Transparency

Role & Permission Audit

IRES is a role-based system. Every screen and every action is gated by the role you sign in as. This page documents — in plain language — what each of the six roles sees, what they can do, and why. It is public on purpose: nothing about access rights should be a black box.

The six roles

Community Admin

Owner of the community — assigns roles & modules.

Owner of the community: assigns roles, enables/disables modules and can do everything a Chair can. Sits above the committee — one per community by default.

Chair / Board

Sign-offs, oversight, accountability.

Sees everything. Approves expenses, publishes announcements, edits RACI, sees the audit log and legal cases.

Secretary

Communications & coordination hub.

Owns communications: announcements, messages, meetings, votes, requests. No finance access, no legal, no member management.

Treasurer

Money in, money out — at a glance.

Sees all finance modules (treasury, approvals, expenses, collections, ledger, fees) plus announcements, requests and votes. Blocked from legal, members, audit and house rules.

Committee Member

Help steer the community.

Governance helper: votes, requests, meetings. No finance, no legal, no member management.

Flat Owner

Your fees, your votes, your voice.

Personal-scope only: home, cockpit, building overview, IRES AI, own fees, own requests, own votes. Cannot see anyone else's data.

Management Company

Operations, maintenance, execution.

External operator: cockpit and building only. Can submit expenses and manage service contracts on request; cannot vote, approve or see confidential items.

What each role can see

A green check means the module is reachable for that role — via navigation, the "More features" sheet, or a deep link. A cross means the role is blocked from that module byrole-route-access.ts— even a direct URL returns to safety.

Module	Community Admin	Chair / Board	Secretary	Treasurer	Committee Member	Flat Owner	Management Company
Home Overview & key figures.
IRIS Cockpit Today's attention list across the community.
Building Live status of every unit — block, floor, owner, fees.
IRES AI IRES AI — AI companion for board & management.
News Updates from the board.
Requests Requests & tickets from owners.
Votes Polls and resolutions.
Treasury Balance, cashflow, year-end accounts.
Fees Personal and community fees.
Approvals Approval workflow for expenses.
Expenses Submit and track receipts.
Collections Outstanding balances, dunning, escalation.
Ledger All transactions at a glance.
Services Contracts and service providers.
Maintenance Work orders and upkeep.
Utilities Power, water, heating.
Compliance Insurance, licences, obligations.
Organization Who does what on the board.
Members Assign roles & invite members (chair only).
Meetings AGM, EGM, committee — agenda & minutes.
Resolutions Resolution tracker with owner & deadline.
Documents Official documents with chair sign-off.
IRIS Freigaben Review & publish IRIS-generated documents (chair signs off).
Delegations Temporarily hand chair/secretary/treasurer rights to another officer.
Legal cases Claims, damages, legal mandates (confidential).
Audit log Full traceability.
Owners List of all owners.
Messages Direct messages to members.
Contacts Key contacts.
House rules Rules & policies.
Info General info about the community.

What each role can do

Seeing a module is not the same as acting inside it. Write actions are gated separately inrole-permissions.ts. The rationale for each row is spelled out — no hidden rules.

Action	Community Admin	Chair / Board	Secretary	Treasurer	Committee Member	Flat Owner	Management Company	Why
Create request								Anyone in the community can raise an issue — that is the whole point of the ticket system.
Cast a vote								Every member with governance stake votes; only external management is excluded.
Close request								Requires accountability — chair, secretary, committee or management can resolve tickets.
Publish announcement								Official voice of the board — chair, secretary and treasurer only.
Send member message								Direct 1:1/broadcast messaging is restricted to chair and secretary to avoid noise.
Create a vote								Only chair and secretary can put a resolution on the agenda.
Approve expense								Financial sign-off — chair and treasurer only (four-eyes principle).
Submit expense								Operational spend — management, treasurer, committee and chair can file receipts.
Mark fee as paid								Only the treasurer (and chair as backup) touches the fee ledger.
Manage service contracts								Operational — management, treasurer, committee and chair can maintain vendors.
Edit RACI / roles								Only the chair defines who is responsible for what — single source of truth.

How people talk to each other

IRES separates broadcast, direct and tickettraffic on purpose, so the community inbox stays useful.

Announcements (broadcast)

Who:: Chair, Secretary, Treasurer
What:: One-to-many, appears on every member's home feed. Non-interactive.
Why:: Official voice of the board — must not be diluted by every owner posting.

Member messages (direct)

Who:: Everyone has an inbox · sending is matrix-gated
What:: Private DMs. Chair & Secretary can DM anyone; Treasurer, Committee, Management and Flat-owners can only DM the committee (Chair, Secretary, Treasurer, Committee). Each recipient sees only their own copy — enforced at the database with Row-Level Security.
Why:: Personal matters need a private channel with audit trail. Flat-owner ↔ flat-owner spam is deliberately blocked — neighbour issues belong in Requests, community-wide topics in News.

Requests / tickets

Who:: Anyone can open · Chair, Secretary, Committee, Management can close
What:: Two-way threaded conversation attached to a subject, with status.
Why:: Owners always have a way in; accountability is on the people who can actually fix things.

Votes & resolutions

Who:: Chair & Secretary create · everyone except external Management casts
What:: Structured yes/no or multi-option decisions with quorum and audit trail.
Why:: Governance decisions must be recorded formally, not decided in a chat thread.

IRES AI chat

Who:: Every role — but tools are gated by role
What:: Natural-language assistant. Read tools are broad; write tools require the same permission as the manual action.
Why:: AI cannot become a permission bypass. It executes as you, not above you.

Direct messages — who can send to whom

Rows are the sender, columns are the recipient. A green check means that sender may open a private DM with that recipient. Enforced in the database by the public.can_message() function plus Row-Level Security on member_message_recipients — each recipient only ever sees their own copy, even for "send to all" broadcasts.

Sender ↓ / Recipient →	Community Admin	Chair / Board	Secretary	Treasurer	Committee Member	Flat Owner	Management Company	Why
Community Admin								Owner of the community — can DM anyone; assigns roles and modules.
Chair / Board								Board leader — must be able to reach every member privately.
Secretary								Communications hub — needs to DM anyone for coordination.
Treasurer								Financial peer — talks to the committee, not to individual owners (fee questions go through Requests).
Committee Member								Governance peer — coordinates with the board, not with individual owners.
Flat Owner								Owner voice — always reaches the committee; neighbour-to-neighbour DMs are blocked on purpose (use Requests or News).
Management Company								External vendor — only communicates with the committee that hired them.

Inbox is universal. Every role — including flat owners and management — has a Messages inbox from day one. Only sending is matrix-gated.
Private stays private. A "send to all" or "send to role" message expands into one recipient row per person. RLS only returns the row you personally received.
No cross-posting. Announcements live in News, tickets live in Requests, meeting/vote invites live in their own modules. Messages is strictly 1:1 or targeted broadcast — never a duplicate of the news feed.
Unread count is per user. The badge next to the Messages menu counts only your unread recipient rows.

Rollout priority — what gets unlocked when

A brand-new community starts with a short IRIS-guided setup, then modules unlock in waves. This keeps onboarding under two minutes and lets each wave earn trust before the next arrives.

Priority 0 — Iris-guided setup

Before a community even exists in the database, IRIS walks the chair through a short guided chat (~90 seconds). Nothing is persisted until the chair confirms. This is the only gate to Priority 1.

Community name
Number of units
Chair's own apartment (+ floor, optional)
Address & country
Currency & language
Fiscal year start month

Priority 1 — Day one (auto-enabled after Iris setup)

Ships enabled the moment the community is created. Every role — including flat owners and external management — gets an inbox from the very first login.

HomeIRIS CockpitBuilding IRES AI

IRES AIMessages

Priority 2 — Communication first

Unlocked next: the community can talk to itself and raise issues.

NewsRequestsContacts

Priority 3 — Money & governance

Once trust is established, finance and formal decisions come online.

FeesTreasuryApprovalsExpensesCollectionsLedgerVotesMeetingsResolutions

Priority 4 — Operations & compliance

Deeper operational modules — enabled per community on demand.

ServicesMaintenanceUtilitiesComplianceDocumentsLegal casesAudit logOrganizationMembersHouse rulesInfoOwners

Guiding principles

Least privilege. A role sees only what it needs to do its job. Flat owners never land on the treasury ledger.
Four-eyes on money. Approving an expense and paying it are held by different roles wherever possible.
Names stay private. Only chair, treasurer and secretary see full names. Everyone else sees initials or "Firstname L." — enforced by use-name-visibility.
Deep links respect roles. Blocking a module hides it from nav and the router — no back doors.
AI is not a super-user. The assistant inherits your role; it can never do something you cannot.
Everything is auditable. Chair role sees a full audit log of who did what and when.