Validasi TOR: User SKAI → UKA → role. Pemberian akses via User SKAI (PN HC / BRIGate). Jejak perubahan akses tercatat di audit trail.
* CRUD/A mengikuti ownership proyek
| Modul | Admin | Admin UKA | ASQ | Auditor | Man. UKA | Auditee |
|---|---|---|---|---|---|---|
| Universe / PAT | R | R UKA | CRUD* | R | A | — |
| EWP MAPA/KKPA/KKPT | R | R UKA | R | CRUD* | A | — |
| LHA auditor | R | R | R | CUD* | A | — |
| LHA Auditee | — | — | — | — | — | R + disposisi |
| Reference | CRUD | CRUD terbatas | R | — | R | — |
| Catalog | R | R UKA | R | R | R | — |
| Security logs | R | — | — | — | — | — |
| Audit trail | R | — | — | — | — | — |
Maker ≠ checker ≠ signer pada dokumen yang sama. Reset approval tercatat.
Role hanya mendapat menu/aksi yang dibutuhkan; data dibatasi UKA.
CRUD mengikuti anggota tim proyek. Auditor lain: baca sesuai kebijakan restricted case.
Unmask data sensitif dan override akses memerlukan dua pihak yang berwenang.
| Event | Mekanisme |
|---|---|
| Joiner | Cari PN HC via BRIGate → map UKA → pilih role → aktif |
| Mover | Ubah UKA/role; cabut privilege modul lama |
| Leaver | Nonaktif User SKAI; sesi SSO dicabut |
| Emergency | Admin mencabut role; tercatat di audit trail |