Understand Letter Manager staff access
Apply the actual access model instead of assuming a module-specific capability exists.
Exact navigationAdmin Area → Letter Manager
Before you begin
- Use an authorised account and confirm the customer, external recipient, template, letter or configuration is the intended one.
- Follow the exact route shown above and verify the stored record, generated file and delivery evidence instead of relying on an alert alone.
What this guide covers
Apply the actual access model instead of assuming a module-specific capability exists. These instructions follow the inspected module’s live hook, route, controller, model, installer, PDF helper and view flow.
Exact step-by-step process
- Review which staff roles can reach the admin area.
- Limit Letter Manager access through organisational role design and operating procedures.
- Use an authorised test staff account to verify the dashboard, template and action routes.
- Reserve Settings for administrators.
Fields, choices and supported possibilities
Action scopeApply the actual access model instead of assuming a module-specific capability exists.
Module version1.0.0
Exact routeAdmin Area → Letter Manager
EvidenceVerify the history row, PDF, email metadata, open evidence, signature, public page, client view or postal fields produced by this flow.
Code-backed validations and workflow rules
- The supplied module does not register Letter Manager staff capabilities.
- Dashboard, templates, sending, resend, internal view and postal actions do not call staff_can or has_permission.
- Only the Settings action explicitly requires is_admin().
Expected result and verification
- The requested letter, template, setting, file or tracking detail is created or updated through the supported route.
- The history row, generated PDF, email/send metadata, public verification, signature evidence, client view or postal display agrees with the action.
- Any warning, missing file or failed send is investigated rather than bypassed.
Security, privacy and operational checks
- Apply least privilege and verify recipient identity before sending or exposing public links.
- Protect PDFs, enclosures, signatures, verification URLs, email-open metadata, IP addresses and customer data under organisational policy.
- Test configuration and deployment changes with controlled records before production-wide use.
- Interpret email opens and e-signatures according to their documented technical limitations.
Important code-backed limitationBecause the supplied release has no dedicated Letter Manager capability checks, do not describe per-action permissions that the code does not enforce. Restrict access through approved staff-role and deployment controls.