Roles & permissions

Every action in MaxTrax is governed by two things: the roles a user holds and the entity scope their account is restricted to. This page is the authoritative reference for both — the exact role names, what each role can do, the minimum role each action requires, and the scope dimensions that narrow which records a user sees.

Roles are enforced on the server, which is the sole authority. The app hides actions a user’s roles don’t cover, but that hiding is a convenience only: a direct or out-of-date request to perform a blocked action is rejected with a 403 “Access required” response. A user may hold more than one role; the most authoritative one applies.

The seven roles

MaxTrax has exactly seven roles. They form an inclusive hierarchy, listed below from greatest authority to least. Holding a role grants everything that role can do plus everything every lower-authority role can do — so, for example, a Project Administrator can also do everything a Weld Associate, an NDE Inspector, and a Reader can do.

The exact name is what the API, exports, and the audit trail carry; the app’s screens display the friendlier label in the second column.

Role (exact name)	Shown in the app as	What the role can do
SystemAdministrator	System Administrator	Full system-wide access. Reserved for CSDS operator use; not normally assigned to a project user. Never locked out.
CorporateAdministrator	Corporate Administrator	Manages all server and application settings, users, and roles across every project. Implies access to all projects, all weld types, and all approval groups.
ProjectAdministrator	Project Administrator	Manages all activities and settings for the projects the user is authorized on.
ProjectAssociate	Project Associate	Manages most activities and settings for authorized projects and contractors (coordination roles — engineering, document control).
Editor	Weld Associate	Manages welds — create, classify, complete, repair, move, and update welds, ISOs, and test packages — for authorized projects and contractors.
NdeAssociate	NDE Inspector	Enters inspection and NDT results (record dispositions, film-interval results) for authorized projects and contractors.
Reader	—	Read-only access to authorized projects and contractors. No changes.

Note

The role hierarchy is an inclusive cascade. A higher role satisfies every lower requirement, but the reverse is never true — a bare NdeAssociate can record inspections but cannot manage welds (that needs Editor), and an Editor can manage welds but is not an administrator (that needs CorporateAdministrator).

Capability matrix

Each action below names the minimum role required. Any role above it in the hierarchy can also perform the action.

Action	Minimum role	Notes
View welds, ISOs, inspections, test packages, and grids	Reader	Results are limited to the user’s authorized projects (see Entity scope).
Generate and export reports	Reader	Reports and exports are not role-floored; any authorized user may run them.
Schedule reports (create/edit/enable schedules, delivery history)	ProjectAdministrator	Recurring email delivery — see Scheduled reports.
Manage welds and ISOs (create, update, delete, classify, complete, repair, move)	Editor	Blocked on a signed ISO or signed test package.
Sign ISOs and test packages	Editor	Uses the same floor as weld management — not a separate, higher signing privilege.
Manage test packages (create, update, delete, assign ISOs)	Editor	Project-scoped.
Import weld data from Excel	Editor	Import bulk-creates welds and inspections, so it requires the weld-management floor.
Record inspection and NDT results (dispositions, film-interval results, welder failures)	NdeAssociate	An Editor also clears this floor via the hierarchy.
Close a welder qualification lot	ProjectAdministrator	Higher floor than routine weld work.
Administer users, roles, project and global settings, custom fields, and the audit log	CorporateAdministrator	The full administrative surface.

Note

The same role floors apply no matter how an action reaches the server — through the app, through the offline sync of field work, or through the Excel import pipeline. There is one rule set, enforced in all three places.

Reads behave differently from writes when access is missing. A user who lacks the scope for a record simply doesn’t see it (the result set is narrowed, never an error), whereas a user who lacks the role for a write receives an explicit 403.

Entity scope restrictions

A role answers what kind of action a user may perform. Entity scope answers which records they may perform it on. A user must clear both — the role floor and the applicable scope — for an action to succeed.

Project scope is the primary restriction and is applied throughout MaxTrax. Each user is set to either All projects or a specific list of projects, on the admin Users screen. A user scoped to specific projects sees and acts on only those projects’ ISOs, welds, inspections, and related data.

MaxTrax’s access model recognizes additional scope dimensions carried on each user. Where a user is restricted on one of these, they see and act on only the matching records:

Scope axis	Limits the user to
Project	The projects — and all their ISOs, welds, inspections, and test packages — the user may see and act on. Set as All projects or a specific list.
Contractor	The construction contractor(s) whose work the user may see and act on.
NDE contractor	The NDE / inspection contractor(s) whose records the user may see and act on.
Inspection type	The inspection / NDT type(s) the user may work with.
Weld type	The weld type(s) the user may work with.
Approval group	The approval / sign-off group(s) the user belongs to. This axis is always a specific list — there is no “all” option.

For every axis except approval group, a user is granted either all values or a specific list. A CorporateAdministrator implies all projects, all weld types, and all approval groups.

Related

• Roles & capabilities — the admin-facing guide to choosing roles.
• Manage users & roles — assign roles and project scope to a user.
• Getting started — roles and domain vocabulary.
• Reference overview