab = judge tablet, Exec = executive dashboard). **Lv** = education level (U = university, S = sports school, U/S = both). **#UC** = number of use cases.

### A. Learners, guardians and alumni

| Code | Thai (use cases) | Ch | Lv | Scope | #UC | Main duties |
|---|---|---|---|---|---|---|
| `APPLICANT` | ผู้สมัคร | App/Web | U/S | OWN | 19 | Apply, upload documents, pay application fee, confirm offer, appeal results |
| `STUDENT` | นักศึกษา (also นักเรียน) | App/Web | U/S | OWN | 80 | Register, pay, file requests and leave, view grades, consent decisions, report incidents |
| `GUARDIAN` | ผู้ปกครอง | App (LIFF/PWA) | U/S | RELATION | 28 | Sub-types `LEGAL`, `CAREGIVER`, `LOCAL_GUARDIAN`, `OBSERVER`, `EMERGENCY_CONTACT`, `PICKUP` (see [04](04-roles-and-access.md)). Co-sign when the DMN rule requires it, approve leave passes, pay, receive incident calls |
| `ALUMNI` | ศิษย์เก่า | Web | U | OWN | 4 | Update profile, request replacement documents, surveys |
| `FORMER_STUDENT` | อดีตนักศึกษาที่ไม่สำเร็จการศึกษา | Web | U | OWN | 1 | Request records after leaving |

### B. Teaching, advising and assessment

| Code | Thai | Ch | Lv | Scope | #UC | Main duties |
|---|---|---|---|---|---|---|
| `LECTURER` | อาจารย์ผู้สอน | BO | U | SECTION | 17 | Attendance, scores, submit grades (W-01), approve sick leave (W-53), approve own-request makeup exams (W-05); acknowledges competition leave and does **not** approve it |
| `ADVISOR` | อาจารย์ที่ปรึกษา | BO | U | ADVISEE | 19 | Approve study plan and add/drop, endorse withdrawal, leave of absence, T2/T3 competition leave, cross-campus registration |
| `THESIS_ADVISOR` | อาจารย์ที่ปรึกษาวิทยานิพนธ์ | BO | U | ADVISEE | 6 | Endorse proposal, similarity report and final revisions |
| `SS_TEACHER` | ครูผู้สอนโรงเรียนกีฬา | BO | S | SECTION | 2 | Teaching, scores, ปพ.5 |
| `HOMEROOM_TEACHER` | ครูประจำชั้น | BO | S | CLASS | 6 | First guardian contact, verify caregivers by home visit, welfare input to retention reviews |
| `PRACTICUM_SUPERVISOR` | อาจารย์นิเทศก์ | BO | U | ADVISEE | 1 | Supervise teaching practicum |
| `EXAM_PROCTOR` | กรรมการคุมสอบ | BO | U | SESSION | 2 | Run exams, report misconduct |
| `SKILL_JUDGE` | กรรมการสอบทักษะ | Tab | U/S | SESSION | 10 | Score skill tests (multi-judge), re-check on appeal (cannot edit locked scores) |

### C. Academic management and committees

| Code | Thai | Ch | Lv | Scope | #UC | Main duties |
|---|---|---|---|---|---|---|
| `DEPT_HEAD` | หัวหน้าภาค (also ประธานหลักสูตร, ประธานกรรมการคัดเลือก) | BO | U | DEPT/PROGRAM | 30 | Review grade distribution, approve grade corrections (after SoD check), มส. list, makeup exams, internships; certify admission results; sponsor external accounts |
| `DEAN` | คณบดี | BO | U | FACULTY | 30 | Batch-approve grades (e-signature), approve withdrawals, transfers, T3 competition leave, batch leave per faculty, course-offering plan, faculty announcements, misconduct rulings |
| `GRAD_SCHOOL` | บัณฑิตวิทยาลัย | BO | U | CENTRAL | 8 | Graduate admission, committees, qualifying and comprehensive exam results |
| `ACADEMIC_COUNCIL` | สภาวิชาการ (also สภามหาวิทยาลัย) | BO (secretary) | U | CENTRAL | 9 | Approve degrees, curricula, PolicySet changes, calendar. Resolution numbers are **recorded manually with 4-eyes** until an e-Meeting system exists (W-06) |
| `SS_DIRECTOR` | ผู้อำนวยการ (`sschool_dir`) | BO/Exec | S | SCHOOL | 11 | Approve admission criteria and results, grades, graduation, promotion, transfers, caregiver certification, retention decisions, crisis communication |

### D. Administrative staff

| Code | Thai | Ch | Lv | Scope | #UC | Main duties |
|---|---|---|---|---|---|---|
| `REGISTRAR` | นายทะเบียน (central, campus and school registrar office) | BO | U/S | CENTRAL/CAMPUS/SCHOOL | 54 | Student records and status, reporting-in, publish grades, calendar overrides, term rollover sign-off, eligibility lists, name changes, transcripts; data owner for grades and status |
| `ADMISSIONS` | งานรับสมัคร | BO | U/S | CAMPUS/SCHOOL | 21 | Configure rounds, verify documents, walk-in entry, clearing overrides (SoD-14), accommodation plans |
| `FIN_OFFICER` | การเงิน (maker / checker) | BO | U/S | CAMPUS | 30 | Invoices, receipts, reconciliation, refunds, cash advances, payouts |
| `FIN_HEAD` | การเงิน (หัวหน้างาน, approver by amount limit) | BO | U/S | CAMPUS | — | Approve refunds, instalments, receipt cancellation, fee schedules (SoD-05, SoD-10); data owner for finance |
| `SCHOLARSHIP_OFFICER` | งานทุน | BO | U | CAMPUS | 2 | Scholarship rounds and committees |
| `SLF_OFFICER` | เจ้าหน้าที่ กยศ. | BO + DSL | U | CAMPUS | 4 | กยศ. checks in DSL (maker ≠ checker) |
| `DORM_STAFF` | หอพัก (incl. ครูหอพัก, ครูเวร) | BO/App | U/S | DORM | 12 | Room allocation, check-in/out, leave pass, night roll call, ตม.30, escalations |
| `STUDENT_AFFAIRS` | กิจการนักศึกษา | BO | U | CAMPUS | 10 | Orientation, activities and volunteer hours, discipline, military deferment, insurance |
| `DISABILITY_SERVICES` | หน่วยบริการนักศึกษาพิการ | BO | U | CAMPUS | 3 | Accommodation plans for exams and study |
| `INTL_OFFICE` | งานนักศึกษาต่างชาติ | BO | U | CENTRAL | 2 | Foreign applicants, visa letters |
| `PR` | ประชาสัมพันธ์ | BO | U/S | CAMPUS/CENTRAL | 6 | Announcements, publishing criteria, crisis communication lock |
| `RECORDS_OFFICE` | งานสารบรรณ | BO | U/S | CAMPUS | 3 | Official documents, retention and destruction |
| `PLANNING` | กองแผน | BO | U | CENTRAL | 5 | Admission plan, regulatory reports, employment survey |
| `FACILITIES` | งานอาคารสถานที่ | BO | U/S | CAMPUS | 2 | Approve venue bookings |
| `PRACTICUM_CENTER` | ศูนย์ฝึกประสบการณ์วิชาชีพ | BO | U | CENTRAL | 1 | Practicum placements |
| `HR` | บุคลากร | BO | U/S | CENTRAL | 5 | Staff data, background checks, staff clearance |
| `COMPLAINTS_CENTER` | ศูนย์รับเรื่องร้องเรียน | BO | U/S | CENTRAL | 4 | Intake of complaints and tips |
| `LEGAL` | นิติกร | BO | U/S | CENTRAL | 4 | Appeals, degree revocation, official-information requests |
| `DOC_VERIFIER` | ผู้ตรวจสอบเอกสาร | BO | U | CAMPUS | 1 | Verify prior-education documents |

### E. Executives

| Code | Thai | Ch | Lv | Scope | #UC | Main duties |
|---|---|---|---|---|---|---|
| `PRESIDENT` | อธิการบดี (or delegate) | Exec/BO | U/S | CENTRAL | 9 | Sign dismissal orders and replacement degrees, approve regulatory submissions, ITA/OIT, document destruction, write-offs above campus limit |
| `VP_FUNCTION` | รองอธิการบดีฝ่าย (วิชาการ; ดิจิทัล/CIO) | Exec/BO | U/S | CENTRAL | 3 | Endorse PolicySet and calendar (academic); 2nd approver for break-glass (CIO) |
| `CAMPUS_VP` | รองอธิการบดีประจำวิทยาเขต (`campusvp`) | Exec/BO | U | CAMPUS | 10 | Approve admission rounds and overrides, scholarships, refunds and write-offs above limit, safeguarding measures, P0 emergency announcements, access recertification |

### F. Sports, health and welfare

| Code | Thai | Ch | Lv | Scope | #UC | Main duties |
|---|---|---|---|---|---|---|
| `COACH` | โค้ช | App/BO | U/S | SQUAD | 19 | Rosters, training, selection decisions, certify team membership, first-aid incident records; sees **readiness status only** (D-05) |
| `SPORTS_HEAD` | หัวหน้างานกีฬา (`sportshead`) | BO | U/S | CAMPUS | 12 | Certify rosters, submit batch competition leave, approve trips and selection, talent-pathway committee |
| `SPORT_SCIENTIST` | นักวิทยาศาสตร์การกีฬา | BO | U/S | SQUAD | 5 | Testing, development input |
| `LAB_STAFF` | เจ้าหน้าที่ห้องปฏิบัติการวิทยาศาสตร์การกีฬา | BO | U/S | CAMPUS | 1 | Lab bookings (LAB is a separate contract, 2574+) |
| `SPORT_NUTRITIONIST` | นักโภชนาการการกีฬา | BO | U/S | CARE | 2 | Nutrition referrals, weight management |
| `SPORT_PSYCHOLOGIST` | นักจิตวิทยาการกีฬา | BO | U/S | CARE | 1 | Psychology referrals |
| `PHYSICIAN` | แพทย์ (incl. `physician.lead`) | BO | U/S | CARE | 9 | Clinical records, clearances, return-to-play, concussion release; the lead physician is 1st approver for health break-glass |
| `NURSE` | พยาบาล | BO | U/S | CARE | 9 | Medical alerts, medication for minors, review first-aid records within 24 h; may set **temporary** UNAVAILABLE only |
| `PHYSIO` | นักกายภาพบำบัด | BO | U/S | CARE | 2 | Injury records, set readiness status, rehab |
| `PSYCHOLOGIST` | นักจิตวิทยา | BO | U/S | CARE | 3 | Mental-health crisis referral, transition support |
| `SAFEGUARD_LEAD` | ผู้รับผิดชอบด้านคุ้มครองเด็ก (`athlete_welfare_officer`) | BO | U/S | CASE | 8 | Safeguarding intake within 24 h, ContactRestriction, approve court-order restrictions and background checks, external referral |

### G. Governance, data and IT

| Code | Thai | Ch | Lv | Scope | #UC | Main duties |
|---|---|---|---|---|---|---|
| `DPO` | DPO | BO | U/S | CENTRAL | 7 | 2nd approver for health break-glass and sensitive exports, data-subject requests, retrospective reviews |
| `DATA_OWNER` | เจ้าของข้อมูล (per domain, e.g. registrar for grades/status, finance head for finance) | BO | U/S | domain | 8 | Approve data fixes, exports, e-Form publishing, JIT access to business data; certify sensitive roles |
| `DATA_STEWARD` | Data steward | BO | U/S | CENTRAL | 1 | Regulatory data snapshots and quality checks |
| `INTERNAL_AUDIT` | ผู้ตรวจสอบภายใน | BO | U/S | CENTRAL | 7 | Read-only review of recertification, finance and access reports |
| `MODULE_CONFIG_ADMIN` | ผู้ดูแลการตั้งค่าโมดูล | BO | U/S | CENTRAL | 2 | Draft PolicySet changes and e-Forms (cannot publish own change, SoD-06) |
| `PLATFORM_ADMIN` | ผู้ดูแลแพลตฟอร์มส่วนกลาง | BO | — | CENTRAL | 2 | Change freeze, capacity, platform operations |
| `IAM_ADMIN` | ผู้ดูแล IAM | BO | — | CENTRAL | 1 | Accounts and role assignments |
| `SECURITY_ADMIN` | ผู้ดูแลความมั่นคงปลอดภัย (`security_admin`) | BO | — | CENTRAL | 3 | Approve JIT/PAM and break-glass (1st), 2nd approver for data fixes on asm/rec/fin, MFA reset for sensitive accounts |
| `CAMPUS_IT` | IT วิทยาเขต | BO | — | CAMPUS | 2 | 2nd approver for MFA reset (non-sensitive accounts) |
| `HELPDESK` | Helpdesk L1/L2 | BO | — | CENTRAL | 2 | Tickets; L2 drafts data-fix requests |
| `DBA` | DBA | — | — | CENTRAL | 2 | Review data-fix scripts on staging; no direct production edits |

### H. External parties (sponsored accounts with expiry, W-139)

| Code | Thai | #UC | Notes |
|---|---|---|---|
| `EXTERNAL_PERSON` | บุคคลภายนอก | 4 | Short-course participants, official-information requesters, complainants |
| `SPORTS_ASSOCIATION` | สมาคมกีฬา | 1 | Athlete-quota admission input |
| `PRACTICUM_SCHOOL_ADMIN` | ผู้บริหารสถานศึกษาที่รับนักศึกษาฝึกสอน | 1 | Host school for teaching practicum |
| `MENTOR_TEACHER` | ครูพี่เลี้ยง | 1 | Practicum mentor |
| `HOST_ORG` | สถานประกอบการ | 1 | Internship host |
| `INSURER` | บริษัทประกันภัยคู่สัญญา | 1 | Accident-insurance claims |
| `EMPLOYER_VERIFIER` | (นายจ้าง, W-67) | 1 | Verifies degrees through the public verification service; no account needed [inferred] |

`ระบบ` (system) appears as an actor in most use cases. It is automation, not a role.

### Roles in the BA chart or proposal without a use case yet
Kitchen / nutrition staff (SS-08), gate or security guard (SS-07.3 exit and return log), and an executive-dashboard viewer as a separate role (the proposal's ผู้บริหาร is covered by `PRESIDENT`, `VP_FUNCTION`, `CAMPUS_VP`, `DEAN` and `SS_DIRECTOR`).

## 3. Approval authority matrix

Who approves what, from the use cases. "→" = sequence; "limit" = amount-based delegation (values to be configured by the university).

| Decision | Approval chain | UC |
|---|---|---|
| Admission round (university) | `ADMISSIONS` drafts → `DEPT_HEAD` checks rubric → `DEAN` endorses → `CAMPUS_VP` approves and e-signs | W-69, W-72 |
| Admission round and results (sports school) | `SS_DIRECTOR` approves round; `SS_DIRECTOR` certifies results | W-83 |
| Admission results (quota) | Selection committee chair (`DEPT_HEAD`) certifies (scores locked) | W-70, W-71 |
| Admission overrides / appeals | `ADMISSIONS` override with reason (SoD-14); appeal: `DEPT_HEAD` → `CAMPUS_VP` (2nd approver), capped by AccreditedIntakeCap | W-74, W-18 |
| Graduate admission | `GRAD_SCHOOL` certifies and decides to open program | W-84 |
| Reporting-in / student status | `REGISTRAR` | W-44, W-78 |
| Grades (university) | `LECTURER` submits → `DEPT_HEAD` reviews (skipped if they teach it, SoD-01) → `DEAN` batch e-sign → `REGISTRAR` publishes | W-01 |
| Grade correction | `DEPT_HEAD` checks (requester ≠ approver, SoD-02) → `DEAN` approves | W-02 |
| Grades, graduation, promotion (sports school) | `SS_DIRECTOR` | W-87, W-88, W-94 |
| Withdrawal / credit overload / leave of absence | `GUARDIAN` co-sign if DMN requires → `ADVISOR` → `DEAN` | W-03, W-10 |
| Medical withdrawal, transfer of major, course substitution | `ADVISOR` / `DEPT_HEAD` → `DEAN` | W-161, W-25, W-140 |
| Dismissal | `PRESIDENT` (or delegate) signs the order | W-11 |
| Time extension | `ADVISOR` → `ACADEMIC_COUNCIL` if regulation requires | W-99 |
| Degree conferral | `DEPT_HEAD` certifies → `ACADEMIC_COUNCIL` approves (resolution no., 4-eyes) | W-06 |
| Curriculum revision / closure | `DEAN` (faculty committee) → `ACADEMIC_COUNCIL` + university council | W-08, W-141 |
| PolicySet change | `MODULE_CONFIG_ADMIN` drafts → `REGISTRAR` → `VP_FUNCTION` (academic) → `ACADEMIC_COUNCIL` if substantive; publisher ≠ editor (SoD-06) | W-15 |
| Academic calendar | `REGISTRAR` → `VP_FUNCTION` (academic) → `ACADEMIC_COUNCIL` / `PRESIDENT` | W-117 |
| Fee schedule for new term | `FIN_HEAD` approves; setter ≠ approver (SoD-05) | W-122 |
| Refund, instalment, fee waiver, late-fee waiver | `FIN_OFFICER` → `FIN_HEAD` by limit (SoD-10) → `CAMPUS_VP` above limit | W-09, W-27, W-81, W-102, W-120 |
| Write-off | `CAMPUS_VP` by limit → `PRESIDENT` above campus limit | W-121 |
| Scholarship | Committee (COI declared, SoD-09) → `CAMPUS_VP` | W-07 |
| Competition leave | T1 auto-approved; T2 `ADVISOR`; T3 (or flagged T2) `DEAN`; batch: one `DEAN` approval per faculty | W-04, W-114 |
| Team trip and cash advance | `SPORTS_HEAD` approves trip; `FIN_OFFICER` approves advance; clearing by a different person | W-31, W-115 |
| Team selection | `COACH` decides with reasons → `SPORTS_HEAD` approves and publishes ≥ 14 days ahead; review by a selector not involved first time | W-150 |
| Sports-school athlete retention | Committee led by `SS_DIRECTOR` (not the proposer); guardian may appeal within 10 working days | W-151 |
| Leave pass (sports school) | `GUARDIAN` with leave-pass right; pickup by someone else needs 4-eyes | W-13 |
| Caregiver certification | `HOMEROOM_TEACHER` proposes → `SS_DIRECTOR` + `REGISTRAR` (4-eyes); university: `REGISTRAR` + `STUDENT_AFFAIRS` | W-160 |
| Court-order restriction | `SAFEGUARD_LEAD` approves with end/review date | W-93 |
| Safeguarding measures | `CAMPUS_VP` (with `SS_DIRECTOR` if not involved) | W-22 |
| Health-data break-glass | `PHYSICIAN` lead (≠ requester) → `DPO`; life-threatening: self-activate, reviewed by both within 24 h | W-14 |
| Announcements | `DEAN` / `CAMPUS_VP` by OrgUnit level; P0 emergency needs a 2nd approver | W-36 |
| Regulatory submission, ITA/OIT | `PLANNING` reviews → `PRESIDENT` (or delegate) | W-35, W-136 |
| Bulk personal-data export | `DATA_OWNER` → `DPO` if sensitive | W-138 |
| Data fix | `HELPDESK` L2 drafts → `DATA_OWNER` → `DBA` reviews script → `SECURITY_ADMIN` 2nd approval for asm/rec/fin | W-137 |
| JIT privileged access | `SECURITY_ADMIN` + `DATA_OWNER` when business data is touched | W-124 |
| Break-glass system account | `SECURITY_ADMIN` → `VP_FUNCTION` (CIO), split credentials | W-125 |
| Access recertification | Line manager (`CAMPUS_VP` or delegate) per person; `DATA_OWNER` for sensitive roles | W-126 |
| External account | Sponsor (e.g. `DEPT_HEAD`) requests with role, scope and expiry | W-139 |
| e-Form publishing | `MODULE_CONFIG_ADMIN` drafts → process `DATA_OWNER` approves | W-113 |
| Document destruction | `RECORDS_OFFICE` → `PRESIDENT` | W-40 |
| Guardian access to adult student's data | `STUDENT` per category with expiry | W-128 |

## 4. Open points for the BA

1. Confirm the role list and codes, and which roles exist at **sports schools** (the use cases are university-centred: e.g. who plays `DEAN`'s role at a school, and is `SS_DIRECTOR` the only approver?).
2. Approval **amount limits** for finance (values configured by the university).
3. Whether `FIN_OFFICER` / `FIN_HEAD`, `PHYSICIAN` / `physician.lead`, and central / campus `REGISTRAR` should be separate roles or one role with different scopes.
4. Who operates committee roles (`ACADEMIC_COUNCIL`, selection and scholarship committees) in the system: a secretary account, or each member?
5. Can a person hold roles in several units at once (e.g. a lecturer who coaches at another campus)?
6. Roles for SS-08 nutrition and the school gate.