Role-Based Access Control — Permission Matrix

Pick a role — patient, doctor, insurer, admin — and try actions like viewing others' reports or managing users. Watch a live allow/deny matrix decide each one. Each role gets only what it needs.

Pick a role, then click an action to attempt it. The matrix below is the policy — green is allowed, grey is denied.

Action

🧑 Patient

🩺 Doctor

🏦 Insurer

🛠️ Admin

Click any row to attempt it as the selected role. The column for your role is highlighted.

What just happened

▹Role-based access control assigns permissions to roles, not individuals. A user gets a role; the role decides what's allowed. Every action is checked against the role before it runs.
▹Each role gets only what it needs (least privilege): a patient touches only their own data, a doctor only their assigned patients, an insurer only claim records, an admin only configuration — not clinical data.
▹Notice 'View ANY patient's records' is denied to everyone, including admin. Managing the system is a different permission from reading patients' health data — don't bundle them.