Step-by-Step Guide — Follow each step exactly as written. All values are provided — do not improvise.

TC-RBAC-002: Permission Boundaries per Role (Detailed)

Module: RBAC - Permission Boundaries (sidebar visibility per role)

URL for this test: https://stg-rcme.membervu.com/login

NOTE: You will log in as 6 different users. Log out completely between each.
Sidebar visibility is ROLE-gated (defined in config/branding.ts) and can differ from raw API permissions — where they diverge, this guide flags it.

Universal admin-deny check: for every non-ADMIN role below, browsing directly to https://stg-rcme.membervu.com/admin/roles must silently redirect to /home (no error page). Only ADMIN and SUPER_ADMIN may open it. The same applies to /admin/settings.

Role 1: Treasurer (Ana Reyes — FINANCE_MANAGER)

Step	Action	Expected Result	Test Value
1	Log in: `treasurer@demo.membervu.com` / `Treasurer123!`. Skip any tour.	Login succeeds.	treasurer@demo.membervu.com / Treasurer123!
2	Inspect the left sidebar groups/items.	SHOULD see: Overview (Executive Dashboard); Finance (Dashboard, Invoices, Payments, Donations Report); Members (All Members); Events (All Events — view only). SHOULD NOT see: Organization/Settings, Platform, Communications/Broadcasts, Prospects, Create Event / Check-in / Guests, Reported Issues, Directory.	-
3	Browse directly to `/admin/roles`, then `/admin/settings`.	Both silently redirect to `/home`.	-
4	Click Finance → Invoices.	Admin invoices list loads (FINANCE_MANAGER allowed).	-
5	Log out.	Logged out.	-

Divergence note: FINANCE_MANAGER does see All Members and All Events (view) — corrected from the prior guide, which wrongly said Finance had no member/event visibility.

PASS if: Finance group visible; Settings/Roles redirect to /home; Communications hidden.

Role 2: Events Manager (Carlos Garcia — EVENT_MANAGER)

Step	Action	Expected Result	Test Value
1	Log in: `events@demo.membervu.com` / `Events123!`.	Login succeeds.	events@demo.membervu.com / Events123!
2	Inspect the sidebar.	SHOULD see: Overview; Members (All Members, Prospects); Events (All Events, Create Event, Guests, Check-in); Communications (Broadcasts). SHOULD NOT see: Finance, Organization/Settings, Platform, Reported Issues.	-
3	Click Communications → Broadcasts.	Broadcasts page loads (EVENT_MANAGER holds `COMMUNICATIONS:VIEW/CREATE/EDIT/DELETE:broadcasts`).	-
4	Browse directly to `/admin/roles`.	Redirects to `/home`.	-
5	Log out.	Logged out.	-

Divergence note: EVENT_MANAGER does see Broadcasts — corrected from the prior guide, which wrongly listed Communications as denied.

PASS if: Events + Broadcasts + Members visible; Finance hidden; Roles redirects.

Role 3: Membership Manager (Elena Torres — MEMBERSHIP_MANAGER)

Step	Action	Expected Result	Test Value
1	Log in: `membershipchair@demo.membervu.com` / `Membership123!`.	Login succeeds.	membershipchair@demo.membervu.com / Membership123!
2	Inspect the sidebar.	SHOULD see: Overview; Members (All Members, Prospects); Events (All Events — view). SHOULD NOT see: Finance, Communications/Broadcasts, Organization/Settings, Platform, Create Event/Check-in/Guests.	-
3	Click Members → Prospects.	Prospects queue loads.	-
4	Browse directly to `/admin/roles`.	Redirects to `/home`.	-
5	Log out.	Logged out.	-

PASS if: Members + Prospects visible; Finance/Communications hidden; Roles redirects.

Role 4: Communications Manager (Seung Eun Lee — COMMUNICATIONS_MANAGER)

Step	Action	Expected Result	Test Value
1	Log in: `comms@demo.membervu.com` / `Comms123!`.	Login succeeds.	comms@demo.membervu.com / Comms123!
2	Inspect the sidebar.	SHOULD see: Overview; Events (All Events — view); Communications (Broadcasts). SHOULD NOT see: Finance, Members / All Members (sidebar item is role-gated to exclude COMMUNICATIONS_MANAGER), Prospects, Organization/Settings, Platform.	-
3	Click Communications → Broadcasts; create a draft broadcast.	Broadcasts page loads; draft can be created.	-
4	Browse directly to `/admin/roles`.	Redirects to `/home`.	-
5	Log out.	Logged out.	-

UI vs API divergence (expected): COMMUNICATIONS_MANAGER holds MEMBERS:VIEW:members at the API level, so GET /api/membership/members returns 200 — but the All Members sidebar item is hidden for this role. This is by design; report it only if the sidebar item unexpectedly appears.

PASS if: Broadcasts visible; Members sidebar item hidden; Finance hidden; Roles redirects.

Role 5: Member (Maria Cruz — MEMBER)

Step	Action	Expected Result	Test Value
1	Log in: `testmember@rcme.membervu.com` / `Member123!`.	Login succeeds.	testmember@rcme.membervu.com / Member123!
2	Inspect the sidebar.	SHOULD see (member nav only): Home, Events, My Invoices, Payment History, Directory, Support (My Issues), My Account. SHOULD NOT see: ANY admin group (no Overview, Finance, Members, Events-admin, Communications, Settings, Platform).	-
3	Browse directly to `/admin/invoices`, then `/admin/roles`.	Both redirect to `/home` (or login). No admin access.	-
4	API: `GET /api/membership/members` as MEMBER.	Status `403` — plain MEMBER lacks `MEMBERS:VIEW:members`. (Directory uses a separate `requireApprovedMember` route.)	-
5	Log out.	Logged out.	-

PASS if: Member sees only the member nav; all /admin/* redirect; GET /api/membership/members → 403.

Role 6: Guest (Roberto Mendoza — GUEST)

Step	Action	Expected Result	Test Value
1	Log in: `guest@demo.membervu.com` / `Guest123!`.	Login succeeds.	guest@demo.membervu.com / Guest123!
2	Inspect the sidebar.	SHOULD see: Home, Events, My Account (and possibly My Invoices / Payment History). SHOULD NOT see: Directory (role-gated to MEMBER/ADMIN/OFFICER/MEMBERSHIP_MANAGER — excludes GUEST), and any admin group.	-
3	Browse directly to `/directory`, then `/admin/invoices`.	Both redirect away (Directory denied for GUEST; admin denied).	-
4	Log out.	Logged out.	-

PASS if: Guest sees public/event items only; Directory and all admin pages are denied.