Loading
SycaMoreWho does what
Who does what
Nobody can do the one thing that would make the record worthless.
Six roles. For each, the useful question is what it cannot do.
Volunteer
Check in and out, see every hour, share their own record.
Type or change an hour.
Guardian
Confirm or withdraw consent for a 13–17 year old, by email link.
Log in or edit anything.
Coordinator
Run events, check people in, set roles, close and attest.
Send anyone’s record to a third party.
Org admin
Everything a coordinator can, plus seats, billing and revocation.
Edit a record after it is issued.
SycaMore admin
Verify organizations, sample records, handle abuse.
Sign in as someone and change their data.
Anyone with a link
Open a record and read it, with no account.
Find records they were not sent.
Between organizations
Each organization sees only its own.
The database enforces it. A forgotten filter returns nothing, not someone else’s data.
- A volunteer at two organizations appears to each only for their own events
- The volunteer sees both
- Tested by direct lookup on every table
Minors
Rules for young volunteers live in the database.
Under 13
No account is created, and nothing is stored.
13 to 17
They serve and see everything. Sharing waits for a guardian.
18 and over
They share their own record whenever they like.
Try to reach something you shouldn’t.
Switch between accounts in the demo and see what each one can open.