How ChurchHub decides access
Django authenticates the ChurchHub account and then checks active organisation membership, organisation or branch scope, role permissions, explicit grants and explicit denies. Successful sign-in alone grants no ChurchHub data access.
Invite or add a user
Open Settings → Users and choose Add user or Invite user.
- 1Use the email address the person will authenticate with.
- 2Choose the organisation role.
- 3Choose Organisation scope or one specific Branch.
- 4Review the effective access shown.
- 5Send the invitation and confirm it with the person through a separate channel when access is sensitive.
Only users allowed to manage organisation access can invite or change memberships.
Use roles for the baseline
Open Settings → Roles to review or create a role. Give the role the permissions everyone doing that job needs. Avoid creating one role per person; personal exceptions belong in explicit grants or denies.
Understand grants and denies
An explicit grant adds a justified permission beyond the role. An explicit deny removes one even when the role includes it. Deny wins during effective-permission resolution. Review exceptions regularly because they outlive a role rename.
Delegation is bounded
A manager cannot delegate more authority than ChurchHub says they may grant. The interface explains what is delegatable, and the server repeats the check so editing a request cannot expand authority.
Scope every membership correctly
Choose Branch scope for a person who should work in one branch only. Choose Organisation scope only when their responsibilities genuinely cross branches. A branch-scoped role with a broad permission name is still confined to that branch.
Suspend access without deleting history
Deactivate the organisation membership when duties end or access is under review. This preserves audit attribution while removing the workspace. Deactivate the whole user only when the identity itself must no longer sign in.
Run regular access reviews
Review administrators, inactive staff, branch assignments, explicit grants, explicit denies and users with finance or export capabilities. Record the reason for unusual access and remove it when the reason ends.