Live Guide | Role-Based Access Control

1.3 Role-Based Access Control (RBAC)

The Payvala platform follows a Role-Based Access Control (RBAC) model to ensure secure and controlled access to system functionalities across FI, Organization, and User levels.

Users can access only permitted features.

Critical actions require authorization.

Segregation of duties is maintained.

RBAC Overview

Level	Role Type	Description
Financial Institution Level	Financial Institution (Admin)	Manages Financial Institution configuration and integration.
Organization Level	Organization (Admin)	Manages merchants, users, and settings.
User Level	End Users (Care User)	Performs operational activities with limited access.

Role Assignment Screen

Role Selection

The user selects one or more permitted roles from the modal based on organization and operational scope.

Save

Save applies the selected role mapping and returns to the user-management view with the new access profile in place.

Cancel

Cancel closes the role modal and returns to the previous screen without changing the user’s current authorization set.

1.3.1 Access Control Rules

Core Enforcement

Least privilege principle is enforced.

Role-based restrictions are applied on APIs and UI.

Sensitive operations such as key generation and key rotation require approval.

Practical Outcome

Each user sees only the modules relevant to their assigned role.

Administrative actions remain restricted to authorized approvers.

High-risk functions stay traceable and tightly controlled.

1.3.2 Audit & Logging

All role-based actions are logged to support monitoring, compliance, and investigation of privileged operations.

User ID

Role

Action performed

Timestamp

Responsibility Matrix

FI Responsibility	Payvala Responsibility
Assign roles based on least privilege and segregation of duties.	Enforce RBAC across UI and APIs.
Review audit logs for sensitive operations and anomalous access.	Maintain audit trails and provide access via POEMS.