Every serious app, at some point, has to answer: who can see what, who can change what, and what happens when an admin is also a user of their own product? In code, this is one of the gnarliest things you write. In Tadabase, it is a checkbox tree and a couple of filter rules — but only if you model it the right way the first time.
The three layers of access
- Role-level — which pages can this role see at all? Easy. Live in role settings.
- Component-level — which records does this query return for this role? This is where most bugs live.
- Field-level — which fields on a visible record can this role read or write? Often forgotten and important for audit.
Tadabase has all three. The trick is knowing which lever to pull for which problem.
Model your roles before you build a single page
A clean role list is a list of "kinds of user who see different data." Not job titles. Not seniority. Different data shape = different role. Two managers who see the same data are one role, not two.
- Customer — sees only their own records.
- Staff — sees everything in their department.
- Admin — sees everything.
That is usually enough. Resist the urge to add a fourth role until the rules genuinely diverge.
Row-level rules: the workhorse
In every Tadabase component, you can add filters that reference the logged-in user. "Show records where Customer is logged-in user" is the entire ballgame for portals. For staff, you scope by department; for admins, you leave the filter open.
Field-level rules: when to bother
Field-level controls matter the moment two roles see the same record but with different views — staff sees the cost field, customer does not. Tadabase lets you hide or set read-only on a per-role basis at the component level. Use it for billing fields, internal notes, status overrides.
Auditability is part of access control
Who changed what, when. The cheapest way to add audit: a workflow on every important table that logs the user, the change, and the timestamp to an Audit Log table. Five minutes to set up, saves you on the first compliance review.