dodil/erp-brick-manufacturing

DODIL ERP brick: manufacturing

src/brick_manufacturing/roles.yaml

# The default roles this brick recommends: module.yaml's actors, permission for permission. A starting point, not a rule: the
# brick checks PERMISSIONS only, never a role's name; a composition maps its own pool roles to these permissions.
#
# mfg:settings:controls (over-issue tolerance, release with shortage, approval thresholds, valuation method, time zone) is held by the
# owner ONLY, never by the planner or operator it controls. The machine permissions (mfg:bom:explode, mfg:outbox:dispatch, ...) go to
# service clients, each with only its exact grants: mfg:bom:explode is also granted to pos's client, mfg:plan:read_requirements to
# inventory's. No wildcard reaches them.
roles:
  process_engineer:
    [mfg:bom:read, mfg:bom:write, mfg:bom:release, mfg:routing:write, mfg:work_centre:write, mfg:order:read]
  planner:
    [mfg:bom:read, mfg:plan:run, mfg:plan:firm, mfg:forecast:write, mfg:order:read, mfg:order:create, mfg:order:release, mfg:order:cancel]
  operator:
    [mfg:bom:read, mfg:order:read, mfg:order:issue, mfg:order:confirm, mfg:order:report_output, mfg:order:scrap, mfg:order:reverse]
  cost_accountant:
    [mfg:bom:read, mfg:order:read, mfg:cost:run, mfg:cost:approve, mfg:order:complete, mfg:order:close, mfg:report:read, mfg:migration:read]
  quality:
    [mfg:bom:read, mfg:order:read, mfg:trace:read]
  owner:
    [mfg:order:read, mfg:report:read, mfg:settings:controls, mfg:migration:read, mfg:migration:sign]
  system:
    [mfg:bom:explode, mfg:plan:read_requirements, mfg:plan:derive, mfg:outbox:dispatch, mfg:genealogy:derive, mfg:number_series:claim, mfg:migration:load, mfg:migration:reconcile]
service_clients: [system]