# Actors and access surfaces

audience: AI agents first.

## Tenant staff

Canonical built-in tenant roles from `2026-05-30-foundation-auth-rbac.md`:

| Role | Scope |
|---|---|
| `OWNER` | Full tenant access, including billing and membership control. |
| `ADMIN` | Broad tenant administration; excludes billing management and user deletion by default. |
| `MEMBER` | Tasks read/write, projects read, time tracking, and knowledge-base read. |
| `VIEWER` | Read-only access where permissions are granted. |
| `CONTRACTOR` | Assigned-task and time-tracking access; not ordinary staff access. |

Permissions, not role-name checks, are authoritative at each route and UI action. Tenants can add custom roles. `ACCOUNTANT` is a scoped financial grant described below, not a replacement for the built-in role matrix.

## External and system actors

| Actor | Authentication | Scope |
|---|---|---|
| `ACCOUNTANT` | Invited tenant membership | Financial reports and statutory exports only; no document editing, user management, or non-financial modules. |
| Customer portal user | Portal invitation/magic-link session | Own customer data: visible invoices, support tickets, linked KB spaces, and portal files. |
| Contractor | Contractor magic-link JWT | Own time entries, assigned projects/tasks, and payout bills. Separate contractor portal. |
| `SUPER_ADMIN` | `admin.zync.is` admin session, with TOTP where configured | System control plane; no implicit tenant membership. |
| Billing/Support admin | System-admin role permissions | System-admin modules granted by the admin control plane. |

## Terminology guardrails

- Say `tenant staff` for users of `app.zync.is`; say `customer portal user` and `contractor` for external users.
- `tenant` is the business workspace, not a person or role.
- Specs also mention `MANAGER`, `STAFF`, and `READ_ONLY` in some UI matrices. Treat them as custom/legacy terminology unless the governing spec explicitly grants them; do not silently substitute them for canonical RBAC roles.