Roles

For the technical interface definition, roles and rights do not play a major role. They mainly determine the business behaviour at runtime. Nevertheless, it makes sense for higher levels of definition to deal with and define the business access rights.

For the sample server and sample client, the roles are of concrete importance for controlling the hypermedia controls.

Agents

Agents should be treated differently again from the actual users. The reasons for this are:

  • Auditability, liability and traceability

  • Restriction of the agents' scope of action

  • Rate limiting and protection of the API

This should be done via an additional attribute, but is not a business criterion.

1. Prospects & End Customers

  • Guest / anonymous user (ROLE_GUEST)

  • Purpose: Users who have not yet authenticated (e.g. on a landing page or in the first contact with a chatbot).

  • Rights: May calculate tariffs (anonymous calculations), retrieve general product information and possibly create an offer (which is then bound, e.g., via a token in an e-mail).

  • Restriction: May not store personal data or conclude contracts bindingly without prior identification (e.g. guest checkout or registration). May not view existing contracts.

  • Authenticated customer / policyholder (ROLE_CUSTOMER)

  • Purpose: A logged-in end customer in the customer portal or in an app.

  • Rights: May view own offers, conclude applications, view own contracts, and initiate contract changes (e.g. change of address, change of vehicle) for their own contracts.

  • Restriction: Strictly sees only their own data (multi-tenancy at user level).

2. Intermediaries

  • Broker / intermediary (ROLE_BROKER)

  • Purpose: Independent brokers or tied agents acting on behalf of customers.

  • Rights: May create calculations, offers and applications for various customers. Has read and (restricted) write access to the portfolio of the customers assigned to them. Is often allowed to see special product components that are discounted or extended for brokers and remain hidden from the end customer.

  • Special feature: Often needs the right to forward an offer to the end customer for digital signature instead of signing it themselves.

  • Broker back office (ROLE_BROKER_ASSISTANT)

  • Purpose: Assistants in a broker’s office.

  • Rights: Similar to the broker; may upload documents, capture data, view contracts, but possibly not submit the final application bindingly on behalf of the customer (four-eyes principle).

3. Insurer Staff

  • Clerk / underwriter (ROLE_UNDERWRITER)

  • Purpose: Specialist department at the insurer that reviews applications.

  • Rights: May view applications that have been routed to manual review (excluded from straight-through processing). May apply risk loadings, issue policies for (accept) or reject applications. Can request documents.

  • Customer service / support (ROLE_CUSTOMER_SUPPORT)

  • Purpose: First- and second-level support.

  • Rights: Read access to contracts, applications and error logs (e.g. failed validations in the API). May make changes to master data on behalf of the customer and resend offers.