Appearance
Permissions
Clearance policy
CLEARANCE_POLICY in dps-code-api/authz.py — minimum clearance_level required per capability, checked against the live agents row on every request. /auth/me returns these flags plus minimum_clearances.
| Permission | Level | Notes |
|---|---|---|
view_dashboard | 1 | General dashboard + docket reads |
view_agents | 1 | Agent directory |
add_case_note | 1 | Notes (plus assignment gate) |
add_evidence | 1 | Evidence (plus assignment gate) |
view_analytics | 2 | Analytics page |
manage_dockets | 2 | Status/field updates, actions, contact, timeline |
view_punishments | 2 | Punishment list/detail/profile reads |
reassign_docket | 4 | + Head Investigator rank or above |
decide_appeal | 4 | Appeal decision surface (audit log) |
manage_punishments | 4 | Issue/edit/revoke, user lookups |
manage_agents | 5 | Agent creation |
delete_docket | 5 | Report deletion (reason required) |
Admin capabilities
ADMIN_PERMISSIONS — gated by require_admin (admin allowlist + clearance; Director rank for Director-only).
| Capability | Clearance | Director-only? |
|---|---|---|
admin_panel | 4 | no — gates the whole /admin area |
admin_health | 4 | no |
admin_queue | 4 | no |
admin_audit | 4 | no |
admin_agents | 4 | no — but rank/clearance edits require Director |
admin_reports | 5 | yes |
admin_schema | 5 | yes |
access management (admin_access_*) | 4 | yes (via admin_agents + director_only) |
Rank gates
| Gate | Ranks |
|---|---|
Supervisor reports/queue, audit visibility, trainer eligibility (SUPERVISOR_RANKS) | Senior Agent, Head Investigator, Lead Agent, Director, Department Director |
Case reassignment (REASSIGN_RANKS) | Head Investigator, Lead Agent, Director, Department Director |
Director authority (DIRECTOR_RANKS) | Director, Department Director |
Trainer role (_is_trainer) | is_trainer flag or supervisor rank |
Rank order (lowest → highest): Trial Agent, Probationary Agent, Agent, Senior Agent, Head Investigator, Lead Agent, Director, Department Director.
Report-level gates
| Gate | Rule |
|---|---|
| Assignment | Only the assigned agent may update/note/evidence/timeline/action/contact (supervisor ranks bypass) |
| Supervisor rows | Senior Agent+ (or API key); restricted placeholders + zeroed counts below |
| Claim | manage_dockets; ALREADY_CLAIMED when assigned |
| Reopen concluded case | Clearance 4+ |
| Bot-only fields | is_supervisor, notes, reason (dashboard may never set) |
Bot (API key) capability surface
| Allowed | Denied |
|---|---|
Report creation, generators, util/timestamp | Training routes (403) |
| Queue pickup/complete/requeue | Punishment/discipline mutation routes (403) |
| Contact respond, discord-profiles ingestion | Admin routes (403) |
| Onboarding agent field updates (no rank) | Any rank write (400) |
| ER:LC player lookup | — |