Role Permissions Panel & Settings Tier Gating

Revenue Engine AI applies a three-tier access model to the Settings panel itself — separate from the dashboard data visibility RBAC. This means an admin can control not just what data each role sees, but also what configuration options they can view or change. The Role Permissions Panel is the admin UI that maps SuiteCRM ACL roles to these access tiers.

The Three Settings Access Tiers

Every user who opens the Settings panel is assigned one of three tiers based on their SuiteCRM role. The tier controls which accordion sections are interactive and which are locked.

Tier	Assigned to	Settings access
Admin	SuiteCRM system administrators	Full access — can read and write all 10 Settings sections including License, Role Permissions, RBAC configuration, and AI keys
Manager	ACL roles mapped to Manager tier	Read-only on sensitive sections (License, Role Permissions, RBAC) — can view but not save. Full access to non-sensitive sections such as View Preferences and Dashboard Modules
Basic	All other roles (default for reps)	View Preferences only — can toggle Demo Mode and Dark Mode for their session. All other sections are hidden or locked

The settings tier is injected server-side via the PHP data bridge as window.__REAI_USER.settings_tier. It cannot be overridden from the browser — the value is derived from the user’s active SuiteCRM session and ACL roles at page load time.

TieredAccordion: Lock States

Each of the 10 Settings sections is wrapped in a TieredAccordion component that enforces the current user’s tier visually and functionally:

Open + Editable: The section is within the user’s tier. All inputs are active. Save button is visible.
Open + Read-Only: A Manager-tier user can expand the section to view current values, but all inputs are disabled and the Save button is hidden. A lock icon appears in the section header.
Hidden: The section is above the user’s tier entirely. The accordion row does not appear in the Settings panel for that user.

This design ensures that sensitive configuration — such as the Revenue Target, License Key, and Role Permissions — is never accidentally changed by a manager-tier user, while still being visible for reference during team reviews or audits.

Role Permissions Panel

The Role Permissions Panel is a Settings section visible only to Admin-tier users. It provides a UI to map SuiteCRM ACL role names to the three settings tiers — replacing the need to edit configuration files manually.

How to access it

Log in as a SuiteCRM system administrator.
Open Revenue Engine AI and navigate to Settings (top-right icon).
Scroll to the Role Permissions accordion section.
Expand it to see the current role-to-tier mapping table.

Setting a role’s tier

Find the ACL role you want to configure in the mapping table. Role names match exactly what is defined in SuiteCRM’s ACL Roles module (Admin → ACL Roles).
Use the dropdown selector to set its tier: Admin, Manager, or Basic.
Click Save Changes. The mapping is stored server-side in SuiteCRM’s config table immediately.
Users with that role will receive the updated tier on their next dashboard page load — no logout or cache clear required.

Security note: Save requests to the Role Permissions endpoint return HTTP 403 for any user who is not a SuiteCRM system administrator (is_admin = 1). The tier cannot be elevated by a manager-tier user editing their own role mapping.

Roles not in the mapping table

ACL roles that are not explicitly mapped in the Role Permissions Panel default to the Basic tier. To give a newly created SuiteCRM role settings access above Basic, you must add it to the mapping table explicitly.

How Tier Assignment Works (Technical)

When a user opens the Revenue Engine AI dashboard, the PHP data bridge performs the following sequence:

Reads the current SuiteCRM user’s ACL roles from the session.
Looks up each role name in the stored Role Permissions mapping.
Assigns the highest tier found across all of the user’s roles (a user with both “Sales Rep” [Basic] and “Team Lead” [Manager] roles receives the Manager tier).
Injects the result as window.__REAI_USER.settings_tier before the React app initialises.

The React Settings panel reads settings_tier at mount time and configures the TieredAccordion lock states accordingly. No subsequent API calls are made to re-check the tier during the session.

Relationship to Dashboard Data RBAC

Settings tier gating is independent of the dashboard data visibility RBAC. They operate in parallel:

Control	What it governs	Configured in
Settings Tier	Which Settings sections a user can view or edit	Role Permissions Panel (in Settings)
Data Visibility RBAC	Which dashboard data (reps, deals, teams) a user can see	SuiteCRM Security Groups + Team Mapping setting

A user can be a Manager-tier for Settings (read-only on sensitive sections) while simultaneously having Admin-level data visibility (seeing all rep data). These are separate controls and should be configured independently based on your organisational policy.

Revenue Engine AI v1.7.2 · Built by Zybroz · support@zybroz.com