The shape of it
A person holds roles in a club. Each role carries a fixed set of capabilities. Your capabilities are the union of every role you hold, on today's date.
Capabilities draw doors. They never open one. The menu you see is built from what you hold — but the server re-checks every single request from scratch and does not care what your browser decided to render. Guessing a web address you have no capability for gets you nothing.
Role grants are dated. A grant starts on a day and can end on a day, so "Sam coached last season" stays true in the record without Sam still holding the keys. Grants are audited, and you cannot grant yourself one.
The roles
| Role | Holds |
|---|---|
owner | Everything in the club, including medical records and Safe Sport |
club_admin | Everything except medical records and Safe Sport |
membership_admin | Members, roster, medical summaries |
registrar | Members, roster |
treasurer | Billing, roster |
board_member | Roster, audit log |
front_desk | The gate, roster, medical summaries |
head_coach | Schedule, programs, broadcasts, roster, medical summaries |
coach | Schedule, roster, medical summaries |
assistant_coach, instructor | Roster, medical summaries |
lifeguard | Medical summaries |
lessons_admin, meet_director | Programs, schedule, roster |
facility_manager | Schedule |
safe_sport_lead | Safe Sport, full medical, safeguarding notes and their audit |
snack_bar, official, adult_athlete | No staff capabilities |
Three deliberate sharp edges
manage_waivers is narrow. Only owner and club_admin hold it — not the
registrar, who is the obvious guess. Chasing an unsigned waiver and rewriting the
release everyone already signed are not the same authority, and publishing a
version marked a material change invalidates every signature in the club.
Safeguarding notes belong to the Safe Sport lead alone. Not the owner, not the board. A safeguarding note is a sentence typed about a named child, and in a club where the treasurer is also a parent, a wider capability is neighbours reading about neighbours' children. The front desk's real need at 5:45am is answered by a structured contact restriction, not by somebody's prose.
Reading a medical record writes an audit row. Every time. A deck coach sees a
short summary; the full record needs read_medical and leaves a trace.
Families
Family access is not a role. It comes from belonging to a household: you see your own family and nobody else's. A caregiver — a nanny, a grandparent on the list — can collect a child and can be checked in at the gate, but cannot sign a waiver or message a coach. That line is a safeguarding decision, not a missing feature.
Platform operators
SwimWin staff have a separate platform flag that is never a club role and never grants a club capability. It opens the Admin area — a cross-club surface with its own navigation, reachable only by SwimWin staff — and it grants nothing inside your club: no roster access, no medical records, no audit trail of yours. What it can read across clubs is a narrow, read-only projection, and every read of it is recorded. See Who can see a swimmer's details.