Budi SetiawanAndi Pratama (you)Maya KusumaYusuf HidayatDewi Lestari

Active Invited Expired

budi.setiawan@insurance.test · Surabayaandi.pratama@insurance.test · Head officeandi.pratama@insurance.test · Surabayamaya.kusuma@insurance.test · Head officeyusuf.hidayat@insurance.test · Surabayadewi.lestari@insurance.test · Head office

Member

Name: Budi SetiawanAndi PratamaMaya KusumaYusuf HidayatDewi Lestari
Email: budi.setiawan@insurance.testandi.pratama@insurance.testmaya.kusuma@insurance.testyusuf.hidayat@insurance.testdewi.lestari@insurance.test
Branch: SurabayaHead office
Supervisor: Dewi LestariAbove this branch–Andi Pratama
Status: ActiveInvitedExpired
Invitation expires: 19 Oct 2026, 14:30 WIB
Invitation expired: 05 Oct 2026, 09:12 WIB

Roles

Adjuster
Admin Admin
Manager
Surveyor

What this Member can do at their branch. They need at least one Role.

Dewi Lestari's Roles savedManager. It applies on their next action.

Budi Setiawan's Roles savedSurveyor and Adjuster. It applies on their next action.

Needs membership.read: without it, the 404 block. The panel reads the Member's row from GET /api/org-chart, the list's own answer: name, email, branch, Roles, Supervisor (by Membership id, named from the rows held) and status, with the Invitation's expiry from expiresAt. An id the answer doesn't hold (another root's, out of the Scope, or ended) is the 404 block.
Change Roles needs membership.update ("Assign Roles and set the Supervisor"); without it the panel is read-only. It opens a dialog over the panel whose picker lists the root's fifteen Roles from GET /api/roles, by name; the "Admin" chip marks a Role holding an administrative Permission.
Save Roles sends PUT /api/memberships/{id}/roles {roleIds}, the whole set replacing the held one; it needs membership.update and works on an Invitation, open or expired, as on a Membership.
Main checks in this order: 404 NOT_FOUND (outside the Scope, ended, or a Role of another root); 409 ORGANISATION_LAST_ROLE (an empty set); 409 ORGANISATION_LAST_ADMIN (dropping Admin from the root's last Admin); then, for the Roles being added only, 403 ORGANISATION_ADMIN_ROLE_ROOT_ONLY (a Role holding an administrative Permission, from a branch) and 403 ORGANISATION_SELF_GRANT (any Role, to your own Membership). Removing one of your own Roles is never refused; an Admin acting at head office may add to their own.
The dialog keeps the last three from happening: an empty set disables Save Roles under the picker's own error; from a branch an Admin-marked Role the Member doesn't hold is disabled; on your own Membership at a branch every Role you don't hold is disabled. ORGANISATION_LAST_ADMIN is shown as main's text at the top of the dialog.
Saved: the dialog closes, the Roles card shows the set the answer returns, and a toast says so. The change applies on the Member's next request, and the audit log records each Role given and taken. Progress shows on Save Roles only.
Role changes apply at once, as main does. Spec #894 / ticket #912 will make giving a Role holding an administrative Permission (an Admin's own included) wait for a second Admin once the company has two approvers; that waiting state is not drawn until #184 is grilled.
Not drawn, waiting for #184's grilling: Remove, Resend and Revoke an Invitation, and changing the Supervisor.

Laid out by the detail rule, as Policy's and the fraud case's: a read-only side panel over Members, the back arrow left, the name with its status chip and the email and branch under it, Change Roles on the right, two titled cards side by side from 64rem.
A Member's Roles change in a dialog, as the newer Operators mockup draws it, not on the old mockup's page; the old mockup's copy is kept where main has none.
Drafted: "Loading the Member…", "Change your Roles" as the dialog's title on your own row, "You can still remove a Role you hold, as long as one is left.", "Above this branch" for a Supervisor the branch's answer doesn't hold, and "Invitation expires" / "Invitation expired".
The saved toast's "It applies on their next action." makes the old mockup's "his" neutral; its title names the Member in full.
"(you)" sits beside your own name in the tertiary weight; the Status row repeats the head's chip.
The last-Admin refusal is drawn in sequence: Andi Pratama first takes Admin from Dewi Lestari, the company's other Admin at head office, which saves while he stays one; then, unticking Admin on his own Membership, he would leave the company with none, so main refuses it. Each step is its own state.
Only Budi Setiawan's dialog at head office draws Saving and Saved; Save Roles in the other dialogs closes them back to their panel.
From a branch and your own at a branch are drawn as states of the Admin acting at Surabaya; in the app they follow the Active Organisation. Read-only is drawn as a state too; switch Signed in as for a Person without the key.
Cancel is an outline button; the close X in the title row is borderless, as the prototype's task dialogs have it.

#184 → comment: a Member is a read-only side panel over the Members list, and Change Roles a dialog over it saved as the whole set; /settings/organisation/members/{id} opens the list with the panel open. The old mockup's page with its own Save goes.
#184 → comment: from a branch only an Admin-marked Role the Member doesn't already hold is disabled, so a set that already holds one still saves; the old mockup disabled every Admin-marked Role.
#184 → comment: on your own Membership at a branch, only the Roles you don't hold are disabled and you may untick one you hold, under main's "You can't assign Roles to yourself."; the old mockup disabled every box and Save Roles.
#184 → comment: an Invitation's Roles change exactly as a Member's, open or expired; the old mockup drew Active Members only.
#184 → comment: main's texts, not the old mockup's: "An active Member must keep at least one Role." under the picker, and the last-Admin refusal "The Organisation must keep at least one Admin. Make someone else an Admin first.", a state the old mockup lacks.
#184 → comment: the "Admin" chip marks only Roles holding an administrative Permission, which on main is Admin alone; the old mockup also marked Auditor.

Members is a minimal list from the built GET /org-chart, a row opening the Member; Remove, Resend, Revoke and Supervisor editing wait for #184's grilling. (12 Oct 2026)
A Member's Roles are changed in a dialog, "Change Roles", over the Member's read-only side panel, saved as the whole set. (12 Oct 2026)
Role changes apply at once, as main does; the wait for a second Admin under #894 / #912 is not drawn until #184 is grilled. (12 Oct 2026)
No access is the 404 block in the content section. (12 Oct 2026)

From main's GET /org-chart, GET /roles and PUT /memberships/{id}/roles with their error texts; roles-and-permissions.html (Member's Roles) for the copy; operator-console.html (Change Roles) for the dialog; the side panel from policy.html

Page not found

Page not found

Change Budi Setiawan's RolesChange your RolesChange Maya Kusuma's RolesChange Yusuf Hidayat's RolesChange Dewi Lestari's Roles