Every person has exactly one primary role. Permissions are managed with spatie/laravel-permission, and the admin can customise what an assistant coach may do.
| Permission | Technical owner | Admin / head coach | Assistant coach | Nutritionist | Trainee |
|---|---|---|---|---|---|
| Platform and infrastructure settings | ✅ | Own account settings only | ❌ | ❌ | ❌ |
| Approve registration requests | ❌ | ✅ | ❌ | ❌ | ❌ |
| Manage plans and pricing | ❌ | ✅ | ❌ | ❌ | ❌ |
| View trainee records | ❌ | ✅ | Assigned only | Assigned only | Own record |
| Build training programs | ❌ | ✅ | ✅ | ❌ | ❌ |
| Build nutrition plans | ❌ | ✅ | ❌ | ✅ | ❌ |
| Chat | ❌ | ✅ | ✅ | ✅ | With their coach |
| Full reports | ❌ | ✅ | Their trainees | Their trainees | Own report |
| Workspace activity log | ❌ | ✅ | Per permission | Per permission | Own activity |
| Page and video tracking | ❌ | ✅ | ❌ | ❌ | ❌ |
| Trainee invoices and payments | ❌ | ✅ | ❌ | ❌ | Own invoices |
| AI assistant | ❌ | ✅ | ✅ | ✅ | ✅ (limited) |
| Log daily data | — | — | — | — | ✅ |
Least privilege
A trainee sees only their own data. An assistant coach or nutritionist sees only assigned trainees and only within their discipline. The technical owner runs infrastructure and integrations and does not, by default, access trainee health data. Any exceptional support access must be temporary, justified, documented and audited.
Role shortcuts
| Role | Start here |
|---|---|
| Admin / head coach | Admin dashboard |
| Assistant coach | Trainee records |
| Nutritionist | Nutrition & calories |
| Trainee | Trainee dashboard |
| Technical owner | Architecture |