Security
Access Control Matrix
Role-based permissions for membership and safeguarding data
Member
Self-service access to own records and bookings
Coach/Facilitator
View attendees and shared support needs for sessions
Admin
Manage memberships, events, bookings, and payments
Safeguarding Officer
Highest access for safeguarding and sensitive data
| Dataset | Member | Coach | Admin | Safeguarding Officer |
|---|---|---|---|---|
Membership Admin Data Name, DOB, contact, address, emergency contact | Read Update Own record only | Limited Read Name + emergency contact for event attendees only | Full CRUD All members. Cannot set safeguarding_flag | Full CRUD All members. Can set safeguarding_flag |
Booking Info / Attendance Event bookings, check-ins, attendance history | Create Read Cancel Own bookings only | Read Check-in Assigned events only. Can mark attendance | Full CRUD All bookings. Manage waitlists, refunds | Read View all for safeguarding context |
Support Needs / Adjustments Reasonable adjustments, communication preferences | Full CRUD Own record only. Control sharing with coaches | Conditional Read Only if member has set share_with_coaches=TRUE | Metadata Only Can see category, dates. Cannot read adjustment text | Full CRUD Full access including safeguarding_notes field. All access logged |
Safeguarding Notes Risk assessments, incident records, safeguarding concerns | ❌ DENIED No access. Not informed of existence | ❌ DENIED No access. Not informed of existence | ❌ DENIED No access unless granted Break Glass emergency access | Full CRUD Exclusive access. All views/edits logged with IP + timestamp |
Equality Monitoring (Individual-level) Gender, ethnicity, disability, sexual orientation, religion | Create Update Own record only (optional submission) | ❌ DENIED No individual-level access | ❌ DENIED Cannot view individual records. Cannot join to members table | Export Only Can export for DSAR. Access logged. Cannot view in UI |
Equality Monitoring (Aggregated Dashboards) Count by gender, ethnicity, disability - no names/IDs | ❌ DENIED | ❌ DENIED | Read Aggregate reports only (COUNT, GROUP BY). No WHERE filters on member_id | Read Same as Admin - aggregate only |
Payments & Financial Records Membership fees, event payments, refunds | Read Own payment history only | ❌ DENIED | Full CRUD Process payments, refunds, invoicing | Read View for context if needed |
Audit Log System access logs, change history | Read Own actions only | Read Own actions only | Read Own actions only. Cannot view others' activities | Full Read View all audit logs. Immutable records |
Emergency Access to Safeguarding Notes
In genuine emergencies where immediate access to safeguarding information is critical (e.g., imminent risk to member safety), Admin users may request emergency access.
Procedure:
- Request Access: Admin user clicks "Request Emergency Access" in system
- Mandatory Justification: Must provide detailed reason (min 50 chars)
- Nature of emergency
- Why access is needed immediately
- What information is being sought
- Instant Alert: Safeguarding Officer receives immediate notification (email + SMS)
- Time-Limited Access: Access granted for 2 hours only
- Full Audit: All actions logged with:
- Requesting user ID + IP address
- Timestamp + reason provided
- Records accessed
- Fields viewed
- Duration of access
- Post-Access Review: Safeguarding Officer reviews justification within 24 hours
- Escalation: Inappropriate use triggers disciplinary procedures
Legitimate Use Cases:
- Member discloses immediate self-harm risk at session
- Safeguarding Officer unreachable + urgent risk identified
- Police/emergency services request information in active incident
- Medical emergency where safeguarding context affects treatment decisions
Prohibited Use:
- Curiosity or routine inquiries
- Membership disputes or complaints
- Non-urgent administrative tasks
- Any access where Safeguarding Officer could be contacted within reasonable timeframe
Database-Level Controls
- Row-Level Security (RLS) policies enforce role-based access
- equality_monitoring.member_id not indexed (prevents easy joins)
- support_needs and safeguarding_notes text fields excluded from search indexes
- safeguarding_notes table invisible to non-Safeguarding Officer queries
Application-Level Controls
- API endpoints validate user role before query execution
- Coach access to support_needs requires both role check AND share_with_coaches=TRUE
- Equality monitoring dashboards use aggregate queries only (COUNT, GROUP BY)
- Safeguarding notes UI component only renders for Safeguarding Officer role
Audit Logging (Mandatory)
- ALL access to safeguarding_notes (including Break Glass)
- ALL access to support_needs.safeguarding_notes field
- Equality monitoring exports
- Admin updates to member safeguarding_flag
Regular Reviews
- Quarterly audit of Safeguarding Officer access logs
- Annual review of support_needs sharing preferences with members
- Immediate review of any Break Glass access within 24 hours
- Annual role assignment audit