Roles and Access
The roles and capabilities a person can hold, how they are granted, and what each one can see and do.
The Model
Every account has a role and, for members, a set of capabilities.
| Role | Meaning |
|---|---|
admin | Impact Hub Houston staff. Sees and manages everything. |
member | Anyone who joined through the intake. What they see is decided by their capabilities. |
dev | The build team. Like an admin, plus developer tools such as the tour preview. |
Capabilities (for members): founder, mentor, investor, volunteer, partner. A member can hold several. The platform calls each capability an audience; a page, a navigation entry or a resource is aimed at one or more audiences.
partner is special in one way: it is also granted automatically to anyone who belongs to a partner organization on the platform, so the Organization page appears for them the moment they are added to one.
Where It Is Stored
Clerk (the sign-in service) is the record. The role and capabilities live in the account's public metadata there and are copied into the platform's users table by the webhook whenever they change. The session token carries them, so every page knows who it is talking to without a database query.
How a Role Is Granted
- At acceptance. Accepting an application grants the capability for the track they applied on. A person who later applies for a second role (from Add a Role on their profile) has it added to the same account.
- By an admin. Settings, Members shows everyone with an account; pick a person, change the role or capabilities, save. The change reaches Clerk first, then the platform.
- By organization membership. Being added to a partner organization adds
partner.
Roles are only ever added by acceptance; removing one is a deliberate admin action on Settings, Members.
What Each Audience Sees
The left rail is built from the audiences a person holds. A founder-mentor sees both sets of entries.
| Entry | Audiences |
|---|---|
| Overview, Calendar, Events, Directory, Partners, Tools and Templates | Everyone |
| Matches | Founder, Mentor |
| Business Profile | Founder |
| Office Hours | Admin, Founder, Mentor |
| Organization | Partner, Admin |
| Manage Resources | Admin, Partner |
| Applications, Matching, Announcements | Admin |
Settings follows the same rule: My Profile, Notifications and Connections for everyone; Business Profile, Team, Business Assessment and Sharing for founders; My Availability for volunteers; the whole Workspace and Content group (Members, Team and Roles, Organization Sharing, Forms, Stage Bands, Member Fields, Company Fields, Tag Lists, Email Templates) for staff.
How Access Is Enforced
Three layers, each one a backstop for the one before.
- The edge. Before a page even renders,
proxy.tsmatches the address against the navigation registries and sends a person without the right audience back to the Overview. Routes that partners may open are the exception: partner membership is not readable at the edge, so those routes are checked in the next layer. - The page. Every page reads the identity on the server and refuses or empties itself when the viewer should not be there.
- The action. Every write (a server action) re-checks the role before touching the database. A screen that hid a button is never the only thing standing between a member and a change.
Previewing as Another Role
An admin can look at the platform as a founder, mentor, volunteer, investor or partner from the Views switcher in the rail. It changes what is shown, never what the admin may do, and it never shows more than the admin already sees. The tour can be previewed per audience from the same place by a developer.