Roles and privileges
A role in DigiFIR is a permission attached to a person's registered signing key. It decides which actions the key may sign and which private data it may read. Roles live on the ledger in the identity-registry chaincode, and every chaincode checks them again on every action. The apps hide buttons a role cannot use, but hiding a button never replaces the chaincode's check.
How a person gets a role
- The person's phone makes a P-256 signing key in its secure hardware (Android Keystore or StrongBox, iPhone Secure Enclave).
- The registrar of their institution checks the person face to face and registers the key with its roles, designation, jurisdiction and validity period (
key.register). - From then on, every action the person takes is signed with that key, and the ledger records it as theirs.
One key holds between one and four roles. A sub-inspector, for example, may be both duty officer and investigating officer. Citizens are not registered by a registrar: they get a decentralised identifier (DID) after identity proofing, described in Identity and access.
Institutions and their roles
Each member organisation of the network is one institution of one kind. A registrar can assign only the roles valid for its own institution's kind.
Police (one institution per state)
| Role | Who | May sign | Jurisdiction |
|---|---|---|---|
DUTY_OFFICER | Front-desk officer | Take in a walk-in complaint, register an FIR, Zero FIR or NCR, ask the informant for details, refer a probable duplicate to a magistrate | One station |
SHO | Station house officer, the officer in charge of the station | Everything the duty officer may sign, plus: request a preliminary enquiry, assign or change the investigating officer, close an enquiry, reply to a court's status request | One station |
IO | Investigating officer | Case diary, statements, arrest and custody events, seizure and seizure memo, dispatch to the laboratory, final report, reply to a court's status request | One station, and only on cases assigned to them |
SUPERVISOR | DSP or ACP and above | Approve or decline a preliminary enquiry (needs the dspOrAbove designation flag) | Up to 64 stations |
MALKHANA_INCHARGE | Keeper of the station's property room | Accept exhibits into the malkhana and hand them out, as one side of a custody hop | One station |
CONSTABLE | Messenger or escort | Take or give custody of a parcel | One station |
REGISTRAR | The state police's registrar | Register and revoke officials' keys, keep stations, districts and areas | The whole institution |
Judiciary
| Role | Who | May sign | Jurisdiction |
|---|---|---|---|
MAGISTRATE | Any judicial officer of a criminal court | Decide probable duplicates and closure reports, take cognizance, record remand, bail, transfer, disposal and High Court quash orders, ask a station for a status report, order erasure | Up to 8 courts, plus link courts delegated to them |
HC_REGISTRY | High Court registry | Record High Court orders, including quash orders | The states the High Court serves |
COURT_STAFF | Court staff, including the High Court's central project coordinator | Take or give custody of exhibits held by the court | Up to 8 courts |
AUDITOR | Read-only auditors issued by the judiciary | Nothing. Auditors read the ledger explorer and integrity reports in the officials' console | None on the ledger; the explorer limits what each auditor sees |
REGISTRAR | The judiciary's registrar | Register and revoke keys, keep courts and link-court delegations | The whole institution |
Forensic laboratories
| Role | Who | May sign | Jurisdiction |
|---|---|---|---|
LAB_RECEPTION | Reception counter of a laboratory | Accept or refuse a parcel, hand an exhibit back | One laboratory division |
LAB_ANALYST | Scientist or analyst | Everything reception may sign, plus: record examination stages and working notes, seal a report, issue a supplementary report | One laboratory division |
REGISTRAR | The laboratories' registrar | Register and revoke keys, keep laboratories and divisions | The whole institution |
IMPORTANT
Only an analyst whose key carries the expert329 designation flag can seal a report. The flag is set for the designations BNSS section 329(4) lists: Chemical Examiner or Assistant Chemical Examiner, Director, Deputy Director or Assistant Director of a Central or State laboratory, Serologist, or a notified expert. A "Scientific Officer" does not qualify unless notified.
Citizens
A citizen signs with a key bound to their DID. They may file a complaint, add information, sign the complaint within three days, answer the station's questions and read their own complaints. They never see duplicate hints or anything about other people's cases.
Service roles
Service roles belong to machines, never to people, and none of them can act for a person.
| Role | Purpose |
|---|---|
GATEWAY | The identity that submits transactions to Fabric for an institution. It carries signed actions and has no authority of its own. |
KYC_ATTESTOR | Attests that a citizen's identity was proved, so the citizen's DID can be registered. |
HINT_SERVICE | Submits signed text-similarity hints within one state. |
DEADLINE_SERVICE | Records the escalation when a statutory clock runs out. |
ADAPTER | Connects one outside system: eSign, documents, CCTNS, ICJS, eCourts, e-Sakshya, the laboratory information system or the general diary. |
Who may read private case data
The narrative, the people involved, statements, the diary and reports are private data. A read is itself a signed request, checked by the chaincode on a peer of an institution that holds the data.
| Reader | Which cases | Which parts |
|---|---|---|
| Citizen | Complaints they filed | Their complaint, attachments, information they added, questions asked of them, diary entries the police chose to share with them |
| Duty officer, SHO | Cases of their station, including complaints received there and Zero FIRs that started there | All |
| Investigating officer | Cases assigned to them at their current station | All |
| Supervisor | Cases of the stations they supervise | All |
| Magistrate | Cases of stations in their courts' jurisdiction, and cases with a final report or referral before their court | All |
| Magistrate | The other case of a duplicate pair before their court, in any state | The narrative only, for the side-by-side comparison |
| High Court registry | Cases of their states | Narrative, people, notes, reports |
| Malkhana in-charge, constable, auditor, laboratory roles | None | None |
When a court transfers a case to another station, the old station's investigating officer stops acting on it and stops reading it at once. The new station's SHO assigns a new one.
Rules that apply to every key
- A key is
ACTIVE,SUPERSEDED(replaced by a newer key of the same person) orREVOKED. A revoked key fails from the next block onwards. - A registrar key never holds any other role. Only the institution's MSP administrator can create one.
- No registrar can enrol their own phone or give another person the registrar role.
- Every key has a validity period. A key used outside it is refused.
- Names of officials never go on the ledger. The backend's directory maps official IDs to names.
Sources: digifir-chaincode docs/SPEC.md sections 2.1, 2.2, 3.10 and 1.7.4; digifir-backend docs/architecture/ARCHITECTURE.md section 3; digifir-police-app docs/registrar.md on the migration branch.