Who may do what

Eleven roles, each holding a named set of things it may do. The system checks that list every time somebody tries one of them, so a role is not a job title with menus attached — it is the list, and the list is enforced.

Several of the boundaries exist for one reason: no single person should be able to carry a case from arrival to certificate. A case officer accepts and assigns but cannot assess or decide. A reviewer assesses but cannot decide the case they assessed. A benchmark custodian prepares the price evidence but cannot publish a version alone. An administrator runs the system and is deliberately not an officer of it — cannot assess, cannot decide, cannot publish benchmarks.

What an administrator cannot do

Two things, and both are refused by the system rather than left to good practice, because both would quietly undo everything above.

1. Change their own roleThe separation between running the system and being an officer of it is worth nothing if the same person can grant themselves the decision officer role for an afternoon, take a decision, and hand the role back. Another administrator makes the change, and it is recorded with the role the person held before it.
2. Suspend or deactivate their own accountThis one is the accident rather than the attack: an Office with no administrator who can get in. Again, another administrator can.

Joining, pausing, leaving

An account is invited, then active. Suspension is the reversible step — the one to use while something is being looked into — and it keeps the person's role and their history intact. Deactivation is final, and that is the deliberate part: nothing is ever deleted. A person who has left still decided the cases they decided, and a register that forgot them would leave an audit trail full of actions nobody performed. Somebody returning to the Office is a new grant of access, taken deliberately, not a switch put back.

Two changes that need somebody else

Publishing a benchmark version and changing a statutory parameter both need a second person, and neither can be expressed as a role. Several people hold the administrator role and several hold the assessment lead role, and one of them is always the person proposing the change — so the rule is not "who may do this" but "not the same person who asked for it".

1. A statutory parameterAn administrator proposes the new value, the date it takes effect from, the instrument behind it and why. It changes nothing until a second administrator agrees. Both names stay on the record, and the old value stays too — a case decided under it is still decided under it.
2. A benchmark versionA custodian prepares the new figure with its source and what has changed. The library keeps using the version it has until somebody who can publish — and who did not prepare it — puts the new one in use. A published figure is never edited in place, because assessments already made against it were made against the figure that was there at the time.