Role-based privileges with relationship scoping
Every permission must be checked on the server against both the role and the exact case assignment. A sponsor's HR manager can see only permitted candidates assigned to that employer. A recruiter's view is not a legal-file view.
Inspect a persona
Effective access summary
Low-friction email → secure request → staff review
The sponsor should not need to manage a second dashboard for occasional document exchanges. An email contains a single-purpose, short-lived request link. The link must be individually issued by a real backend, never a shared permanent URL.
Request preview and workflow
What applicants and sponsors should actually see
Applicant Portal
VIEW Current published stage, upcoming actions, requested documents, approved interview dates, personal payment schedule.
SUBMIT Form answers, own/family documents, corrections and questions.
NOT AVAILABLE Internal legal assessments, sponsor financials, other applicants, changing final immigration statuses.
Sponsor HR
VIEW Assigned applicants' employer-approved CVs, interview outcomes, document request statuses, workforce plan.
SUBMIT Employer evidence, salary/job change proposal, interview decision, requested signatures.
NOT AVAILABLE Passport files by default, applicant private payments, other sponsors' cases or direct legal approval.
Recruiter / Agent
VIEW Attributed applicants, approved referral stage, commission eligibility and verified settlement records.
SUBMIT Referrals, permitted corrections, supporting evidence, payment details under verification.
NOT AVAILABLE Employer tax returns, unrelated applicants, internal attorney notes, unilateral commissions.
One person can have multiple relationships, but not unlimited access
Employer → Applicants
Employer ID and approved case-assignment ID determine which people appear in an HR view. Application stage alone grants no access.
Recruiter → Referrals
Attribution table stores recruiter and applicant link, originating source, assignment approval, start/end times and commission contract version.
Applicant → Household
Main applicant and accompanying family have separate identity and documents, with controlled family-member permissions.
Attorney → Case Assignment
Assigned attorney has explicit case access, with separate financial, identity, evidence and privileged-legal note scopes.
user_id · organization_id · employer_id · applicant_id · household_member_id · case_id · recruiter_id · relationship_id · document_id · document_version_id · access_grant_id · request_id · approval_id · communication_id · audit_event_id
Blocking requirements before real client data
These are implementation requirements—not completed capabilities. Real role enforcement, request tokens, sensitive-file storage and audit recording must be implemented and penetration-tested before sponsor onboarding.