Skip to content

Access Control

Last updated: 2026-07-21

This file is the runtime-oriented access reference (live gates, route guard props, and nav visibility). Business policy canon now lives in docs/access-control-v2.md. If this file conflicts with docs/access-control-v2.md, follow docs/access-control-v2.md and update runtime docs accordingly.

Live server snapshot

Item Value
Production https://www.archetiq.com
Demo https://demo.archetiq.com
VPS 76.13.211.100
Production frontend root /opt/personality-app/public
Demo frontend root /opt/personality-app-demo/public
Production backend port 5002
Demo backend port 5006

startup.archetiq.com serves Startup Playbook production. demo-startup.archetiq.com serves Startup Playbook demo.

Product access model

The live app uses two plan models:

  1. individual
  2. organisation

Runtime access states are derived from those plans and role overrides:

  1. Discovery (always on)
  2. Explorer (paid individual flow)
  3. StartupOS (included with organisation access)
  4. Organisation tools (included with organisation access)

Rule set

  • Discovery is always available.
  • Explorer is gated by paid access or admin/coach override.
  • StartupOS is included when a user has organisation access.
  • Organisation tools are included when a user has organisation access.
  • HR Admin is the first organisation operator and can add members.
  • Org Admin has full organisation access.
  • StartupOS is available to all organisation users for their own journey.
  • Team leads may view StartupOS for team members they lead.

Feature mapping

Area Live home
Discovery assessment, report, profile
Explorer Book Guide, Mind & Body, Money Plan, Career Path, Growth Loop, Chemistry Check
StartupOS Startup Dashboard, Create Startup, Startup Settings, Lecturer Dashboard, Decision Lab, /startup/* routes
Organisation tools Organisation Dashboard, Teams, Team Intelligence, Team Maturity, People Blueprint, Work Chemistry

Role model

Organisation role vocabulary in active flows:

  • member
  • lead
  • coach
  • hrAdmin
  • orgAdmin
  • admin (legacy compatibility value still supported in some records/routes)

Live gates

The implementation lives in client/src/utils/journeyGates.ts.

Gate Purpose
hasPaidAccess() Explorer access
hasStartupOS() StartupOS access
hasOrgTools() Organisation tools access
canAccessBook() Book Guide
canAccessChemistry() Chemistry Check
canAccessCorporate() People Blueprint / Work Chemistry
canAccessFutureStudio() Career Path / Life Simulator
canAccessGrowthLoop() Growth Loop
canAccessFinancialPlan() Financial Plan
canAccessWellnessProfile() Mind & Body
canAccessCompare() Relationship Lens / personal chemistry tab
canAccessCoachPortal() Coach Portal
canAccessOrgDashboard() Organisation Dashboard
canAccessTeams() Team list / team map
canAccessTeamIntelligence() Team Intelligence
canAccessTeamMaturity() Team Maturity own/member access
canAccessTeamMaturityDashboard() Team / org maturity dashboard

Route guards

ProtectedRoute.tsx uses these props:

  • requiresDiscovery
  • requiresFoundations
  • requiresPayment
  • requiresBook
  • requiresChemistry
  • requiresOrganisation (deprecated alias, maps to org-tools style access)
  • requiresStartupOS
  • requiresOrgTools
  • requiresTeamIntelligence
  • requiresTeamMaturity
  • requiresTeamMaturityDashboard
  • requiresOrgDashboard
  • adminOnly
Navigation Visible when
Explore hasPaidAccess()
Design hasPaidAccess()
Master hasPaidAccess()
Organisation role-aware org access helpers
StartupOS hasStartupOS()
Coaching canAccessCoachPortal()
Platform admin only

Access diagram

flowchart TD
  A[Login] --> B[Discovery]
  B --> C{Access state}
  C -->|Explorer| D[Personal journey]
  C -->|Organisation plan| E[StartupOS]
  C -->|Organisation plan| F[Organisation tools]
  C -->|Explorer available| D

Admin controls

The admin and organisation management surfaces can:

  • edit organisation settings
  • assign and manage organisation roles
  • manage organisation members
  • manage StartupOS / org-tool access through org membership

Migration note

Legacy non-organisation plan and org-kind paths were removed from active runtime access checks and billing paths. StartupOS is now bundled with organisation access.

Naming map (policy -> runtime fields)

docs/access-control-v2.md uses policy names. Runtime code currently stores/accesses role fields as:

  • platformAdmin -> role === 'admin'
  • orgAdmin -> orgRole === 'orgAdmin' (legacy compatibility: orgRole === 'admin')
  • hrAdmin -> orgRole === 'hrAdmin'
  • coach -> orgRole === 'coach'
  • lead -> orgRole === 'lead'
  • teamMember -> orgRole === 'member' (or null/unset for legacy member records)