Unclassified

IntegrateWise Workbench Role–Capability Map

Status: Canonical mapping reference; runtime access remains RBAC- and
policy-resolved

Date: 2026-07-28

Code authority: packages/workbench-config/src/roles.ts

Source support: IntegrateWise_Role_Workbench_Mapping_Package.zip

1. Mapping law

A role configuration is a projection recipe, not a separate schema and not an
authorization token.

tenant membership
× effective RBAC
× role
× department
× industry
× enabled connectors and entity availability
× policy and entitlement
× active context
→ permitted Workbench projection
→ permitted semantic capabilities

The Gateway resolves the effective projection. The browser does not choose its
own authority. Canonical Spine records keep the same identity regardless of
which role views them.

Connector names in a role configuration are discovery/availability candidates.
They do not require a customer to use a particular vendor, prove that a
connection is active, or permit the Product to call the provider directly.

2. Shared Platform projection

All 12 roles receive the following Platform modules when RBAC and policy allow:

Module ID	Product label	Responsibility
`integrations`	Integration Manager	Connector catalog, connections, sync, webhooks and schema mappings
`configuration`	Configuration Manager	Projection inputs, tenant policies and configuration
`activation`	Activation Hub	Onboarding and operational-readiness state
`governance`	Governance	Approvals, policy decisions and audit
`continuity`	Continuity	Governed context and memory projection
`network-graphs`	Network Graphs	Entity and relationship projections from the Spine

The Twin is not a shared Platform module or permanent sidebar destination. It
is a contextual Workbench capability governed by the Silence Law and the Four
Buttons.

3. Role projection registry

The table records the current repository configuration. Module and capability
names are semantic identifiers; Product labels may be friendlier while
preserving the same contract.

Role ID	Projection	Default RBAC profile	Role-specific operational modules	Principal entity/capability families
`founder`	`founder`	`admin`	Home, accounts, contacts, meetings, docs, tasks, calendar, risks, expansion, analytics, pipeline, knowledge, projects, notes, team, operations, admin, settings, profile	`entity360.*`, connections, sync, tasks, analytics, knowledge, pipeline, signals, projects, calendar, docs, meetings, admin, billing, connectors, webhooks, schemas
`customer-success`	`cs`	`business-ops`	Home, accounts, contacts, meetings, docs, tasks, calendar, risks, expansion, analytics	Account/contact 360, connections, sync, tasks, analytics, knowledge, calendar, docs, meetings, signals
`sales`	`sales`	`sales`	Home, pipeline, accounts, contacts, meetings, tasks, calendar, docs, analytics	Account/contact/deal 360, pipeline, connections, sync, tasks, analytics, calendar, docs, meetings
`support`	`support`	`business-ops`	Home, accounts, contacts, tasks, calendar, knowledge, analytics	Account/contact/ticket 360, connections, sync, tasks, analytics, knowledge, calendar
`project-management`	`pm`	`business-ops`	Home, projects, tasks, docs, meetings, calendar, knowledge, analytics	Project/task 360, projects, tasks, connections, sync, analytics, knowledge, calendar, docs, meetings
`marketing`	`marketing`	`business-ops`	Home, analytics, contacts, docs, calendar	Campaign/contact 360, connections, sync, analytics, knowledge, calendar, docs
`business-operations`	`bizops`	`business-ops`	Home, projects, accounts, contacts, meetings, docs, tasks, calendar, notes, knowledge, team, pipeline, risks, expansion, analytics	`entity360.*`, connections, sync, tasks, analytics, knowledge, pipeline, signals, projects, calendar, docs, meetings
`technology`	`tech`	`business-ops`	Home, projects, tasks, docs, knowledge, analytics	Project/task 360, projects, tasks, connections, sync, analytics, knowledge, docs
`human-resources`	`hr`	`business-ops`	Home, team, tasks, docs, meetings, analytics	Employee/project 360, connections, sync, tasks, analytics, knowledge, calendar, docs, meetings
`finance`	`finance`	`business-ops`	Home, accounts, docs, analytics	Account/invoice/subscription 360, connections, sync, analytics, knowledge, docs
`legal`	`legal`	`business-ops`	Home, docs, tasks, analytics	Contract 360, connections, sync, tasks, analytics, knowledge, docs
`personal`	`personal`	`developer`	Tasks, calendar, notes, knowledge	Tasks, calendar, knowledge, connections

4. Mapping-package interpretation

The supplied role package contains one master workbook and 12 role workbooks.
Its entity catalogs, click-context maps, CRUD tables, canvas/page definitions,
backend mappings, governance rules and acceptance tests are detailed projection
requirements. They do not independently:

create physical per-role or per-tenant schemas;
authorize a capability;
prove a connector is operational;
allow Loader or Triage to write canonical truth;
make every record click open the Twin; or
override the repository's hyphenated role IDs.

Workbook role IDs that use underscores must be normalized to the repository
IDs, such as customer_success → customer-success and
project_management → project-management, before contract generation.

5. Runtime response

Discovery and projection responses must expose the resolved result, not the
entire configuration registry:

interface ResolvedRoleProjection {
  role: string;
  projection: string;
  modules: Array<{
    id: string;
    label: string;
    state: "available" | "degraded" | "unavailable" | "forbidden";
  }>;
  capabilities: Array<{
    id: string;
    mode: "read" | "propose" | "approve" | "execute";
  }>;
  connectorAvailability: Array<{
    connectorId: string;
    state: "available" | "authenticated" | "operational" | "degraded";
  }>;
}

Execution still requires a governed command and, where applicable, a valid
approval token. A visible module or capability never grants write authority by
itself.

6. Acceptance

All 12 repository role IDs resolve without underscore/hyphen ambiguity.
Shared Platform modules are independently permissioned.
Role/department/industry changes alter projections, not canonical schema.
Disabled or disconnected connectors reduce availability without creating
broken routes or synthetic data.
The Product receives semantic projection responses through Gateway only.
Twin visibility follows explicit Ask/Assign or a qualified material signal.
CRUD commands pass tenant, RBAC, policy, provenance and governed-writer
checks before a canonical mutation.