Four roles, and why the list stops there
Every role exists because some specific action needs an owner. Each card below names that action; none of the four was added because it sounded like a job somebody might have.
A fifth role is always proposed and is always one of these four wearing a different name. The test applied before any role is added is whether there is a cell in the grid that no existing role can hold and that the new role would hold alone. If there is not, the request is a permission on an existing role.
- ReaderNeeds no account at all. That is the first decision rather than an afterthought: a portal that asks for an account before it will show a published listing has made the listing worthless.
- HolderExists because an entry needs one writer, and because somebody has to be answerable for what a field means.
- ModeratorExists because a state change needs somebody accountable for it, and because a reason code needs a name against it.
- StewardExists because the tree and the slug register are the two things a mistake in cannot be undone locally.
The grid that settles what each role may change
Permission grid
| Action | Reader | Holder | Moderator | Steward |
|---|---|---|---|---|
| read a published listing | yes | yes | yes | yes |
| submit a revision against its own entry | no | yes | no | no |
| move a listing to published | no | no | yes | no |
| withdraw a published listing | no | its own | any | no |
| move a listing to removed, against a code | no | no | yes | no |
| change a slug and write the register | no | propose | propose | yes |
| add, rename or merge a category | no | no | propose | yes |
| read the record | no | its own rows | the queues it works | all of it |
| change another account’s role | no | no | no | yes |
Two cells in that grid say propose rather than yes or no. A proposal is a queue row, not a permission, and it is how a moderator who can see a slug is wrong gets it fixed without being handed the register.
What an account record holds, and what it leaves out
A listed thing outliving the account that described it is the normal case, not the exception.
- Inidentifier, one address to reach the account at, one role, the entry held if any, the stamp it was created, the stamp its role last changed.
- Outa person’s name, a postal address, a telephone number, a job title, and any field describing who somebody is rather than what the account may do.
A role change writes a row carrying the role before, the role after, the account that made the change and the stamp. Who could do what on a given day is a question asked long afterwards and it cannot be answered from a current-state table, so the change is recorded rather than the state alone.
When a holder stops holding, the entry does not go with them. The entry’s state is untouched, the holder field is cleared, and the entry waits in the steward’s list for a new holder.