Build explicit roles
Authorized administrators create role groups and attach the HourOps scopes required for a responsibility.
HourOps use case
Give people the operational access they need within their workspace.
HourOps permissions are built from scopes grouped into roles. Organizations can distinguish employee actions, manager responsibilities, organization administration and HourOps system administration.
Create roles from granular scopes
Keep data isolated by account
Limit reporting by responsibility
Reserve billing-owner actions
Inside HourOps
How HourOps supports this workflow
Apply account-aware authorization
Protected backend routes establish active account context and validate scopes. Database row-level security adds a tenant boundary.
Keep ownership separate
Primary billing ownership is distinct from ordinary admin access. Delegation uses a protected OTP-based process.
Respect project responsibility
Project views and reports combine account membership, scopes, assignments and project creation responsibility.
A practical HourOps path
1
Define
Choose the scopes for the role.
2
Assign
Attach roles to users.
3
Validate
Check active account and scope on actions.
4
Audit
Preserve relevant operational history.