Hiring Staff & Role Permissions

The Staff Onboarding Flow (/people/hire) registers new employees, assigns duty branches, establishes job titles and targets, and issues cryptographic system roles.

1. Governance & Security Model

  • Required Privilege: staff: create (System Administrators and Executive Directors).
  • Three-Tier Account Provisioning:
    1. Core Identity: The employee’s personal account (National ID, mobile phone, email).
    2. Staff Profile (STF...): The employment record linking the person to a physical branch (BRX...), official title, and performance target.
    3. Role Grants: The specific operational permissions that govern menu visibility, gated actions, and Typesense cryptographic search key generation.

2. The 4-Step Hiring Rail

[ 1. The Person ] ──► [ 2. The Post ] ──► [ 3. Access & Roles ] ──► [ 4. Review & Credentials ]

Step 1: The Person (#person)

Capture the employee’s personal identification details:

FieldValidation & RequirementsPurpose
Full Legal NameAs printed on national identity card.Displayed across audit trails, client cards, and receipts.
National ID Number7–8 digit citizen ID; unique across system.Primary login username and government verification anchor.
Mobile PhoneValid Kenyan MSISDN (2547... or 07...).Receives two-factor authentication (2FA) OTP codes.
Email AddressInstitutional corporate email.Receives system alerts, approval notices, and reports.
GenderFemale / Male / OtherStatutory reporting for regulatory returns.

Step 2: The Post (#post)

Establish the employee’s operational base:

  1. Branch Assignment:
    • Use the live search bar to select the assigned branch office (BRX...).
    • Branch-scoped roles (officer, manager, teller) will have their visibility confined to this office.
  2. Job Title:
    • Select from standard designations: Loan Officer, Senior Loan Officer, Branch Manager, Teller, Accountant, Compliance Officer, Director, Administrator.
  3. Monthly Disbursement Target (KES):
    • Sets the officer’s performance baseline (e.g., KES 2,500,000 per month) used to power the dashboard progress gauge.
  4. Employment Date: The official contract commencement date.

Step 3: Access & Role Grants (#access)

Select the operational privileges assigned to the employee:

Role OptionSecurity ScopeOperational Permissions
Loan Officer (officer)Own Book & BranchClient onboarding, loan origination, collection sheets. Confined to own borrowers.
Branch Manager (manager)Whole BranchLoan approvals $< \text{KES } 500k$, reschedules, reassignments, staff monitoring.
Teller (teller)Branch CounterCash receipts, M-Pesa entry, STK push initiation, cash drawer balancing.
Executive Director (director)Org-wideHigh-value loan approvals, write-offs, institutional reports.
Accountant (accountant)General LedgerChart of accounts, journal vouchers, bank reconciliations, fiscal closures.
Compliance Officer (compliance)Org-wide RiskKYC document verification, sanction checks, AML monitoring, CRB reporting.
Auditor (auditor)Read-Only Org-wideUniversal read-only audit log inspection; cannot alter data or approve.
Administrator (admin)Organization-wideFull configuration, product management, user provisioning, database reindexing.

Step 4: Review & Credentials (#review)

  1. Verify Handover Checklist:
    • Displays combined summary: Identity, Branch, Title, Assigned Roles.
  2. Temporary Password Generation:
    • The platform generates a secure, randomized temporary password (e.g., Wk8NmY2z@45).
    • Click the Copy Password button to securely share with the employee.
    • Security Rule: The employee is forced to set a private new password upon their initial sign-in.
  3. Complete Onboarding: Click Hire Staff Member.