Simpler, Centralized Role-Based Access Control
We've completely rewritten the permissions system to use a single YAML configuration file as the source of truth for all role-based access control across the platform.
What Changed
- 22 distinct roles — from admin and seller to CPA, attorney, developer, lender, and regulator — each with precisely scoped access to projects, portfolios, proposals, and tax credits
- One file governs everything — adding or changing a permission means updating one YAML key, not hunting through scattered controller logic
- Automatic syncing — new accounts get correct permissions on creation; existing accounts update with a single rake task
- Sub-resource inheritance — child resources like transfer documents and term sheets automatically inherit their parent's permission rules
Why This Matters
The previous system had permissions scattered across controllers, policies, and database columns. This rewrite makes access control auditable, consistent, and easy to reason about — critical for a platform handling sensitive financial transactions.