# FellaHost Company Limited
**Project Developers & Software Engineering Specialists**  
**Document Reference:** Section 24 Deliverables for Software Development Team  
**System Designation:** Integrated Clearing, Forwarding & Logistics System (ICFLS)  
**Corporate Entity:** FellaHost Company Limited  
**TIN NO:** 189-723-717 | **B.L.No:** 20000105272  
**Headquarters:** P.O. Box 80079, Dar es Salaam, Tanzania  
**Support Desk:** support@fellahost.co.tz | **Web:** www.fellahost.co.tz  
**System Deployment Host:** `logistics.domain.co.tz` | `api.domain.co.tz`  
**Publication Date:** September 2026 | **Version:** 1.0 (Production Master Engineering Pack)  

---
# 4. Role-Permission Matrix (RBAC & Segregation of Duties)

## Executive Overview
ICFLS enforces granular Role-Based Access Control (RBAC) and strict Segregation of Duties (SoD) across 9 user personas and 36 system capabilities to comply with customs, fiscal, and international compliance regulations.

---

## 4.1 Enterprise Role-Permission Capabilities Table

| Capability ID | Module / Feature Area | Admin / MD | Ops Manager | Declarant | Fleet Mgr | Finance | Field Agent | Driver | Auditor | Client |
| :--- | :--- | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| **AUTH-01** | Sign in with 2FA Identity Verification | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| **USER-01** | Create / Suspend Staff Accounts | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| **JOB-01** | Create New Consignment Job | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| **JOB-02** | Update Milestones & Status | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
| **CUST-01** | Lodge TANCIS Declaration | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| **CUST-02** | Override Customs Valuation | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| **TRAN-01** | Assign Vehicle and Driver | ✅ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
| **TRAN-02** | Issue Fuel & Expense Vouchers | ✅ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **CONT-01** | Update Container Interchange (EIR) | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
| **FIN-01** | Verify Customer Escrow Deposits | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **FIN-02** | Authorize & Dispatch Tax Payment | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **FIN-03** | Generate Commercial Invoice | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ |
| **AUD-01** | View System Security Audit Log | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ |
| **AUD-02** | Export Financial Reconciliation Pack | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ✅ | ❌ |
| **PORT-01** | View Public Consignment Tracking | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

---

## 4.2 Segregation of Duties (SoD) Constraints
1. **Rule SoD-01 (Invoicing vs. Job Creation)**: Operational personnel who create or manage a Consignment Job cannot generate, alter, or dispatch the final commercial invoice.
2. **Rule SoD-02 (Customs Payment vs. Declaration)**: The Declarant who lodges an assessment with TRA cannot authorize disbursement from the client's escrow funds.
3. **Rule SoD-03 (Audit Non-Tampering)**: The Security Audit Trail is immutable; even the System Administrator cannot delete or alter historical entries in `audit_logs`.

---

### Regulatory Notice
> **We're Top leading Company Registering under Commercial & Technical ICT Services TIN NO: 189-723-717**  
> *FellaHost Company Limited — Project Developers & Engineering Specialists.*  
> *Confidential & Proprietary Enterprise Asset — All Rights Reserved.*