Frozen document. Dates and status refer to its original source. Private resources and unreviewed images are unavailable.
Roles and access
Status: accepted business role boundaries. The owner accepted both rounds of recommendations on September 22, 2026. The role decision holds the authoritative resolution. The accepted workflow contract defines assignment and human-decision behavior. The accepted security contract defines enforcement and manager field categories. Exact field schemas remain downstream.
Agreed boundaries
One person can use one login across personal insurance and employer benefits. A person can be both a customer and an employee, with permissions separated by the context in which they act. A shared login does not make personal insurance records visible to the employer.
The prototype includes experiences for customer/employee, manager, insurer reviewer, employer benefits administrator, content author, and technical operator. These names describe business responsibilities; they do not decide the physical applications, IAM claims, or routing structure.
Dependents and beneficiaries are related records without separate logins in the first prototype. Customers act for themselves; representative transactions for dependents or beneficiaries are deferred.
Managers see their reporting team's leave dates, approval status, and relevant return-to-work information. Managers cannot access medical evidence, EOI documents, insurance claim details, or bank details. The security contract limits manager fields to leave dates, proposed/approved return dates, leave/RTW status, and next-manager-action availability. Exact schema names remain for specs.
Access matrix
| Role or record | Agreed actions and visibility | Downstream details |
|---|
| Customer/employee | Acts for themselves in personal and employer contexts, each with its own permissions. Initial individual fixtures make the customer the policyholder and insured where applicable, or annuity owner. | Record linkage, exact actions and fields for each selected journey. |
| Manager | Acts for their reporting team within their employer; sees leave dates, approval status, and relevant RTW information. No medical evidence, EOI, claim details, or bank details. No delegated or impersonated access. | Exact RTW fields. Deterministic reporting-manager assignment and reminder-only timers are agreed. |
| Insurer reviewer | Handles assigned cases and evidence needed for those cases; no access to cases outside their assignment. | Eligible seeded reviewer assigned per case/product; approve, request information, or decline. Exact evidence fields remain downstream. |
| Employer benefits administrator | Manages their employer's membership and coverage/enrollment information; no medical evidence or banking details. | Exact enrollment actions, field access, and approval flows. |
| Content author | Edits and publishes templates/copy using synthetic previews; no customer-record access. | Publication validation and form-release lifecycle. |
| Technical operator | Sees redacted diagnostics and service status; no business-record editing or insurance decision authority. | Operational recovery mechanisms and log redaction rules. |
| Dependent or beneficiary | Linked record with no independent login or representative transactions in the initial prototype. | Relationship fields captured during selected intake/servicing journeys. |
The downstream details must preserve these boundaries. They do not grant additional permissions by default.
Agreed relationships and demo limits
The owner accepted the following recommendations after agreeing to the initial role set and manager boundary.
- Demonstrate two fictitious employers with isolated employee records. An employer-side role acts only in its assigned employer context. Include a person who has both personal coverage and one employer relationship. The initial fixtures use one active employer per employee; multiple simultaneous employers are deferred.
- Keep policyholder or contract owner, insured person, and signed-in user as distinct concepts. For the first fixtures, the individual customer is also the policyholder and insured where applicable, or the annuity contract owner. Dependents and beneficiaries remain linked records; independent claim submission or other representative actions for them are deferred. Detailed relationship fields belong to the product-rule and data decisions.
- Insurer reviewers handle assigned cases and the evidence required for those cases. Employer benefits administrators handle their employer's membership and coverage/enrollment information, without medical evidence or bank details. Content authors edit and publish templates/copy using synthetic previews, without customer-record access. Technical operators see redacted diagnostics and service status, without business-record editing or insurance decision authority. The security and workflow contracts define recovery boundaries and field categories; later schemas must preserve them.
- Defer manager delegation and impersonation from the initial demo. A manager cannot act for another manager's team simply because that manager is absent. The workflow contract keeps stalled work pending/on hold and defers a reassignment UI or shared claimable inbox. Reminder timers do not introduce delegation.
Scenarios
- A person with personal coverage and employer benefits signs in once. The active context determines the allowed actions; employer roles do not gain access to that person's private insurance details.
- A manager requests a team member's EOI document or bank details. The agreed manager boundary disallows access, even if the manager can approve that person's leave.
- A manager attempts to view another employer's employee or act for an absent manager. Access is denied; employer isolation and the absence of delegation both apply.
- A reviewer accesses evidence from a case outside their assignment. Access is denied; deterministic assignment does not grant a shared inbox or access to other cases.
- An employer benefits administrator requests an employee's medical evidence or bank details. Access is denied, even when that administrator manages the employee's enrollment.
- A content author tries to preview a form with a customer's saved answers. Access is denied; author previews use synthetic inputs.
- A technical operator attempts to change a claim decision. Access is denied; service operations do not grant business decision authority.
Downstream decisions
The role decision establishes business access boundaries. The accepted security contract establishes enforcement, MFA, recovery, and sensitive-data controls. The accepted workflow contract establishes assignment, human decisions, and incident recovery boundaries. No IAM configuration or application implementation is authorized by this document.