Koinonia OS uses Role-Based Access Control (RBAC) to ensure that every member, servant, priest, treasurer, and administrator has appropriate access while protecting sensitive parishioner data.
1. Summary of User Roles
| Role Name | Target Users | Key Capabilities |
|---|---|---|
| Parish Member | All registered church members | Manage personal profile, view public events, register for forms, view giving receipts, QR check-in badge. |
| Servant / Group Leader | Sunday school teachers, fellowship leaders | Record attendance, view class rosters, send group announcements, manage small group events. |
| Ministry Leader | Department heads (Worship, Youth, Facilities) | Manage ministry rosters, assign volunteer shifts, submit ministry expense requests, build custom forms. |
| Priest / Clergy | Ordained clergy & pastoral team | Access 360° parishioner profiles, record Sacraments, manage confidential pastoral visitations and absence cases. |
| Treasurer / Finance Officer | Finance committee & bookkeepers | Process donations, generate contribution statements, manage annual budgets, approve expenses, audit bank entries. |
| Parish Administrator | Church office managers & IT admins | Full access to all church data, manage user roles, configure settings, manage parish join codes, export analytics. |
2. Field-Level Security & Privacy Protection
To safeguard sensitive parishioner records, Koinonia OS enforces strict database trigger protections:
-
Self-Service Restrictions: Members can update their personal phone, email, and address, but cannot modify administrative fields such as
organization_id,linked_user_id,membership_status, orenvelope_number. -
Confidential Pastoral Notes: Pastoral visitation notes and absence case files are strictly restricted to assigned servants, priests, and church admins. General members cannot view pastoral care records.
-
Financial Confidentiality: Uploaded expense receipts, bank statement lines, and individual donor records are strictly restricted to authorized Finance Officers and Priests.