Accounts and roles

• Public visitor: public pages only.
• Read-only researcher: can view workspace records but not change them.
• Researcher: manages their own samples, submissions, and experiments.
• Research collaborator: contributes to shared experiments and datasets.
• Reviewer: reviews results, governance records, and mitigation proposals.
• Dataset manager: curates datasets, labels, and access levels.
• Administrator: manages users, roles, engine controls, and audit.

Access is defined in a single role-by-resource permission matrix (view, create, update, delete, approve, export). High-impact actions such as approving an agentic mitigation require an explicit approve permission, and every approval is written to the audit log.

Sign-up, login, and password reset screens are complete, with validation and rate limiting. Sessions are currently demonstration sessions held in a cookie so that each role's view can be tested. No personal data is stored on a server at this stage.

When the backend returns, sign-in moves to Supabase Auth with signed sessions, and the role on each account is controlled only by administrators.