Roles & access
Choose the right Clineso role for owners, managers, clinicians, receptionists, and finance staff without giving wider access than needed.
Clineso has three workspace families: patient, practice and platform admin. Each role unlocks a different part of those workspaces and a different set of actions. Access is enforced twice — once in the UI (button visibility) and once at the database (Row Level Security policies). A user with a hacked UI still can't perform actions outside their grants.
Roles
| Role | Workspace | Can do | Cannot do |
|---|---|---|---|
| Patient | /patient/* | View own record, upload photos, sign consent, reply to clinician, reorder, track delivery | See other patients, prescribe, edit clinic settings |
| Practice owner / principal | /practice/* | Staff, clinical oversight, operations, fulfilment, billing, settings, DPA | Platform-wide admin outside their practice |
| Clinician | /practice/clinical | Review cases and approve / decline / request more info / issue prescriptions | Platform admin and owner-only staff governance |
| Practice team | /practice/* | Role-specific areas such as front desk, requirements, dispatch, inventory, payments, leads and DPA | Prescribe, approve, decline, modify, cancel prescriptions unless they also have a clinician-capable role |
| Manager | /practice/operations | Operations across patients, requirements, dispatch, inventory, templates, catalogue, payments, settings, leads and DPA | Prescribe, approve, decline, modify, cancel prescriptions — these are clinician-only |
| Platform admin | /admin/* | Tenant onboarding, suspend / anonymise, storage adapter, RLS posture check | Read patient data on tenants they don't own |
Who can see what
Patients see only their own record. Clinicians and managers see the patients in their tenant (their clinic). Platform admins see the list of tenants but never the patient data inside them.
The clinical safety rule
AI prepares the workflow. Clinicians make the decision.
The platform may surface an auto-recommendation (e.g. "approve"
based on triage rules) but it never executes a clinical decision
on its own. The trigger is always pulled by a licensed clinician.
Managers can run every operational surface — but they cannot
prescribe, modify, or cancel a prescription. This is enforced at
the database level and there is a regression check
(audit_prescribing_role_posture()) the platform admin can run
to assert no role drift.
Switching workspaces
A user with multiple roles is rare in practice (most users have one). If you do, the sidebar shows the role you're currently in; sign out and back in to switch.