Skip to content

Users, Groups & Access Management

Travomate Cargo uses a flexible, group-based permission system for managing user access and visibility. Rather than hardcoded groups, permissions are defined through groups that inherit from each other, and visibility is controlled through field-level rules and assignment.

Overview

Core Concepts

Groups: Define sets of permissions and visibility rules. Groups can inherit from other groups.

Permissions: Specify which GraphQL queries and mutations a group can call, and which fields are relevant on the way in and out of each one.

Visibility Rules: Control which fields and instances are visible to users in a group.

Assignment: Instances are assigned to users/groups, determining who can access them.

Two-Sided Marketplace

Travomate Cargo connects:

  • Cargo Owners - Post goods for shipment, find capacity
  • Capacity Providers - Offer available shipping space, fulfill requests

Both groups have distinct permissions and default visibility rules upon signup.

Main Types

The GraphQL types most of this section refers to:

  • Listings - Cargo and Capacity postings
  • Conversations - Messages between parties, assigned to specific users
  • Shipments - Active bookings and tracking
  • Documents - Uploaded files and verification docs
  • User Profiles - Company and verification information

Looking for the security overview?

This section is the detailed access model. For a consolidated summary of authentication, authorisation, and data protection (the kind enterprise procurement asks for), see Security.

User Journey

  1. Sign up with Google Auth
  2. Auto-assigned to cargo_owner group
  3. Create business profile
  4. Create cargo listings (visible to capacity providers)
  5. Receive offers from capacity providers
  6. Create conversations with selected providers
  7. Manage shipments
  1. Sign up with Google Auth
  2. Auto-assigned to capacity_provider group
  3. Create business profile
  4. Create capacity listings (visible to cargo owners)
  5. Respond to cargo owner requests
  6. Create conversations with cargo owners
  7. Manage available capacity
  1. Created manually by platform (not self-signup)
  2. Assigned to admin group
  3. Can see all resources regardless of assignment
  4. Can modify visibility rules
  5. Can manage groups and permissions
  6. Can moderate content

State Management

Some types (CargoListing, Shipment) transition through states (draft, published, matched, shipped) that affect visibility and modifiability. This isn't a universal property of every type in the system (a user profile or a document doesn't have these states), and it's a type-level concern, not a user account concern. See State-Based Constraints for how a state locks specific operations, and Scope Changes With State for how it affects what's visible to whom.

Key Features

✓ Whitelist-Based Permissions - Groups explicitly list what they allow; unlisted actions are denied by default ✓ Multi-Group Assignment - Users can belong to multiple groups; effective permissions are the union ✓ Minimal Inheritance - Groups inherit from parents to avoid duplication; most groups are independent ✓ Field-Level Access - Permissions specify which fields are allowed for each operation ✓ Scope-Based Visibility - Control who sees which instances (own only, assigned, public, admin only) ✓ State Constraints - Operations can be restricted by resource state (e.g., only modify drafts) ✓ Admin Override - Admins bypass all restrictions and see everything

Permission Matrix Quick Reference

Resource Cargo Owner Capacity Provider Verified Provider Admin
Create Cargo Listing ✓ - - ✓
Create Capacity Listing - ✓ ✓ ✓
View Own Resources ✓ ✓ ✓ ✓ All
View Public Resources ✓ (capacity) ✓ (cargo) ✓ (cargo) ✓ All
See Assigned Messages ✓ ✓ ✓ ✓ All
Modify Published Resource ✓ ✓ ✓ ✓
Modify Matched Resource - - - ✓
Premium Analytics & Featured Listings - - ✓ ✓

This matrix covers the four default groups only. Each user account also has its own personalized version of this table (see Your Access Summary), and admins can define entirely new groups with their own rows; see Groups for the full, extensible list.

Next Steps

  1. Start with Groups to see the default groups and their permissions
  2. Learn Visibility & Privacy for instance and field-level access rules
  3. Review Sharing & Resource Assignment for how instances get shared
  4. Check Account & Group Lifecycle for signup, group changes, and each user's own access summary
  5. Developers and admins configuring the system should read Permission Model Reference and GraphQL Implementation