| Role | Credential | How it is obtained | Status |
|---|---|---|---|
| Organizer | Manage code | Generated when the event is created, stored hashed; 8 wrong tries in 10 minutes triggers brute-force throttling, correct tries never count | Live |
| Assistant | Assistant key | Issued by the organizer in the console, stored hashed; the organizer can reset it to revoke | New in this spec · To build |
| Referee desk | No credential of its own | Opens via the event link, reads public data, checklist state stays on the device; score writes still go through the console | Live (read-only form) |
| Player · unbound | Light claim (tap your name on the roster) | Tap to claim, no password; enough to read and speak, never to change state | Live |
| Player · bound | Google account bound to player_id | One roster identity binds one Google account, first come first served; the organizer can unbind with the manage code as a fallback; a verified email is also bound as the recovery anchor | Decided 2026-11-03 · To build |
| Spectator / big screen | None | Public links. Note: the tournament ID in a screen link is an address, not a credential — it only has read paths, so it is not a permission surface | Live |
| Calling recovery | rt token | Calling actions only, 48-hour expiry, stored hashed | Verification live Issuance pending repair |
The MCP server follows the same table: organizer tools require the manage code (same column as the organizer), player tools are public reads. Platform back-office surfaces (docs / ideas / import) use a separate X-API-Key, unrelated to tournament permissions, and are outside this matrix.
| Action | Organizer | Assistant | Player · unbound | Player · bound | Spectator / screen |
|---|---|---|---|---|---|
| View draw, schedule, roster | ✓ | ✓ | ✓ | ✓ | ✓ |
| View calling status | ✓ | ✓ | ✓ | ✓ | ✓ |
| Edit event settings (name, venue, contact, format) | ✓ | — | — | — | — |
| Lock / unlock the event | ✓ | — | — | — | — |
| Edit roster (add, remove, rename players) | ✓ | — | — | — | — |
| Generate draw / reschedule matches | ✓ | — | — | — | — |
| Enter scores, advance winners | ✓ | ✓ | — | — | — |
| Calling actions (call, skip, re-call, and the rest) | ✓ | ✓ | — | — | — |
| Broadcast / send notifications, reply as the organizer | ✓ | — | — | — | — |
| Raise an appeal / reply in a thread (own thread only) | — | — | ✓ | ✓ | — |
| Check in, withdraw, confirm a score (own matches only) Decided · To build | — | — | — | ✓ | — |
| Read the activity log | ✓ | — | — | — | — |
| Delete the event | ✓ | — | — | — | — |
| Issue / reset the assistant key New · To build | ✓ | — | — | — | — |
Unbound players' appeals and replies are rate-limited (reads 300/hour, writes 60/hour, bucketed per event and direction), and a player's replies are visible only to the organizer and that player, while organizer replies are visible to everyone — visibility is part of permission too.