Permissions Model: 57 Permissions

How It Works

The tikento permissions system is based on an additive model: a user's effective permissions are the union of all permissions from their assigned roles. Permissions are only added and never subtracted.

Example: if a user is assigned the Manager and Finance roles, they receive all Manager permissions (events, registrations, check-in) plus all Finance permissions (payments, reports, refunds).

Three Role Contexts

Each role in tikento operates in one of three contexts that determine the scope of its permissions:

Global Context

Platform-level roles. Used for administering the tikento platform itself. Not available to regular organizers.

Tenant Context (Organization)

The primary context for team work. The role operates at the organization level and applies to all its events.

Examples:

• Admin at the organization level -- access to all events and settings
• Finance at the organization level -- viewing finances across all events

Event Context

The role is limited to a specific event. The user can only see the event their role is associated with.

Examples:

• Manager at the event level -- managing only one event
• Support at the event level -- check-in only at a specific event

Atomic Permissions

The system contains 57 atomic permissions, grouped by area:

Events

Registrations

Payments

Forms

Team

Notifications

Reports

Experiments

Billing

The full list of 57 permissions is available in Settings -> Team -> Permissions (for Business and Enterprise plans).

Temporary Roles

You can assign a role with a limited duration. This is useful for:

• Event volunteers -- Support role for the one or two days of the event
• Temporary managers -- Manager role for the event preparation period
• Auditors -- Finance role for the duration of an audit

How to Assign a Temporary Role

1. Go to Settings -> Team.
2. Select the team member.
3. When assigning a role, enable the Time-limited toggle.
4. Specify the end date and time for the role.
5. Click Save.

After the specified time, the role is automatically deactivated. The user loses the corresponding permissions but remains a team member. The temporary role record is preserved in the audit log.

Permission Caching

To ensure fast permission checks, permissions are cached in Redis:

• Cache key: perms:{tenantId}:{userId}:{eventId}
• Cache TTL: 60 seconds
• When a role is changed, the cache is automatically invalidated

In practice, this means that after a role change, new permissions take effect within a maximum of one minute. The user does not need to sign out and back in.

Checking Permissions

The organizer can check what permissions each team member has:

1. Go to Settings -> Team.
2. Click on the member's name.
3. In the Effective permissions section, the full list of permissions is displayed, considering all assigned roles.

Permissions obtained from different roles are marked with corresponding labels.