CivitasVote Role and Permission Matrix

1. Principle of least authority

A CivitasVote user account does not grant operational authority by itself. Authority is obtained through one of three separate mechanisms:

1. technical superuser status;
2. a current Platform Administrator appointment;
3. a current association membership or election-cycle appointment.

A person may hold more than one lawful role, but the system evaluates the role relevant to the requested page and election. Voter eligibility is separate from all administrative roles.

2. Account, officer and voter are different concepts

An election officer does not need to be a voter. An officer who is otherwise eligible is not automatically prevented from voting. Appointment, eligibility and ballot participation must not be inferred from one another.

3. Platform-level roles

Technical superuser

Main capabilities:

• perform technical recovery;
• access Django administration where enabled;
• appoint and revoke Platform Administrators;
• inspect technical, security, audit and deployment System Documentation material;
• bypass some application role checks for recovery and testing.

Boundaries:

• should not be used for routine election operations;
• must not be shared;
• should not be assigned merely to make an ordinary user’s page accessible;
• does not replace documented association and election appointments.

Platform Administrator

Main capabilities:

• create and update associations;
• create, update, activate, deactivate and reset ordinary authorised user accounts;
• perform controlled CSV/XLSX authorised-user imports;
• appoint association Owners and Administrators;
• inspect the election-officer register and platform-level operational information.

Boundaries:

• platform authority alone does not authorise opening, closing, tallying or approving a poll;
• the appointee must be an active ordinary application user, not a Django staff account or technical superuser;
• appointment start, end, active and revocation state are enforced.

4. Association-governance roles

Organisation Owner

Main capabilities:

• exercise senior governance authority for one association;
• create election cycles for that association;
• appoint and manage election officers where the view permits governance roles;
• inspect association records and System Documentation material;
• act as the appointing authority for officer complaints when no valid Appeals reviewer is available or where the complaint is assigned to the appointing authority.

Organisation Administrator

Main capabilities largely mirror the governance functions exposed to the Owner, subject to the relevant decorator and page.

Boundaries for both roles:

• association governance does not automatically authorise operational election decisions;
• they do not gain voter eligibility by appointment;
• they should not determine complaints against themselves;
• membership applies only to the assigned association.

Other organisation model roles

The OrganisationMembership model also defines Election Manager, Voter Data Officer, Auditor and Read-only Viewer. The current association-administrator assignment form offers only Owner and Administrator. Treat the additional model choices as internal or future capabilities unless a specific current view explicitly recognises them.

5. Election Committee roles

Core mandatory roles

An election cannot pass the appointment readiness checks until three distinct active people hold these roles:

1. Electoral Commissioner / Chairperson
2. Election Secretary
3. ICT and Data Protection Commissioner

Each appointment must satisfy the current date, active-account, active-appointment and appointment-letter requirements.

Optional roles

The system permits but does not universally require:

• Deputy Commissioner;
• Gender and Inclusion Commissioner;
• Appeals Panel Chairperson;
• Appeals Panel Member;
• Committee Member;
• Returning Officer;
• Voter Registration Officer;
• Polling or Verification Officer;
• Observer;
• Election Auditor.

Governance rules may require additional roles for a particular association even though the software’s minimum is three.

6. Operational election roles

Electoral Commissioner / Chairperson

Typical capabilities:

• access the election operational dashboard;
• configure election content where the configuration period is open;
• manage nominations and candidate records according to mode;
• open and close voting;
• initiate tally, recount and runoff actions;
• approve results where the role is included among authorised approvers;
• generate or manage result declarations;
• review election objections where authorised.

Critical boundaries:

• actions are limited to the appointed election cycle;
• configuration freezes after voting opens;
• the Commissioner cannot replace governance authority for appointments;
• result publication remains subject to independent approval requirements.

Deputy Commissioner

Optional support role. May be included in configuration, nomination management, result approval and objection review according to the view’s role list. The Deputy does not replace the mandatory Commissioner appointment unless the code and governing rules expressly provide acting authority.

Election Secretary

Core role. Typical capabilities include operational configuration, nomination administration, record keeping, result approval, objection review and declaration management. The Secretary should preserve decision references and minutes outside free-form fields where formal records are required.

ICT and Data Protection Commissioner

Core role. Typical capabilities include nomination operations and technical/data-protection oversight. The role should supervise protected files, voter-data handling, credentials, incident escalation, audit verification and privacy controls. It must not be used to access ballot selections linked to voters because no such routine linkage should exist.

Gender and Inclusion Commissioner

Optional role supporting inclusive access, accommodations and nomination administration. Assistance must preserve secrecy and must not become proxy voting.

Committee Member

Optional general operational member. Access is limited to views that include this role; the title does not confer Commissioner-only controls.

Returning Officer

Optional operational role associated with poll administration, results, declarations, objections and signatures. Some pages include the Returning Officer among configuration or result roles.

Voter Registration Officer

Optional role focused on the voter directory and election register. May review eligibility and objections where permitted. Register changes after certification invalidate certification and require recertification.

Polling or Verification Officer

Optional role supporting verification and polling operations. The officer may not ask a voter to disclose selections and must not reuse credentials.

Observer

Read-oriented role where recognised. Observation does not authorise configuration, voter-data modification, tally generation or result approval.

Election Auditor

Independent assurance role. Typical access includes result approval where configured, evidence inspection and audit review. Audit participation should not be confused with technical superuser access.

7. Appeals roles and complaint fallback

Appeals Panel Chairperson and Member

Optional roles for independent review of disputes assigned to the Appeals Panel. A person should not simultaneously serve in a Commission role and an Appeals role for the same cycle. The appointment validation enforces the project’s separation rules.

Where no current Appeals reviewer exists, officer-complaint routing may fall back to the association appointing authority. This prevents a complaint from becoming unreviewable merely because an optional Appeals Panel was not appointed.

8. Public roles

Voter

A voter does not require an authorised staff account. Access is based on the election’s verification methods and an active eligible register record. The voter may:

• view a public election page;
• authenticate through an enabled verification route;
• submit one ballot;
• save and verify an anonymous receipt;
• submit a public objection or officer complaint where the election status permits.

Self-nominee

In Self or Mixed mode, an eligible voter may submit a nomination during the nomination window using the certified register identifier and personal PIN. Submission does not make the person a candidate until the Commission approves it and a linked candidate record is created.

Public complainant

May submit an election objection or officer complaint without staff login. The public reference must be retained for follow-up. Public access does not expose protected evidence or internal deliberations.

9. Lifecycle of election appointments

An appointment may be:

• future: valid record, not yet operational;
• current: active, within dates, user active and otherwise valid;
• read-only grace: operational period ended but limited historical inspection remains available for seven days where the permission decorator permits it;
• expired: no operational or grace access;
• revoked: inactive immediately, with revocation reason and actor recorded.

The read-only grace period never authorises new nominations, configuration changes, candidate deletion, voting control or result decisions.

10. Page-level permission summary

This table is a guide. The Django decorators and service-layer checks are the final implementation authority.

11. Separation-of-duty rules

At minimum, organisations should enforce:

• three distinct people in the core Committee roles;
• no self-appointment by the Commissioner;
• no Commission/Appeals overlap in the same cycle;
• no accused officer deciding their own complaint;
• at least two independent result approvals;
• no use of the technical superuser as the routine poll operator;
• no sharing of accounts, passwords, PINs, codes or passkeys;
• no manual database alteration during a binding election.

12. Troubleshooting access

When a user receives “You do not hold a current appointment or governance role”:

1. confirm the user account is active;
2. confirm the correct association or election was opened;
3. confirm a membership or appointment exists;
4. confirm the appointment role is authorised for that page;
5. confirm the start and end dates;
6. confirm the appointment has not been revoked;
7. confirm the request is not attempting a write action during read-only grace;
8. do not solve the problem by granting superuser status.