Users & roles

Redline uses role-based access control. Each user belongs to one tenant (workspace) and has one role that determines what they can see and do.

Roles

Role	Can do	Typical user
Coordinator	Full access — create/edit ECRs and ECs, manage ECOs, configure settings, invite users	EC Coordinator, Engineering Manager
Department user	View assigned tasks, update action item status, view ECOs (read-only)	Procurement Manager, Production Lead
Viewer	Read-only access to all data, no editing or status updates	Operations Director, Quality Auditor

CCB member flag

Any user can additionally be flagged as a CCB member. This is not a separate role — it is a permission that gives the user visibility of ECRs in CCB Review status. CCB members see these ECRs in their dashboard and can participate in the decision process.

Inviting users

Coordinators can invite new users from Settings → Users:

1

Click Invite user

Enter the user’s email address, first name, last name, and username.

2

Assign a role

Select coordinator, department user, or viewer. Optionally set the department and job title.

3

Send invitation

The user receives an email with a signup link. They set their password on first login.

Managing users

From the Users page, coordinators can:

• Change role — promote or demote a user’s access level
• Set CCB member flag — enable or disable CCB visibility
• Edit profile — update name, job title, or department
• Reset password — send a password reset email
• Remove user — delete a user from the workspace

Workspace isolation

Every user belongs to exactly one tenant. Data is isolated at three levels:

1. JWT layer — the authentication token contains the tenant ID
2. API layer — every database query filters by the user’s tenant
3. Database layer — Row Level Security (RLS) enforces isolation at the database level

Users cannot see or access data from other tenants, even if they know the IDs.