For super admins
Security & roles
How VenueTunes decides who can do what.
Role hierarchy
super_admin > org_admin > venue_admin > dj > customer. Higher roles inherit lower-role permissions in their scope.
Enforcement
- Every write goes through a server function that verifies the caller's role.
- Row-level security in the database is a second line of defense.
- Roles are stored in a dedicated table — never on the user profile.
Heads up
Never grant super_admin casually. It bypasses org-level scoping.