If you are answering "why could this person see that?" — or "why can't they?" — this is the page. What you can see, and why is the short version for everyone; this one is the whole model.

There is no role field

ARC stores no single "role" per person. Authorisation is layered, and one person routinely holds several layers at once.

Layer	Where it lives	Values
Platform operator	`operators`, on its own sign-in	ARC's own staff
Company role	`company_memberships.role`	`admin`, `hr`, `member`
Home role	`home_memberships.role`	`staff`, `senior`, `deputy`, `manager`, `safeguarding_lead`
DSL designation	`home_designated_safeguarding_leads`	a designation, per home
On-call elevation	a published company-wide `on_call` rota assignment	time-bounded
Inspection session	its own `/inspection` sign-in	time-boxed, one home

Every check resolves through one place. ARC builds a snapshot of these facts for the person and the home in question, then maps that snapshot to a yes or no. The capability matrix in the system documentation is generated by probing that same code, so it cannot disagree with the running system.

What each layer actually buys

Home role decides day-to-day permissions, and it is per home — the same person can be a manager in one and staff in another.
Deputy shares some of the manager's work: writing care plans, managing medication, choosing what an inspector sees, and building the rota. Elsewhere a deputy resolves as an ordinary home member. A deputy does not sign off money.
Senior adds the senior dashboard and sign-off of money entries, the home's and the children's.
Manager holds the review and sign-off gates for the home, apart from money, which seniors sign off too. Some things are the manager's alone, such as the medication go-live cutover and deleting a plan.
Company admin covers every home in the company, and adds company-wide administration — homes, people, DSL designations, compliance rules.
HR is a company membership role, not an operational one. It opens the HR scope and nothing else.
Logs have their own role lists, set per log by your organisation: which home roles can record it and which can read it. Managers can always read, and so can anyone who can record it. A company admin can read a log in any of the company's homes but, with no home role, records nothing. See Logs and required logs.
The audit log is the deliberate exception: everyone who works in the home can read it. See The audit log.

The two that are not roles

The DSL designation. Inviting someone as "safeguarding" gives them the safeguarding_lead home role, which only decides which dashboard they land on. It grants access to no safeguarding record. Reaching the workspace, DSL-private content and the safeguarding audit log requires the designation, assigned per home by a company admin. This is the single most common source of confusion in the product, and being a manager is not a substitute.

On-call elevation. It applies only to someone with no normal access to the home, is scoped to that home's company, and reaches only the home summary, the child summary and the on-call log. It can never read safeguarding depth and can never edit anything.

The gates around the permission layer

Someone can hold the permission and still be refused. Most "it's broken" reports are one of these:

Gate	What it does
Billing state	A restricted company is on hold: home routes redirect to billing
Company live	Home operations need a live company: paid up, a demo, or past due inside the 14-day grace period. While a company is still setting up, nothing is recorded and staff can't sign in
Home active	Only `active` homes open; draft, pending activation, suspended and archived are blocked
Home access	Direct home membership, or a company membership for that home's company
Home selected	The home switcher lists direct home memberships only
Staff profile	An incomplete profile blocks every home route until it is filled in

The billing one catches people most often, and it is worth saying out loud: being sent to billing means billing, not permissions.

Working out an answer

Take them in order. Is the company in good standing? Is the home active? Do they have a membership for that home, and is the home in their switcher? Is their profile complete? Only then ask what their home role grants — and if the question is about safeguarding, ask whether they hold the designation rather than the role.

The two temporary ways in

Both are read-only, both expire, both are logged.

On-call widens access to summary surfaces for someone covering out of hours.

An inspection session is the wider one. A manager mints a time-boxed code; it opens one home, read-only, and it deliberately includes DSL-private safeguarding content with every record opened written to an access log. Beyond that, what it shows is bounded by the home's published evidence pack — or, with no pack, everything the home holds. See Give an inspector access.