Koinonia OS uses Role Based Access Control (RBAC) to ensure that every member, servant, priest, treasurer, and administrator has appropriate access while protecting sensitive parishioner data.
Tip: Users can hold multiple roles simultaneously. For example, a user can be both a Parish Member and a Sunday School Servant, automatically unlocking permissions for both roles.
Role Name | Target Users | Key Capabilities |
|---|---|---|
Parish Member | All registered church members | Manage personal profile, view public events, register for forms, view giving receipts, QR check-in badge. |
Servant / Group Leader | Sunday school teachers, fellowship leaders | Record attendance, view class rosters, send group announcements, manage small group events. |
Ministry Leader | Department heads (Worship, Youth, Facilities) | Manage ministry rosters, assign volunteer shifts, submit ministry expense requests, build custom forms. |
Priest / Clergy | Ordained clergy & pastoral team | Access 360° parishioner profiles, record Sacraments, manage confidential pastoral visitations and absence cases. |
Treasurer / Finance Officer | Finance committee & bookkeepers | Process donations, generate contribution statements, manage annual budgets, approve expenses, audit bank entries. |
Parish Administrator | Church office managers & IT admins | Full access to all church data, manage user roles, configure settings, manage parish join codes, export analytics. |
---
To safeguard sensitive parishioner records, Koinonia OS enforces strict database trigger protections:
Self-Service Restrictions: Members can update their personal phone, email, and address, but cannot modify administrative fields such as organization_id, linked_user_id, membership_status, or envelope_number.
Confidential Pastoral Notes: Pastoral visitation notes and absence case files are strictly restricted to assigned servants, priests, and church admins. General members cannot view pastoral care records.
Financial Confidentiality: Uploaded expense receipts, bank statement lines, and individual donor records are strictly restricted to authorized Finance Officers and Priests.
Important: If a servant or leader requires elevated permissions (for example, a new Sunday School teacher who needs class roster access), a Parish Administrator must grant the role under Settings > User & Role Management.