This page defines the roles DomiDo recognises and the permissions each role carries across the visible application surface. Permissions are platform-neutral unless a later native-specific gate adds an explicit platform constraint, so the same role grants the same capability on web today and on native iOS or Android when those targets open. The matrices in this page sit alongside two cross-cutting constraints that apply to every grant. The first is that delivery-phase gates always evaluate before any permission grant: a role permission does not unlock Phase B capture, fulfilment, receipts, invoices, the build companion, or payout release while the corresponding feature is still in Phase A, Phase A.5 readiness, Phase C expansion, native-deferred, or blocked-or-read-only state. The second is that resource-evaluated permissions — labelled in the tables as Owner, Recipient, Participant, or Limited — are evaluated against the resource and the actor's relationship to it, not only against the actor's role. A signed-in designer does not get to edit another designer's listing simply because both are designers; the listing's ownership is the check that matters. Throughout the tables, "Support" means the staff role may assist or act through an auditable support workflow rather than freely mutating another user's data, and "Finance" means access is limited to the payment, tax, refund, return-fee, payout, statement, restriction, and dispute operations that make up the FinanceTrust scope.
DomiDo distinguishes a small number of named roles, each with a clear remit. A Guest is an unauthenticated visitor browsing the public home, gallery, listing, designer-profile, published Help, Workshop, legal, authentication, and footer surfaces. A User is a signed-in account holder with profile, preferences, saved listings, Phase A interest reservations, Phase A.5 and Phase B cart and Stripe checkout where active, pre-orders, orders, addresses, saved Stripe payment references, privacy controls, notifications, trust-challenge records, and support conversations. A Buyer is a signed-in User performing buyer commerce — Phase A interest reservation management, Phase A.5 no-capture pre-order management, and Phase B order management — and the buyer role is therefore a capability of User rather than a separate identity. A Designer is a signed-in User who creates drafts, publishes listings, generates Promo Studio media, manages Phase A.5 marketplace activation, projected royalties, ad boost, payout readiness and settings, statements, the disabled Phase A remix state, messages, and the designer action queue. A ListingOwner is a Designer who owns a specific draft or listing, and the listing-owner check is what gates listing-editor actions. A SupportStaff role is an authorised staff role for support conversations, order assistance, return-fee disputes, restriction challenges, and visible staff-assist contexts. A FinanceTrust role is an authorised internal role for payout, statement, tax, Know-Your-Customer, refund, return-fee, trust-restriction, and dispute workflows. An Admin is an authorised internal role for Workshop and Help content administration and the related audit review.
| Role | Description |
|---|---|
| Guest | Unauthenticated visitor browsing public home, gallery, listing, designer profile, published help, workshop, legal, authentication, and footer surfaces. |
| User | Signed-in account holder with profile, preferences, saved listings, Phase A interest reservations, Phase A.5 and Phase B cart and Stripe checkout where active, pre-orders, orders, addresses, Stripe payment references, privacy, notifications, trust challenges, and support conversations. |
| Buyer | A signed-in user performing buyer commerce: Phase A interest reservation management, Phase A.5 no-capture pre-order management, and Phase B order management. Buyer is a capability of User. |
| Designer | A signed-in user creating drafts, publishing listings, generating Promo Studio media, managing Phase A.5 marketplace activation, projected royalties, ad boost, payout readiness and settings, statements, the disabled Phase A remix state, messages, and the action queue. |
| ListingOwner | A Designer who owns a specific draft or listing. |
| SupportStaff | An authorised staff role for support conversations, order assistance, return-fee disputes, restriction challenges, and visible staff-assist contexts. |
| FinanceTrust | An authorised internal role for payout, statement, tax, KYC, refund, return-fee, trust restriction, and dispute workflows. |
| Admin | An authorised internal role for Workshop and Help content administration and related audit review. |
The public surfaces of DomiDo are open to every role. Anyone — signed-in or not — can view the public home, gallery, listing, designer-profile, Help, Workshop, and legal surfaces; can search the configured public scopes; can see the footer's locale, currency, social, and legal controls; can open the authentication modal; can sign in through Google, Apple, or Facebook OAuth; and can manage cookie preferences for the current session or account. Newsletter subscription is exposed to Guest and to all user-facing roles, but the internal staff roles do not subscribe on behalf of others.
| Permission | Guest | User | Buyer | Designer | ListingOwner | SupportStaff | FinanceTrust | Admin |
|---|---|---|---|---|---|---|---|---|
| View public home, gallery, listing, designer, help, legal surfaces | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Search configured public scopes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| View footer locale, currency, social, legal controls | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Open authentication modal | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Use Google, Apple, Facebook OAuth | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Manage cookie preferences for current session or account | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Subscribe to newsletter | Yes | Yes | Yes | Yes | Yes | No | No | No |
Anything that touches a personal account is the user's own to manage, with limited support-staff assistance available through an audited workflow and finance access scoped to money- and order-related views. A signed-in user manages their own profile, avatar, preferences, privacy, notifications, security sessions, lifecycle requests, saved addresses, and saved masked Stripe payment references (the latter when Phase A.5 or Phase B is active); SupportStaff can assist on those surfaces through the audited support workflow but never mutates them freely. Saving and unsaving listings, following and unfollowing designers, and starting support conversations are likewise user-initiated actions. Cart, checkout, and the saved-cart machinery exist only when Phase A.5 or Phase B is active, and within those phases the buyer manages their own cart and saved carts and runs Stripe-handled checkout themselves. Phase A interest reservation creation and cancellation belong to the User, with SupportStaff assistance available; viewing an interest reservation is broadened to FinanceTrust so the finance scope can analyse demand attribution.
Phase A.5 invited no-capture pre-orders are created by the buyer through Stripe SetupIntent. Viewing or cancelling a pre-order where state permits is the buyer's right, with SupportStaff and FinanceTrust able to read for the support and finance workflows. The same shape applies to Phase B orders: viewing, updating notification read state, retrying payment through Stripe, cancelling where state permits, updating delivery preferences where state permits, requesting return, replacement, or dispute, reporting an order issue, sending an order message, challenging a return fee or restriction, and viewing the captured order's receipt or invoice are all owned by the buyer with audited Support and Finance read access. The build companion is Phase B only: viewing it, updating progress, and uploading finished-build photos are the buyer's actions, with SupportStaff assistance available where needed.
| Permission | Guest | User | Buyer | Designer | ListingOwner | SupportStaff | FinanceTrust | Admin |
|---|---|---|---|---|---|---|---|---|
| Save or unsave listing | No | Yes | Yes | Yes | Yes | No | No | No |
| Follow or unfollow designer | No | Yes | Yes | Yes | Yes | No | No | No |
| Manage own profile, avatar, preferences, privacy, notifications | No | Yes | Yes | Yes | Yes | No | No | No |
| Manage own security sessions and lifecycle requests | No | Yes | Yes | Yes | Yes | Support | No | No |
| Manage own saved addresses | No | Yes | Yes | Yes | Yes | Support | No | No |
| Manage own saved masked Stripe payment references (Phase A.5 / B active) | No | Yes | Yes | Yes | Yes | Support | No | No |
| Create or cancel own Phase A interest reservation | No | Yes | Yes | Yes | Yes | Support | No | No |
| View own Phase A interest reservations | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| Add listing kit to own cart (Phase A.5 / B active) | No | Yes | Yes | Yes | Yes | No | No | No |
| Manage own cart (Phase A.5 / B active) | No | Yes | Yes | Yes | Yes | Support | No | No |
| Manage own saved carts and checkout drafts (Phase A.5 / B active) | No | Yes | Yes | Yes | Yes | Support | No | No |
| Checkout own cart through Stripe (Phase A.5 / B active) | No | Yes | Yes | Yes | Yes | No | No | No |
| Create own Phase A.5 no-capture pre-order through invited Stripe SetupIntent | No | Yes | Yes | Yes | Yes | No | No | No |
| View or cancel own Phase A.5 pre-order where state permits | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| View own orders | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| View and update own order notification read state | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| Retry payment on own order through Stripe | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| Cancel own order where state permits | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| Update own delivery preferences where state permits | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| Request own return, replacement, or dispute | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| Report own order issue or send own order message | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| Challenge own return fee or restriction | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| View own receipt or invoice for Phase B captured order | No | Yes | Yes | Yes | Yes | Support | Finance | No |
| View own build companion in Phase B | No | Yes | Yes | Yes | Yes | Support | No | No |
| Update own build progress in Phase B | No | Yes | Yes | Yes | Yes | Support | No | No |
| Upload own finished-build photos in Phase B | No | Yes | Yes | Yes | Yes | Support | No | No |
| Start support conversation | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No |
Any signed-in user can start a design draft and run it through the five create stages, but the draft is theirs alone: resuming a saved draft, editing the Describe data, generating or restoring projection faces, generating or selecting model tryouts, submitting model-generation feedback, generating or reviewing the block kit, and saving the draft are all Owner-scoped — the actor must be the draft's author. Publishing a valid draft is reserved to the Designer role and to the ListingOwner who carries listing ownership. Once a listing exists, listing-editor actions sit under listing ownership: editing the listing, changing visibility, acknowledging the Phase A disabled-remix notice, requesting a moderation rerun, requesting a platform-owned copy change, and viewing the listing's status notes are all the owner's actions, with SupportStaff able to assist through the audited workflow. Royalty-percent changes between zero and twenty-five and ad-boost setting changes are owner actions but route their finance impact through FinanceTrust visibility rather than SupportStaff. Viewing the listing editor aggregate, moderation, similarity, and analytics is broadened to FinanceTrust so commerce questions can be answered.
Promo Studio is a listing-scoped capability that only the ListingOwner can open and operate. Updating the scene, generating photo and video assets, downloading the resulting private assets, downloading all authorised assets, and adding an asset to the listing gallery are owner actions, with SupportStaff allowed to assist on download and add-to-gallery actions through the audited workflow. Public listing media added from Promo Studio is, of course, visible to everyone — that is the point of publishing it.
| Permission | Guest | User | Buyer | Designer | ListingOwner | SupportStaff | FinanceTrust | Admin |
|---|---|---|---|---|---|---|---|---|
| Start design draft | No | Yes | Yes | Yes | Yes | No | No | No |
| Resume own saved draft or generation | No | Owner | Owner | Owner | Owner | No | No | No |
| Upload own draft media | No | Yes | Yes | Yes | Yes | No | No | No |
| Edit own draft Describe data | No | Owner | Owner | Owner | Owner | No | No | No |
| Generate or restore projection faces for own draft | No | Owner | Owner | Owner | Owner | No | No | No |
| Generate or select model tryouts for own draft | No | Owner | Owner | Owner | Owner | No | No | No |
| Submit own model generation feedback | No | Owner | Owner | Owner | Owner | No | No | No |
| Generate or review block kit for own draft | No | Owner | Owner | Owner | Owner | No | No | No |
| Save own draft | No | Owner | Owner | Owner | Owner | No | No | No |
| Publish own valid draft | No | No | No | Yes | Yes | No | No | No |
| Edit own designer listing | No | No | No | Owner | Owner | Support | No | No |
| View own designer listing editor aggregate | No | No | No | Owner | Owner | Support | Finance | No |
| Change own listing visibility | No | No | No | Owner | Owner | Support | No | No |
| Change own listing royalty 0–25 | No | No | No | Owner | Owner | No | Finance | No |
| Acknowledge Phase A disabled-remix notice | No | No | No | Owner | Owner | Support | No | No |
| Change own ad-boost settings | No | No | No | Owner | Owner | No | Finance | No |
| Request moderation rerun for own listing | No | No | No | Owner | Owner | Support | No | No |
| View own listing moderation, similarity, analytics | No | No | No | Owner | Owner | Support | Finance | No |
| Request platform-owned copy change | No | No | No | Owner | Owner | Support | No | No |
| View listing status notes | No | No | No | Owner | Owner | Support | No | No |
| Open Promo Studio for own listing | No | No | No | Owner | Owner | No | No | No |
| Update own Promo Studio scene | No | No | No | Owner | Owner | No | No | No |
| Generate own Promo Studio photo and video assets | No | No | No | Owner | Owner | No | No | No |
| Download own private Promo Studio assets | No | No | No | Owner | Owner | Support | No | No |
| Download all authorised Promo Studio assets | No | No | No | Owner | Owner | Support | No | No |
| Add own Promo Studio asset to listing gallery | No | No | No | Owner | Owner | Support | No | No |
| View public listing media added from Promo Studio | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
The designer commerce surfaces are organised so a designer sees only their own statements, sales, and payout posture, while SupportStaff and FinanceTrust can read those surfaces through their respective audited workflows. Viewing the designer dashboard, the attributed pre-orders and projected royalties, the payout readiness, the sales-and-earnings summary, the statement archive, the payout-transfer ledger, the reserve ledger, the sale dispute, and the designer action queue are all designer-and-owner actions with read-only Support and Finance access. Exporting statements is gated on Phase B money movement existing. Starting Stripe Connect onboarding, updating the payout option, updating the payout schedule or pause state, requesting a payout when Phase B release-eligible, updating Value-Added-Tax, Unique Taxpayer Reference, or tax region, retrying a failed payout via the authorised handoff once money movement exists, and exporting the tax statement are all designer-and-owner actions where FinanceTrust may act in scope but SupportStaff does not.
Engagement on the designer side is resource-scoped. Replying to designer messages is a Recipient action — the actor must be the message thread's recipient — with SupportStaff able to assist. Replying to reviews, answering questions, and creating FAQ candidates on a designer's own listings are Owner actions on the listing. Reporting nodes in a designer message thread is a Participant action on the thread. Submitting designer claim actions is owner-scoped and visible to Finance for review. Creating an active remix or split is universally denied during Phase A — no role, including Admin, can create remix economics while the feature is closed.
| Permission | Guest | User | Buyer | Designer | ListingOwner | SupportStaff | FinanceTrust | Admin |
|---|---|---|---|---|---|---|---|---|
| View own designer dashboard | No | No | No | Yes | Yes | Support | Finance | No |
| View own attributed pre-orders, projected royalties, payout readiness | No | No | No | Yes | Yes | Support | Finance | No |
| View own sales, earnings, payout summary | No | No | No | Yes | Yes | Support | Finance | No |
| Export own statements (Phase B money movement exists) | No | No | No | Yes | Yes | Support | Finance | No |
| View own statement archive | No | No | No | Yes | Yes | Support | Finance | No |
| Start Stripe Connect onboarding | No | No | No | Yes | Yes | No | Finance | No |
| Update own payout option | No | No | No | Yes | Yes | No | Finance | No |
| Update own payout schedule or pause state | No | No | No | Yes | Yes | No | Finance | No |
| Request own payout when Phase B release-eligible | No | No | No | Yes | Yes | No | Finance | No |
| Update own VAT, UTR, tax region | No | No | No | Yes | Yes | No | Finance | No |
| View own payout transfer ledger | No | No | No | Yes | Yes | Support | Finance | No |
| Retry own failed payout via authorised handoff (after money movement exists) | No | No | No | Yes | Yes | No | Finance | No |
| View own reserve ledger | No | No | No | Yes | Yes | Support | Finance | No |
| View own designer sale dispute | No | No | No | Yes | Yes | Support | Finance | No |
| Export own tax statement | No | No | No | Yes | Yes | No | Finance | No |
| View own action queue | No | No | No | Yes | Yes | Support | Finance | No |
| Reply to own designer messages | No | No | No | Recipient | Recipient | Support | No | No |
| Reply to reviews on own listings | No | No | No | Owner | Owner | Support | No | No |
| Answer questions on own listings | No | No | No | Owner | Owner | Support | No | No |
| Create FAQ candidates from own listing Q&A | No | No | No | Owner | Owner | Support | No | No |
| Report designer message-thread nodes | No | No | No | Participant | Participant | Support | No | No |
| Submit designer claim actions | No | No | No | Owner | Owner | Support | Finance | No |
| Create active remix or split in Phase A | No | No | No | No | No | No | No | No |
Return assessments and return-fee decisions are staff actions: creating a return assessment or fee is a SupportStaff or FinanceTrust capability, not a buyer or designer one. The buyer can view their own assessment and challenge their own return fee, with Support and Finance able to read and act on the challenge. Trust restrictions sit outside ordinary role grants: creating or updating a blacklist or trust restriction is Limited to SupportStaff and FinanceTrust acting within the authorised trust workflow, and resolving a restriction challenge is similarly Limited. The user the restriction applies to can view their own restriction-challenge state but cannot edit the restriction itself.
| Permission | Guest | User | Buyer | Designer | ListingOwner | SupportStaff | FinanceTrust | Admin |
|---|---|---|---|---|---|---|---|---|
| Create return assessment or fee | No | No | No | No | No | Support | Finance | No |
| View own return assessment | No | Owner | Owner | Owner | Owner | Support | Finance | No |
| Challenge own return fee | No | Owner | Owner | Owner | Owner | Support | Finance | No |
| Create or update blacklist or trust restriction | No | No | No | No | No | Limited | Limited | No |
| View own restriction challenge state | No | Owner | Owner | Owner | Owner | Support | Finance | No |
| Resolve restriction challenge | No | No | No | No | No | Limited | Limited | No |
The Help and Workshop content surface is editorial, and the editorial mutation rights belong exclusively to Admin. Only Admin can create, update, publish, unpublish, archive, delete, or reorder Help content, and only Admin can reorder Help topics or featured content; no other role — including SupportStaff and FinanceTrust — can mutate that surface. Reading published Help, Workshop, and legal articles is open to everyone, and submitting Help article comments, replies, likes, and reports where the discussion feature is enabled is available to Guest as well as every signed-in user-facing role, with SupportStaff and FinanceTrust able to act through the audited support and discussion workflows. Submitting a support request is available to Guest and to every user-facing role; viewing one's own support conversation is Owner-scoped, with Support and Finance read access for the workflow.
Audit access mirrors the resource-scoped pattern. Audit events for one's own order timeline are visible to the order's owner — User, Buyer, Designer, or ListingOwner depending on the role of the order's owner — with Support and Finance read access for the workflow. Audit events for one's own designer payout or listing are visible to the Designer and ListingOwner who owns the resource, with Support and Finance read access. Help-content audit events are visible to Admin, with Limited SupportStaff and FinanceTrust access through the audited review workflow. Cross-user operational audit events are Limited across SupportStaff, FinanceTrust, and Admin — no role gets a free view of cross-user audit data, and every staff read of an audit event is itself an audited event.
| Permission | Guest | User | Buyer | Designer | ListingOwner | SupportStaff | FinanceTrust | Admin |
|---|---|---|---|---|---|---|---|---|
| View published help, workshop, legal articles | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Submit help article comments, replies, likes, reports (where enabled) | Yes | Yes | Yes | Yes | Yes | Support | Finance | No |
| Create, update, publish, unpublish, archive, delete help content | No | No | No | No | No | No | No | Yes |
| Reorder help topics or featured content | No | No | No | No | No | No | No | Yes |
| Submit support request | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No |
| View own support conversation | No | Owner | Owner | Owner | Owner | Support | Finance | No |
| View audit events for own order timeline | No | Owner | Owner | Owner | Owner | Support | Finance | No |
| View audit events for own designer payout or listing | No | No | No | Owner | Owner | Support | Finance | No |
| View help-content audit events | No | No | No | No | No | Limited | Limited | Yes |
| View cross-user operational audit events | No | No | No | No | No | Limited | Limited | Limited |
Several rules apply uniformly across the matrices above. Resource-scoped grants — Owner, Recipient, Participant, and Limited — are evaluated against the resource, not only against the signed-in user's role; the role is necessary but not sufficient, and the resource relationship is the binding check. Staff and finance access is audited and is limited to the support, refund, return-fee, payout, tax, dispute, trust, or listing-state workflows that the role exists to perform. Private data — including private draft media, model feedback, private Promo Studio scenes and assets, private listings, saved carts, checkout drafts, pre-orders, order notifications, order tracking, order action attachments, saved addresses, saved Stripe payment references, payout, tax, reserve, and dispute settings, trust-restriction data, support conversations, and statement exports — is not visible to unrelated users.
The designer-buyer boundary is enforced symmetrically. Designers never see buyer payment credentials or buyer private account details beyond what is required for the statement or order royalty context. Buyers never see designer payout-account details, tax identifiers, or private designer messages. The admin boundary is similarly strict: only Admins may mutate Workshop and Help content, and the discussion permissions for Help comments, replies, likes, and reports are not Help content administration permissions even though they sit on the same surface. Finally, the delivery-phase gates evaluate before any permission grant. A role permission does not make Phase B capture, fulfilment, receipts or invoices, the build companion, or payout release available while the feature is Phase A, Phase A.5 readiness-only, Phase C expansion, native-deferred, or blocked-or-read-only.