Repository navigation
Stakeholders and User Roles
SaludVital shall implement Role-Based Access Control (RBAC) to ensure that each authenticated user can access only the operations and information permitted for their assigned role.
The system shall enforce permissions on the backend. Hiding interface elements shall not be considered sufficient authorization.
SaludVital defines three application roles:
Patient: manages personal information, appointments, notification preferences, and access to their own authorized clinical history.
Doctor: manages assigned consultations and authorized clinical records and accesses only appointments and patient information permitted by an authorized care relationship.
Administrator: manages users, patients, doctors, specialties, schedules, appointments, operational reports, and authorized administrative functions.
| Operation | Patient | Doctor | Administrator |
|---|---|---|---|
| Sign in and sign out | Yes | Yes | Yes |
| Register a public account | Patient only | No | No restriction on administrative creation |
| View and edit own permitted profile | Yes | Yes | Yes |
| Register patient records | Own registration | No | Yes |
| Create doctor accounts | No | No | Yes |
| Create administrator accounts | No | No | Yes |
| View and search users by role | No | No | Yes |
| Edit permitted user information | Own permitted fields | Own permitted fields | Yes |
| Change user roles | No | No | Yes, with confirmation when granting Administrator |
| Activate or deactivate user accounts | No | No | Yes |
| Create and manage specialties | No | No | Yes |
| Assign specialties to doctors | No | No | Yes |
| View appointments | Own appointments | Assigned appointments | All appointments |
| Create appointments | Yes, subject to booking rules | No | Yes, subject to booking rules |
| Cancel or reschedule appointments | Own eligible appointments, at least 24 hours in advance | No direct cancellation or rescheduling | Authorized administrative workflow |
| View calendar | Own appointment information | Own agenda | All doctors' appointments |
| View and manage doctor schedules | No | View own schedule | All doctors' schedules |
| Start and complete consultations | No | Yes, for eligible assigned appointments | No |
| Have a consultation in progress | No | Maximum one at a time | No |
| Create or modify diagnoses | No | Yes, in authorized clinical workflows | No |
| Create or modify prescriptions | No | Yes, in authorized clinical workflows | No |
| View own clinical history | Yes | Not applicable | Not applicable |
| View patient clinical history | Own history only | Only with an authorized care relationship | Read-only, subject to authorized access |
| View diagnoses and prescriptions across patients | No | Only as authorized | Read-only, subject to authorized access |
| Manage notification preferences | Own preferences | As supported for own account | Manage supported system configuration |
| Manage WhatsApp integration | No | No | Yes, within administrative permissions |
| View operational reports | No | Own dashboard metrics | Yes |
| View audit records | No | No | Yes, according to permissions |
The backend shall validate every operation against the authenticated user's role and applicable resource-level permissions.
Patients shall be able to:
Manage their own permitted profile information.
Book appointments according to doctor availability and scheduling rules.
View their own appointments and cancel or reschedule eligible appointments at least 24 hours before the scheduled start.
Reschedule only with the same doctor. To book with another doctor, they must cancel the existing appointment, when eligible, and create a new booking.
Consult their own authorized clinical history, diagnoses, and prescriptions.
Manage supported notification preferences.
Request supported WhatsApp appointment operations after completing the required identity verification.
Patients shall not be able to access another patient's private information, create or modify diagnoses or prescriptions, change their role, or access administrative functions.
Doctors shall be able to:
View their own dashboard, agenda, appointments, and configured schedule.
Start and complete eligible consultations assigned to them.
Record consultation duration and authorized clinical information.
Search for patients and access clinical history only when an assigned appointment or another explicitly authorized care relationship permits it.
View clinical information created by another doctor only when permitted by the authorized care relationship.
Doctors shall not be able to:
View or manage appointments assigned to other doctors.
Cancel or reschedule appointments directly.
Modify their own configured schedules.
Create their own doctor accounts.
Create or modify clinical records outside authorized clinical workflows.
Start another consultation while one is already in progress.
The backend shall enforce the single-active-consultation rule across concurrent requests, browser tabs, and devices.
Administrators shall be able to:
View, search, edit, activate, and deactivate users.
Filter users by role and change user roles.
Create administrator accounts through the User Management section.
Register and manage patients and doctors.
Create and manage specialties and assign them to doctors.
Manage doctor schedules and schedule exceptions.
Create and manage appointments through authorized administrative workflows.
View the system calendar and appointments across all doctors.
Consult diagnoses and prescriptions, including their associated patients and responsible doctors, subject to authorized access.
Access supported WhatsApp administration functions, operational reports, and audit records.
Before granting the Administrator role, the system shall require explicit confirmation.
Role changes, administrator account creation, account deactivation, and other critical administrative operations shall be recorded in the audit log.
Administrators shall not create or modify diagnoses or prescriptions through administrative functions. Their clinical-record access shall be read-only and subject to authorized permissions.
The system shall:
Authenticate users before allowing access to protected operations.
Enforce role-based permissions on the backend.
Verify resource ownership and authorized care relationships before returning patient or clinical information.
Prevent users from changing their own roles or bypassing administrative authorization.
Apply the same business rules to appointment operations performed through the web application and WhatsApp.
Record critical administrative and security operations in the audit log.
Reject unauthorized operations even when a request is submitted directly to a backend endpoint.
Avoid exposing passwords, password-reset tokens, verification codes, or unnecessary clinical information in logs.
Changes to role permissions shall be documented and reviewed before implementation.
The permission matrix shall remain consistent with the Functional Requirements documentation and the approved SaludVital architecture.
Any unresolved permission rule shall be tracked explicitly rather than implemented through an unapproved assumption.