Designing Region-Scoped RBAC for Statewide Government Platforms
Lessons from building four-tier, jurisdiction-aware role hierarchies digital-identity and permit systems in Nagaland and Haryana.
Government platforms don't just need roles — they need *jurisdiction*. A district administrator and a state-level administrator might use the same screen, but they must never see the same data. Building statewide systems for **Nagaland** and **Haryana Goverment** taught us that role-based access control (RBAC) at this scale is as much a data-modelling problem as a security one.
## A four-tier hierarchy
Our digital-identity and permit system used a strict chain:
1. **Super Admin** — full platform oversight
2. **Chief Admin** — state / top-tier scope
3. **Admin** — regional scope
4. **Agent** — on-the-ground registration
Each tier can provision the tier below it, and every account is bound to a jurisdiction — a region, district or village.
## Region-scoped access is a query concern
The mistake teams make is treating RBAC as purely a permission check ("can this user open this page?"). At government scale, the harder question is *"which rows is this user allowed to see?"*
> Every list, report and export is automatically filtered to the caller's assigned jurisdiction — there is no code path that returns data outside a user's scope.
We enforce this with middleware that resolves the caller's scope on every request and injects it into the data layer, so scoping can't be forgotten at the query site.
## Cascading provisioning
Because higher tiers create lower ones, account creation *cascades* the parent's jurisdiction downward. An Admin created under a particular district automatically inherits that district as their ceiling — they can never provision an Agent outside it.
## Everything is audited
For government delivery, an action isn't done until it's recorded. Applicant registration, Aadhaar/QR capture, permit issuance and fee configuration all write to an **audit log** with real-time reporting, so oversight bodies can trace exactly who did what, where and when.
## The takeaways
- Model jurisdiction as first-class data, not an afterthought
- Enforce scoping in the data layer, not just the UI
- Make provisioning cascade so scope can only ever shrink down the tree
- Treat the audit log as a feature, not plumbing
These patterns now underpin the multi-tenant, welfare and tourism platforms we deliver across states.
Have a project like this?
We build enterprise, government-scale and AI-integrated platforms end-to-end.
Start a project
