Roles, permissions and restrictions

Custom permission logic restricts supported IR documents by role and designation. Both list-query filtering and direct document permission checks are used for sensitive records. Creation validation prevents users from bypassing restrictions through direct links or API calls.

The effective role order is IR Manager, IR Officer and IR User, with the highest applicable role taking precedence.