The shape of it
A person holds roles in a club. Each role carries a fixed set of capabilities. Your capabilities are the union of every role you hold, on today's date.
Capabilities draw doors. They never open one. The menu you see is built from what you hold — but the server re-checks every single request from scratch and does not care what your browser decided to render. Guessing a web address you have no capability for gets you nothing.
Role grants are dated. A grant starts on a day and can end on a day, so "Sam coached last season" stays true in the record without Sam still holding the keys. Grants are audited, and you cannot grant yourself one.
Granting and revoking a role
An owner or club admin grants roles in Club setup → Staff
(/setup/staff): pick a person already on the roster, a role and a start date
(today or later), and optionally an end date. Once your club runs two programs
you can also grant a role in one program. See Programs.
Four rules hold whoever is asking:
- Nobody grants themselves a role, and nobody revokes their own.
- You can only grant a role whose powers you hold yourself. A club admin cannot make somebody treasurer, because a club admin does not handle billing.
- Only an owner can grant or revoke
owner. An owner can also appoint the Safe Sport lead, and has to name a Safe Sport alternate — a different person to escalate to on the day the lead is the one involved. - A club always keeps an owner. The last owner cannot be revoked.
Revoking takes a reason. The grant is kept in the record with that reason, the date and who revoked it. It is never deleted. Both are in your audit trail.
A brand-new club has nobody who can grant anything, so SwimWin support grants the first owner. Every role after that is granted from inside the club.
The roles
| Role | Holds |
|---|---|
owner | Everything in the club, including medical records and Safe Sport |
club_admin | Everything except medical records and Safe Sport |
membership_admin | Members, roster, medical summaries |
registrar | Members, roster |
treasurer | Billing, roster |
board_member | Roster, audit log |
front_desk | The gate, roster, medical summaries |
head_coach | Schedule, programs, broadcasts, roster, medical summaries |
coach | Schedule, roster, medical summaries |
assistant_coach, instructor | Roster, medical summaries |
lifeguard | Medical summaries |
lessons_admin, meet_director | Programs, schedule, roster |
facility_manager | Schedule |
safe_sport_lead | Safe Sport, full medical, safeguarding notes and their audit |
snack_bar, official, adult_athlete | No staff capabilities |
Three deliberate sharp edges
manage_waivers is narrow. Only owner and club_admin hold it — not the
registrar, who is the obvious guess. Chasing an unsigned waiver and rewriting the
release everyone already signed are not the same authority, and publishing a
version marked a material change invalidates every signature in the club.
Safeguarding notes belong to the Safe Sport lead alone. Not the owner, not the board. A safeguarding note is a sentence typed about a named child, and in a club where the treasurer is also a parent, a wider capability is neighbours reading about neighbours' children. The front desk's real need at 5:45am is answered by a structured contact restriction, not by somebody's prose.
Reading a medical record writes an audit row. Every time. A deck coach sees a
short summary; the full record needs read_medical and leaves a trace.
Families
Family access is not a role. It comes from belonging to a household: you see your own family and nobody else's. A caregiver — a nanny, a grandparent on the list — can collect a child and can be checked in at the gate, but cannot sign a waiver or message a coach. That line is a safeguarding decision, not a missing feature.
Platform operators
SwimWin staff have a separate platform flag that is never a club role. It opens the Admin area — a cross-club surface with its own navigation, reachable only by SwimWin staff — and on its own it grants nothing inside your club. What it can read across clubs is a narrow, read-only lookup, and every read is recorded.
When you ask support to fix something, an operator can work inside your club with your club's own screens. They confirm their password first (and again every 30 minutes), they act as SwimWin support rather than being added to your club, safeguarding notes need a stated reason, and every change shows in your audit trail as "SwimWin support · their name". They can also view your club as one member to see what that member sees — read-only, for at most an hour, and the member is emailed who looked and why. See Who can see a swimmer's details.