The shape of it
A person holds roles in a club. Each role carries a fixed set of capabilities. Your capabilities are the union of every role you hold, on today's date.
Capabilities draw doors. They never open one. The menu you see is built from what you hold — but the server re-checks every single request from scratch and does not care what your browser decided to render. Guessing a web address you have no capability for gets you nothing.
Role grants are dated. A grant starts on a day and can end on a day, so "Sam coached last season" stays true in the record without Sam still holding the keys. Grants are audited, and you cannot grant yourself one.
The roles
| Role | Holds |
|---|---|
owner | Everything in the club, including medical records and Safe Sport |
club_admin | Everything except medical records and Safe Sport |
membership_admin | Members, roster, medical summaries |
registrar | Members, roster |
treasurer | Billing, roster |
board_member | Roster, audit log |
front_desk | The gate, roster, medical summaries |
head_coach | Schedule, programs, broadcasts, roster, medical summaries |
coach | Schedule, roster, medical summaries |
assistant_coach, instructor | Roster, medical summaries |
lifeguard | Medical summaries |
lessons_admin, meet_director | Programs, schedule, roster |
facility_manager | Schedule |
safe_sport_lead | Safe Sport, full medical, safeguarding notes and their audit |
snack_bar, official, adult_athlete | No staff capabilities |
Three deliberate sharp edges
manage_waivers is narrow. Only owner and club_admin hold it — not the
registrar, who is the obvious guess. Chasing an unsigned waiver and rewriting the
release everyone already signed are not the same authority, and publishing a
version marked a material change invalidates every signature in the club.
Safeguarding notes belong to the Safe Sport lead alone. Not the owner, not the board. A safeguarding note is a sentence typed about a named child, and in a club where the treasurer is also a parent, a wider capability is neighbours reading about neighbours' children. The front desk's real need at 5:45am is answered by a structured contact restriction, not by somebody's prose.
Reading a medical record writes an audit row. Every time. A deck coach sees a
short summary; the full record needs read_medical and leaves a trace.
Families
Family access is not a role. It comes from belonging to a household: you see your own family and nobody else's. A caregiver — a nanny, a grandparent on the list — can collect a child and can be checked in at the gate, but cannot sign a waiver or message a coach. That line is a safeguarding decision, not a missing feature.
Platform operators
SwimWin staff have a separate platform flag that is never a club role. It opens the Admin area — a cross-club surface with its own navigation, reachable only by SwimWin staff — and on its own it grants nothing inside your club. What it can read across clubs is a narrow, read-only lookup, and every read is recorded.
When you ask support to fix something, an operator can work inside your club with your club's own screens. They confirm their password first (and again every 30 minutes), they act as SwimWin support rather than being added to your club, safeguarding notes need a stated reason, and every change shows in your audit trail as "SwimWin support · their name". They can also view your club as one member to see what that member sees — read-only, for at most an hour, and the member is emailed who looked and why. See Who can see a swimmer's details.