User roles in O9X did not emerge from a UI kit or a standard permissions template. They appeared while I was mapping where failure must land.
The biggest threat is not a lack of access. It is permission creep — the slow, quiet drift where authority, visibility, and time get mixed until no one is responsible for anything. In O9X, I did not design roles to describe who does what. I designed them to decide who is allowed to rewrite recorded truth, and for how long.
The Separation Rule
In a healthy system, no single role should hold these three things at the same time: speed to act, visibility into the whole system, and authority to finalize outcomes. If a role has all three, errors do not get corrected — they get justified.
O9X is built on asymmetry. Each role is forced to price in bad behavior, ensuring that truth is verified by someone with a different set of constraints.
The 60-Day Wall
The HR and Ops Manager has the broadest authority. They raise invoices, handle compliance, and resolve queries. But they hit a hard stop: a 60-day edit limit.
This is not a technical limitation. It is a boundary.
In my business, attendance truth must stabilize before money moves. Once an invoice is raised — typically by the seventh of the following month — the data is no longer just information. It is a legal and tax artifact.
Every long-running business accumulates social capital. Without hard boundaries, that social capital starts to overpower recorded truth. If I removed the 60-day limit, the first person to benefit would not be the efficient employee. It would be the supervisor with a strong social relationship who wants to reframe a billing error as a misunderstanding. Billing errors stop being errors and become negotiated rewrites. O9X stops the negotiation.
Field Staff: Speed Is Local, Memory Is Short
Field staff create reality. They enroll associates and submit attendance. They need speed, so we give it to them. But their authority ends in 72 hours.
If an error is not corrected within 72 hours, it stops being an observation and starts becoming a narrative. After 72 hours, the field layer loses the right to edit. If they need a change, they escalate to Ops.
This forces a second look, introducing independent verification instead of self-correction. It also prevents comparisons and quiet coordination across units. Local truth stays local. Organizational truth gets resolved elsewhere.
Customers: Visibility Without Mutation
Customers do not operate the system — they witness it. Their role is built on full visibility and zero modification rights. They can view units, associates, and compliance artifacts, but they cannot touch the data. The Corporate Role gives full visibility across all contracted units. The Unit Role restricts visibility to specific approved sites.
Limiting the Unit Role prevents local site managers from comparing data across a client’s wider footprint, which can create artificial comparisons and unnecessary disputes.
The Escalation Ladder
When a customer raises a complaint in O9X, it signals that trust has been punctured. That is why the system does something counter-intuitive: it bypasses the field staff.
If a customer is complaining, the field layer has already failed. Speed is no longer the priority. Credibility repair is. For days one through five, the Ops Manager owns resolution. From day six onward, the issue escalates to the Super Admin.
About 90% of issues resolve without escalation. Most customers do not want an email storm — they want acknowledgment. If an issue persists beyond five days, it is no longer operational noise. It is a systemic failure that must be owned by me.
The Super Admin: Ownership Without Escape
The Super Admin role is the terminal point of failure. It has full authority, but in a well-run system it should almost never be used.
If everything reaches the Super Admin, the system is broken. If nothing ever does, the system is lying.
What the Role Design Actually Does
Roles are about failure timing, not access control. O9X ensures field staff fail early and locally. O9X ensures Ops absorbs shock before money moves. O9X ensures the Super Admin only sees what the system could not contain.
Without these boundaries, the system would not be flexible. It would be negotiable. And negotiated systems do not fail loudly — they rot quietly, one relationship at a time. Rot is inevitable in any system. O9X exists to ensure it is visible, expensive, and contained.