My Business: Access and Role Management

### **Figma File ([link](https://www.figma.com/design/03Cc7aqTy7kZO8BOlOVOKU/My-Business-%7C-Access-Management?node-id=3-584&t=FNgqTfKijZLhDSNQ-1))**
____________________________

### **Issue**
Right now, business owners do not have a clear way to see who currently has access to their business or who has been invited. There is no single place in the product that shows all users and roles. And director access in particular is confusing. This creates uncertainty for businesses and users affiliated with/to a business and makes access management harder than it needs to be.

This ticket outlines the MVP requirements for an Access and Role Management feature that gives business users better visibility and control, while staying compliant with legal obligations around directors.

**Policy and legal context for Directors**
- We cannot legally require a director to provide their residential address.
- By law, directors must have access to their business.
- Director access cannot be declined, blocked, or revoked by other users.
- Directors effectively have full administrative control.
- Directors should be able to remove external representatives, such as law firms with elevated privileges.

### **Goals**
- Give business users a clear, centralized view of who has access and who is invited.
- Provide a safe and compliant way to manage access, especially for directors.
- Clarify where this feature lives in the product and use plain language to explain roles.
- **revise way for business to request access? (Verify)**

### **In scope**
- An access list page for a business
- Inviting users
- Removing users
- Viewing active users and pending invitations.
- Clear role definitions and role based rules.
- **Director access logic and UI handling. (post MVP?)**

**Out of scope**
- Advanced or custom permission models.
- ***NEW* Full API based access management workflows for third party vendors.**

____________________

### **Functional requirements**

**Access list**
- A user with the right permissions can view an Access page for a business.
- The page shows all current access holders and pending invitations in one place.
- Each entry shows at minimum:
- Profile Name (Authenticated name on their BC Service Card or BCid)
- Account Name
- **Email?**
- **Date?**
- Role or access level.
- Status such as Active or Invited.
- **Who invited them, when available. (Maybe not MVP?)**

**Invitation visibility**
- Invited users appear in the same list as active users with a clear invited status.
- Invitations are visually distinct from active access.
- Ability to re-send invitation
- Invitations create pending affiliations that must be accepted by the invited person.

**Add person to a business**
- An **Admin** or **Director** can invite another person to the business.
- The system records the invite and displays it in the access list.
- The UI clearly distinguishes between active access and invited users.

**Language and placement**
- Access management lives in a clearly labeled location
- Roles and access states use plain language labels.
- Each role includes a short description explaining what that role can do.

**Non functional requirements**
- The UI must not imply that director access is optional or revocable.
- The system must not require directors to provide their residential address.
- Only **authenticated users** can manage or view access where permitted.

**Permission rules for MVP**
- Directors are treated as admins by default, by law.
- Director access cannot be blocked, revoked, or downgraded.
- The UI must reflect director access as automatic and mandatory.
- External representatives, such as law firms, can be removed by admins.
- ***NEW* Third party vendors must not be treated as business owners or permanent admins. (Vendors act only as technical intermediaries.)**

____________________

### **Role based rules**

**User roles**
- Directors **(Should Directors be their own role instead of Admin? You cannot remove them within this tool, so separating the role might make things clearer.)**
- Admins
- Editors
- Viewers

**Director specific rules (Post MVP?)**
- Directors automatically have admin level access.
- Their access does not depend on invitations.
- Their role cannot be downgraded by other users.
- Can only be removed by changing directors in the Business Management Tool
- **They can remove other admins, editors, and viewers? (Verify)**

**Admin**
- Full control over the business.
- Can manage all roles, including other admins.
- Can remove external representatives.
- Can not remove directors within the access management tool.
- All roles can see the **Primary Admin/or Admins?** and their contact information.

**Editor**
- Can manage the business they are associated with.
- **Can add other Editor and Viewer roles. (Verify)**
- Cannot remove the Admins
- Can not remove Editors or Viewers they did not add.
- Can remove their own access.

**Viewer**
- Read only access.
- Cannot invite or remove access.
- Cannot view the full access list (Can they view the person that added them?).
- Can remove their own access.

____________________________

### **User flow summary**
User goes to My Business.
User selects View and Manage Access.
User sees a list of all active users and invited users.
User invites a new person or reviews existing access.
System enforces role based rules and director constraints.

### **Acceptance criteria**
A business user can view a complete access list for their business.
Invited users are clearly visible in the same list as active users.
Directors always appear with admin level access.
Director access cannot be removed or blocked in the UI or backend.
External representatives can be removed by directors.
The UI language never suggests that director access is optional.
***NEW* Vendors never appear as business owners.