> ## Documentation Index > Fetch the complete documentation index at: https://theteam-13fc7f49.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Use Cases & Role Permissions > Who does what on the platform: the global use case diagram, then one permission table per role. This page answers two questions: **what each kind of user does on the platform** (the use case diagram) and **which permissions each role holds** (one table per role). It was built on 29/10/2026 from the backend's policies (`app/Policies`), the role → permission seed (`PermissionRole::assign_permissions_to_roles`), and the screens each role gets in the app. **Table of Contents** * **1. Global use case diagram**: actors (with their generalization) and use cases * **2. How permissions work** * **3. Permissions per role**: Super Admin, Admin, Content Manager, Instructor, Student * **4. Features by role** * **5. Keeping this page in sync** *** ## 1. Global use case diagram ### 1.1 Actors The actors and their **generalization** (UML inheritance: the hollow arrow points to the parent, and a child actor can do every use case of its parent). The four company roles are a *Signed-in user*, so they all get the *My account* use cases. The Super Admin is an Admin of every company, plus the platform use cases. ```mermaid theme={null} classDiagram direction BT class Visitor { <> Not signed in } class SignedInUser["Signed-in user"] { <> +Edit profile, password and language() +Turn two-factor authentication on or off() +Read notifications() +Sign out of all devices() } class Student { <> role_id = 1 } class Instructor { <> role_id = 2 } class ContentManager["Content Manager"] { <> role_id = 3 } class Admin { <> role_id = 4 · own company } class SuperAdmin["Super Admin"] { <> role_id = 5 · every company } SignedInUser <|-- Student SignedInUser <|-- Instructor SignedInUser <|-- ContentManager SignedInUser <|-- Admin Admin <|-- SuperAdmin ``` ### 1.2 Use cases Actors are on the left, outside systems on the right; each arrow is one use case the actor performs. Inherited use cases (§1.1) are not drawn again: the *My account* ones belong to every signed-in role, and the Super Admin also has every use case of the Admin. ```mermaid theme={null} flowchart LR classDef actor fill:#DCFCE7,stroke:#15803D,color:#14532D,font-weight:bold classDef ext fill:#F3F4F6,stroke:#6B7280,color:#111827,stroke-dasharray:4 3 V["👤 Visitor"]:::actor S["👤 Student"]:::actor I["👤 Instructor"]:::actor CM["👤 Content Manager"]:::actor A["👤 Admin"]:::actor SA["👤 Super Admin"]:::actor subgraph PUB["Public"] P1(["Visit the company landing page"]) P2(["Register and verify the e-mail"]) P3(["Sign in, with 2FA when enabled"]) P4(["Reset a forgotten password"]) P5(["Verify a certificate"]) end subgraph LEARN["Learning & buying"] L1(["Browse trainings, exams and instructors"]) L2(["Manage the wishlist and the cart"]) L3(["Apply a coupon"]) L4(["Pay for an order"]) L5(["Redeem a voucher"]) L6(["Follow a training's lessons"]) L7(["Take a quiz or an exam"]) L8(["Review past attempts"]) L9(["Download certificates"]) L10(["Rate and review"]) L11(["Join a classroom and chat"]) end subgraph TEACH["Teaching"] T1(["See my dashboard and sales"]) T2(["Edit my public profile and background"]) end subgraph CONTENT["Content"] C1(["Manage trainings, chapters and lessons"]) C2(["Manage quizzes, exams and questions"]) C4(["Manage classrooms and notify members"]) C5(["Moderate chatrooms"]) C3(["Manage categories and tags"]) C6(["Export and import content"]) end subgraph COMPANY["Company administration"] M1(["Manage users and their roles"]) M2(["Sign in as a user (impersonate)"]) M3(["Manage orders, mark them paid offline"]) M4(["Manage coupons and vouchers"]) M5(["Send reminders and notifications"]) M6(["Configure the platform: theme, landing page, certificate, SMTP, storage"]) M7(["See dashboards, analytics and activity history"]) end subgraph PLATFORM["Platform administration"] SP1(["Manage companies"]) SP2(["Manage company admins"]) SP3(["Set each role's permissions per company"]) SP4(["Export and import platform data"]) end PAY["🏦 Payment gateway
Konnect / Flouci"]:::ext MAIL["✉️ Mail server
SMTP"]:::ext V --> P1 V --> P2 V --> P3 V --> P4 V --> P5 S --> L1 S --> L2 S --> L3 S --> L4 S --> L5 S --> L6 S --> L7 S --> L8 S --> L9 S --> L10 S --> L11 I --> T1 I --> T2 I --> C1 I --> C2 I --> C4 I --> C5 CM --> C1 CM --> C2 CM --> C4 CM --> C3 A --> T1 A --> C1 A --> C2 A --> C4 A --> C5 A --> C3 A --> C6 A --> M1 A --> M2 A --> M3 A --> M4 A --> M5 A --> M6 A --> M7 SA --> SP1 SA --> SP2 SA --> SP3 SA --> SP4 L3 -.->|extend| L4 L4 --> PAY P2 --> MAIL M4 -->|vouchers by e-mail| MAIL M5 --> MAIL ``` > [!NOTE] > > The Admin reaches **See my dashboard and sales** for any instructor of the company (the "preview instructor" screen). The Super Admin inherits the Admin's use cases (§1.1). Their own app screens are the *Platform administration* box plus impersonation, analytics and export; for the rest of a company's work they go through the API or **Sign in as a user**. *** ## 2. How permissions work The platform has five roles, stored in `users.role_id`: | Id | Role | Scope | | :-: | :- | :- | | 1 | Student | Own company | | 2 | Instructor | Own company | | 3 | Content Manager | Own company | | 4 | Admin | Own company | | 5 | Super Admin | Every company | Each policy check runs in this order: **1. Super Admin** Passes every policy, in every company. The company check (`company_policy_middleware`) lets them read and write another company's data. **2. Admin** Passes every policy, inside their own company. A request that names another `company_id` is refused with `403`. **3. Content Manager, Instructor, Student** Pass only when their role holds the matching permission **for their company** in the `permission_role` table. These rows are written when a company is created (`CompanyObserver` → `PermissionRole::assign_permissions_to_roles`), and the Super Admin can change them per company on the **Roles & Permissions** screen. On top of the permission, some checks also let a user act on **their own records**, whatever their role: | Own record | What the owner can do | | :- | :- | | Their user account | View, update, delete, restore | | Their orders (wishlist, cart, orders) | View, update, delete, restore | | Their reviews | View, update, delete, restore | | Their certificates | View, update, delete, restore | Two checks are open to every signed-in user: opening a training's detail page, and listing or generating certificates. There are **120 permissions** in the `permissions` table (ids 1 to 136, with gaps): nine actions for most resources (`*_VIEWANY`, `*_CREATE`, `*_VIEW`, `*_UPDATE`, `*_ARCHIVE`, `*_UNARCHIVE`, `*_DELETE`, `*_RESTORE`, `*_FORCE_DELETE`), plus a few special ones (certificate settings, training export, instructor dashboard, landing page). Roles and permissions themselves are only listed, read, updated, and (for roles) given their permission set: the archive / delete actions exist in the table but no endpoint uses them, so the tables mark them ·. See [Roles](https://theteam-13fc7f49.mintlify.site/api-reference/roles.md) for the endpoints and [Archive, delete & restore](https://theteam-13fc7f49.mintlify.site/api-reference/archive-delete-and-restore-flow.md) for what each action does to a row. *** ## 3. Permissions per role **Legend:** ✅ allowed · — not allowed · · the action doesn't exist for that resource. The Content Manager, Instructor and Student tables show the **default** permissions a new company starts with. A Super Admin may have changed them for a given company. ### 3.1 Super Admin Runs the whole platform: companies, their admins, and the role permissions of every company. | Resource | View list | Create | View one | Update | Archive | Unarchive | Delete | Restore | Force delete | | :- | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | | Companies | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Roles | ✅ | · | ✅ | ✅ | · | · | · | · | · | | Permissions | ✅ | · | ✅ | ✅ | · | · | · | · | · | | Categories | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Tags | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Users | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Trainings | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Coupons | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Quizzes & exams | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Reviews | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Vouchers | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Orders | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Certificates | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Special permission | Granted | | :- | :-: | | Read / edit the certificate settings | ✅ | | Export trainings | ✅ | | Open any instructor's dashboard | ✅ | | Read / edit / delete the landing page | ✅ | **Scope:** every company. Super Admins are left out of the standard user lists. ### 3.2 Admin Runs one company: its users, catalog, sales, discounts, notifications and platform settings. | Resource | View list | Create | View one | Update | Archive | Unarchive | Delete | Restore | Force delete | | :- | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | | Companies | — | — | ✅ | ✅ | — | — | — | — | — | | Roles | ✅ | · | ✅ | ✅ | · | · | · | · | · | | Categories | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Tags | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Users | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Trainings | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Coupons | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Quizzes & exams | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Reviews | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Vouchers | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Orders | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Certificates | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Special permission | Granted | | :- | :-: | | Read / edit the certificate settings | ✅ | | Export trainings | ✅ | | Open any instructor's dashboard (same company) | ✅ | | Read / edit / delete the landing page | ✅ | **Scope:** their own company only. An Admin reads and edits **their own** company; creating, archiving and deleting companies is the Super Admin's job, and the role → permission matrix is edited on the Super Admin's **Roles & Permissions** screen. ### 3.3 Content Manager Builds and organizes the catalog: trainings, quizzes and exams, categories and tags, classrooms. | Resource | View list | Create | View one | Update | Archive | Unarchive | Delete | Restore | Force delete | | :- | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | | Categories | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Tags | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Users | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Trainings | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Coupons | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Quizzes & exams | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Reviews | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Vouchers | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Orders | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Certificates | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Companies, Roles, Permissions | — | — | — | — | — | — | — | — | — | | Special permission | Granted | | :- | :-: | | Read the certificate settings | ✅ | | Edit the certificate settings | ✅ | | Export trainings | — | | Open the instructor dashboard | — | | Read / edit / delete the landing page | — | **Scope:** their own company. No **Restore** or **Force delete** by default: bringing back or permanently removing a deleted row is left to the Admin. ### 3.4 Instructor Teaches: writes trainings, quizzes and exams, runs classrooms and their chatrooms, and follows their own sales. | Resource | View list | Create | View one | Update | Archive | Unarchive | Delete | Restore | Force delete | | :- | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | | Categories | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Tags | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Users | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Trainings | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Coupons | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Quizzes & exams | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Reviews | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Vouchers | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Orders | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Certificates | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | — | — | | Companies, Roles, Permissions | — | — | — | — | — | — | — | — | — | | Special permission | Granted | | :- | :-: | | Read the certificate settings | ✅ | | Edit the certificate settings | — | | Export trainings | — | | Open the instructor dashboard (their own) | ✅ | | Read / edit / delete the landing page | — | **Scope:** their own company. The dashboard and sales pages only show the instructor's **own** figures. The default set is the Content Manager's, minus *Edit the certificate settings*, plus *Open the instructor dashboard*. The Instructor and Content Manager defaults are wider than their screens: the app shows neither role a user, order, coupon or voucher list. When you want a role to match its screens exactly, untick the extra permissions for that company on the Super Admin's **Roles & Permissions** screen. ### 3.5 Student Learns: browses and buys trainings and exams, studies, takes quizzes and exams, and earns certificates. | Resource | View list | Create | View one | Update | Archive | Unarchive | Delete | Restore | Force delete | | :- | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | | Categories | ✅ | — | ✅ | — | — | — | — | — | — | | Tags | ✅ | — | ✅ | — | — | — | — | — | — | | Trainings | ✅ | — | ✅ ¹ | — | — | — | — | — | — | | Quizzes & exams | ✅ | — | ✅ | — | — | — | — | — | — | | Reviews | ✅ | ✅ | ✅ ² | ✅ ² | — | — | ✅ ² | ✅ ² | — | | Orders | — | ✅ | ✅ ² | ✅ ² | — | — | ✅ ² | ✅ ² | — | | Certificates | ✅ ¹ | ✅ ¹ | ✅ ² | ✅ ² | — | — | ✅ ² | ✅ ² | — | | Users | — | — | ✅ ² | ✅ ² | — | — | ✅ ² | ✅ ² | — | | Companies, Roles, Permissions, Coupons, Vouchers | — | — | — | — | — | — | — | — | — | ¹ Open to every signed-in user, not a seeded permission. ² Only their **own** record (see §2). | Special permission | Granted | | :- | :-: | | Read the certificate settings | ✅ | | Edit the certificate settings | — | | Export trainings | — | | Open the instructor dashboard | — | | Read / edit / delete the landing page | — | **Scope:** their own company's catalog. A student **applies** coupons and **redeems** vouchers from the cart; they never see the coupon or voucher lists. *** ## 4. Features by role Some features are not tied to a `permissions` row: the role itself decides, in the controller or through the screens the app gives that role. This matrix is the quick view. | Feature | Student | Instructor | Content Manager | Admin | Super Admin | | :- | :-: | :-: | :-: | :-: | :-: | | Browse the catalog, buy, study, take quizzes & exams | ✅ | — | — | — | — | | Redeem a voucher, apply a coupon | ✅ | — | — | — | — | | Instructor dashboard & sales | — | ✅ own | — | ✅ any instructor | ✅ | | Public instructor profile & background | — | ✅ | — | — | — | | Trainings, quizzes & exams screens | — | ✅ | ✅ | ✅ | — | | Categories & tags ("Classifications") | — | — | ✅ | ✅ | — | | Create and manage classrooms | — | ✅ | ✅ | ✅ | — | | Join a classroom | ✅ | — | — | — | — | | Chatrooms | ✅ member | ✅ moderator | ✅ ³ | ✅ moderator | ✅ any company | | Users screen | — | — | — | ✅ company users | ✅ company admins | | Orders, coupons & vouchers screens | — | — | — | ✅ | — | | Reminders & notifications | — | — | — | ✅ | — | | Platform settings (theme, landing page, certificate, SMTP, storage, security) | — | — | — | ✅ | — | | Dashboards (PDF / CSV), learner analytics, activity history | — | — | — | ✅ | ✅ | | Sign in as a user (impersonate) | — | — | — | ✅ | ✅ | | Companies | — | — | — | — | ✅ | | Roles & Permissions editor | — | — | — | — | ✅ | | Platform export / import | — | — | — | — | ✅ | | My account: profile, password, language, 2FA, notifications | ✅ | ✅ | ✅ | ✅ | ✅ | ³ The chatroom rules let a Content Manager manage the chatrooms of their company, but the Content Manager app has no chatroom screen yet. For the chatroom roles inside one room (`instructor`, `learner`, `admin`), see [Chatrooms](https://theteam-13fc7f49.mintlify.site/api-reference/chatrooms.md). *** ## 5. Keeping this page in sync Update this page when the backend changes one of these: * `app/Models/PermissionRole.php` (the default permission set per role) → the §3 tables * `app/Models/Permission.php` (a permission added or removed) → §2 and §3 * `app/Policies/*` (a role bypass or an ownership rule) → §2 and §3 * a role-only check in a controller or service, or a new screen in a role's app → §1 and §4 See also the [class diagram](https://theteam-13fc7f49.mintlify.site/system-design/class-diagram.md) (`Role`, `Permission`, `PermissionRole`) and [User roles](https://theteam-13fc7f49.mintlify.site/introduction/user-roles-1.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.