09 — User Behaviour (RBAC Module)

• 1. Core state machine (all lists)
• 2. Data freshness rules
• 3. Permission propagation (the critical behaviour)
• 4. Destructive actions
• 5. Offline behaviour
• 6. Concurrency / multi-admin
• 7. Empty / zero states
• 8. Rate limiting
• 9. Session expiry mid-edit
• 10. Behaviour by persona (summary)

Behavioural rules for the RBAC surface: state machines, refresh, caching, offline, destructive paths, and the permission-change propagation story. Server rules quoted from rbac.service.ts / rbac.guard.ts; client conventions from 00-shared/06.

1. Core state machine (all lists)

Initial → Loading → Success(Empty) ─┐
            │                       ├→ Content
            └→ Error(ApiException) ←┘
  Error → Retry → Loading
  Success → PullToRefresh → Loading(background, keep content)

Per 00-shared/06 §3.1; screens never render blank.

2. Data freshness rules

3. Permission propagation (the critical behaviour)

Derived from source — three different latencies:

UI behaviour:

• After saving a role's permissions, the editor shows: "Permissions apply to holders within 5 minutes; role claims refresh at next login." (info banner).
• Route-tree rebuild (05 §9) happens on login/permission refresh — not on RBAC writes by a different admin (no server push event exists; OQ-R9).
• Removing/deleting while own token holds the affected role → post-save hint + offer "Refresh session" (re-login) — else the UI may show screens the server now denies.

4. Destructive actions

No optimistic deletes with undo: deletes are irreversible-enough (soft-delete but no restore endpoint — rbac.service.ts:106,139) → server-confirm then remove row (00-shared/03 F rule: irreversible ops are never optimistic).

5. Offline behaviour

• Reads: last-good cache renders + AppOfflineBanner; all write CTAs disabled with tooltip "Connect to retry" (no offline write queues for RBAC — 00-shared/12 C3).
• Stale matrix: if editor opened offline, matrix renders from 24 h permission cache and 5 min role cache; Save blocked; on reconnect → refetch + compare (banner "Permission catalog updated" if diff).

6. Concurrency / multi-admin

• Two admins editing the same role: last-writer-wins ($set whole doc, rbac.service.ts:96; version field exists in base.schema.ts:30-31 but no optimistic lock is enforced on role update — OQ-R10). Mitigation: client shows "edited elsewhere" on conflict only if the fetched doc differs at save time — refresh detail before save when the screen has been backgrounded > 5 min.
• Duplicate member add across two admins: server 500 (E11000, OQ-R5) — client shows conflict copy + refreshes list.

7. Empty / zero states

• Roles: system section always renders (7 seeded roles, role.schema.ts:8-65); custom section empty-state.
• Members: "No members yet — add your first member." (org_admin always exists in practice — created at registration auth.service.ts:88-91).
• Matrix search: "No permissions match 'xyz'".
• Audit: "No activity recorded" (empty meta.totalItems === 0).

8. Rate limiting

• /rbac/* uses the default api tier, 100/min (rate-limit.guard.ts:36-37); audit default too. Enforcement only in production (rate-limit.guard.ts:30).
• 429 → AppBanner countdown + backoff, no auto-retry (00-shared/06 §5).

9. Session expiry mid-edit

• 401 during Save → silent refresh → retry once → failure: preserve form state in memory, route to login with "re-login to continue" snackbar; matrix selections survive re-login (state held by cubit, 13 §2).

10. Behaviour by persona (summary)