Who sees what

Toutadmin has no permission matrix to tick. It has two roles, four cross-cutting rights, a line management deduced from the organisation, and one simple rule: a space refuses entry before loading a single piece of data. This page lists every rule, exactly as it is written in the code.

The principle#

The checks are not scattered across the screens. They sit in one place — src/middleware/ on the Node side, App\Core\Kernel on the PHP side — crossed by every request before routing. The whole access policy can therefore be read in one go, and a new page cannot be forgotten.

When access is refused, the product does not say why: it sends you back to your own space with a neutral message. A talkative error would teach a curious visitor that the screen exists and which right it would take.

The two roles#

What administration does not see#

Three deliberate exceptions, where being an administrator is not enough:

• Whistleblowing reports. A report may be about an administrator. Only the appointed officers read the reports; administration appoints them and reads nothing there.
• A vault locker opened with an access code. A session opened with a code is never a management session, whoever is behind the account.
• The spaces reserved for staff. /mon-espace and /agenda send administration back to its dashboard: an administration account has no leave balance, no manager and no payslip.

The four cross-cutting rights#

They are granted from Administration → Rights, one at a time, to a named member. Each block shows its scope before you click: a right is granted knowing what it opens.

A right is additive: it opens a space, it closes none. A member can hold several. Administration holds them all implicitly — except for the three exceptions above.

Line management, which is not a checkbox#

There is no "manager" box. You manage because you have been appointed head of a department or a team in the organisation. The /mon-equipe space opens to whoever heads at least one of them, and the list of people it shows is exactly the people in those — not one more.

A manager gets, over their own perimeter only:

• approval of their team's leave and requests;
• the one-to-ones;
• write access to the schedule;
• the /qualite space;
• writing in the knowledge base.

Steering#

/pilotage looks at the whole company: it opens to administration, to finance and to HR. It is the only screen whose access is the union of two rights rather than one of them.

Open to read, reserved to write#

Four spaces distinguish the HTTP verb rather than the space: seeing is open, acting is not. This is the opposite of a hidden screen — a schedule nobody can read is of no use to anyone.

Administration only, with no delegation possible#

The spaces with two locks#

Seven spaces belong to optional modules. They require two conditions: the module switched on, and the right. When the module is off, the page does not answer "access denied" — it answers 404. A module that is off does not exist; there is nothing to infer from it.

The works council#

The /cse space opens to all employees; /cse/gestion to elected members only. Being an administrator changes nothing there: you are elected or you are not.

The signature book#

Everyone sees and signs the documents that concern them. Creating a signature request, withdrawing one, or looking at other people's supposes the HR right or administration.

What a member cannot change themselves#

Three fields can be changed by administration alone, in every version, and do not even appear in the profile:

• The mail address — it is the login identifier.
• The IMAP and SMTP settings of the account.
• Removal from the directory — a company directory you can remove yourself from is no longer a directory.

The member keeps control of their password, their photo, their bio, their phone number, their display language and their two-factor authentication.

Checking a rule rather than assuming it#

The policy fits in one file. To read the rule that applies to a path:

# PHP edition
grep -n "/pilotage" app/Core/Kernel.php

# Node edition
grep -rn "/pilotage" src/middleware/

Both editions carry the same rules, written twice and checked by the same scenarios: for every reserved space, the test suite contains a case that attempts entry with an account that has no right to it and requires the refusal.

Toutadmin documentation — built on 2026-09-13. A standalone site, independent of the software.