Access is always scoped state → district → taluka → FPS. A District Supply Officer sees only their district; a dealer sees only their shop; a vendor sees only their assigned, district-segregated batches. The citizen is unauthenticated, rate-limited, and scoped to the single record behind the scanned QR.
Permission matrix
Server-enforced · the UI only ever requests what the role is granted
| Module / Role | Dept | Dist | Taluka | FPS | Vendor | QC | Auditor | Griev | Citizen |
|---|---|---|---|---|---|---|---|---|---|
| Beneficiary data | CRUD | RU | R | R | — | R | — | R | — |
| eKYC verification | A | R | R | — | — | — | R | — | — |
| Card lifecycle | CRUDA | RU | RU | C | R | — | R | — | C |
| QR / print job | RUA | R | — | — | CRUD | RU | R | — | — |
| AePDS txn sync | R | R | R | C | — | — | R | — | — |
| Dispatch / logistics | RU | RU | RU | R | CRU | R | R | — | R |
| MIS dashboards | CRUD | RU | RU | R | RU | R | R | RU | — |
| Grievance mgmt | RUA | RU | RU | C | — | — | R | CRUD | C |
| Device fleet (IoT) | CRUD | R | R | R | — | — | R | — | — |
| User & role mgmt | CRUD | — | — | — | CRU | — | — | — | — |
| Audit logs | R | — | — | — | — | — | R | — | — |
C Create R Read RU Read-Update CRU Create-Read-Update A Approve CRUD Full — None
Active users · access review
Quarterly review flags stale accounts · last review 01 Jun 2026
| User | Role | Scope | Last active | Status |
|---|---|---|---|---|
| A. Deshmukh | State Nodal Admin | state:MH | Today | Active |
| R. Joshi | District Supply Officer | district:nandurbar | Today | Active |
| P. Bagul | Grievance Officer | taluka:nandurbar | 2 hrs ago | Active |
| Centre 02 Admin | Vendor Admin | batches:nandurbar | Today | Active |
| K. Nikam | MIS Auditor | district:nandurbar | Yesterday | Active |
| S. Tadvi | Taluka Officer | taluka:navapur | 41 days ago | Stale — review |
No shared credentials. Every action carries a service-scoped token and lands in the audit ledger with the acting user. Stale accounts are surfaced for revocation each quarter.