🏠 Overview › 👥 User Roles ›📖 Organization Administrator Manages User Role Assig...

Organization Administrator Manages User Role Assignments Within Their Organization

The Organization Administrator has elevated permissions to manage user roles within their organizational scope. Through the admin interface, the org admin can assign the peer mentor, coordinator, or organization administrator roles to users, modify existing role assignments, and revoke access when users leave the organization or change roles. All role assignments are stored in the User Role Repository and validated through the Role Authorization Service. The org admin's actions are scoped to their own organization — they cannot assign roles in other organizations or grant global admin access.

HIGH story-role-based-access-control-organization-administrator-007 8 pts
8
Story Points
High
Priority
Role-Based Access Control
Feature

User Story

As a Organization Administrator
I want to assign, modify, and revoke roles for users within my organization
So that So that I can control who has access to which features and maintain accurate access control as staff and volunteer roles change over time, without depending on platform-level support

Acceptance Criteria

  • Given a user authenticated as an Organization Administrator, when they navigate to user management, then they see all users within their organization with their current role assignments
  • Given an Organization Administrator assigns a role to a user, when the assignment is saved, then the User Role Repository is updated and the affected user's next session reflects the new role
  • Given an Organization Administrator assigns a role, when the change is persisted, then the affected user's cached role data is invalidated so stale permissions are not used
  • Given an Organization Administrator attempts to assign a global admin role, when they submit the assignment, then the system rejects the action with an appropriate error message
  • Given an Organization Administrator revokes a user's role, when the revocation is saved, then the user's next session no longer has access to the revoked role's features
  • Given an Organization Administrator is scoped to Organization A, when they access user management, then they cannot view or modify users from Organization B

Business Value

Organizations need to manage volunteer and staff role changes independently without requiring platform-level support intervention. An organization administrator's ability to self-manage role assignments reduces onboarding time for new coordinators and peer mentors, and ensures that departing volunteers have their access revoked promptly in accordance with GDPR data minimization requirements. This is especially important for NHF with 1,400 local associations whose membership rosters change frequently.

Components

Role-Based Access Control
Related Feature
Organization Administrator
User Role