# Setting Up Role-Based Access for Line Producers

Role-based access for a line producer must grant cross-department budget visibility while making any write into locked union rates structurally impossible. That is the exact edge case this page covers: a role that legitimately needs to read every above-the-line talent pool and every below-the-line department to forecast cash flow, yet may only approve spend inside a narrow, phase-dependent slice of the ledger — never against a rate a guild has fixed, and never above a delegated ceiling. Get the scoping wrong and the failure is not cosmetic. A line producer who can edit a below-the-line cost code that shares a parent node with an above-the-line talent contract can silently reallocate funds a completion guarantor has already reported against, and the variance surfaces weeks later during reconciliation when it is expensive to unwind. This guide specifies that role as a deterministic resolver: derive the grant from the cost code series and production phase rather than from a departmental tag, cap it with a Decimal spending authority, and hash every decision into an audit trail a bond lender can replay.

# Prerequisites and Context

This page builds on Security & Access Boundaries, which defines the request-to-ledger enforcement path in general; here we specialize that middleware for the single hardest role to scope correctly. It assumes Python 3.11+ (for zoneinfo in the standard library and X | None typing), Pydantic v2 for boundary validation of every access request, and the standard-library decimal, hashlib, json, and zoneinfo modules for currency-safe math, tamper-evident hashing, and timezone-aware timestamps. Row-level security is enforced at the PostgreSQL layer beneath the application resolver, so an application bug cannot become a bypass.

The resolver only behaves deterministically because the cost codes it evaluates are already normalized upstream — the canonical, series-tagged keys produced by Cost Code Standardization are what make a 4-digit prefix a reliable scoping key, and the frozen above-the-line / below-the-line classification comes from Above/Below-the-Line Mapping. The contract clause that drives the read/write asymmetry is the guild rate lock: once a collective bargaining agreement rate table is committed for a shoot, only a production accountant may post against it, and a line producer’s access to those series is read-only for the life of the production.

# Step-by-Step: A Lazy, Cost-Code-Scoped Resolver

A common failure mode occurs when permission resolvers eagerly hydrate the entire permission tree on session initialization, exhausting the database connection pool during peak accounting periods. The resolver below is lazy and cache-aware: it touches the schema only on a cache miss, resolves the grant against the standardized cost code series and union jurisdiction, and — critically — keeps the per-transaction Decimal ceiling outside the cache so a single cached role resolution serves every amount.

1. Model the request at the boundary. A Pydantic v2 model rejects any cost code that does not expose a 4-digit series prefix before a scope check ever runs, so a malformed code fails as a validation error rather than a silent permission drop.
2. Resolve the scope, cached. resolve_scope maps the role, series, and category to a maximum grant (READ_ONLY, APPROVE, or DENIED) and memoizes it — above-the-line series that require guild approval collapse to read-only regardless of anything else.
3. Apply the delegated ceiling, uncached. authorize_write demotes an in-series approval to DENIED when the amount exceeds the delegated spending authority, keeping the cache key small and the money math in Decimal.

Those three steps collapse to a single deterministic path with exactly three terminal grants — READ_ONLY, APPROVE, or DENIED:

import functools
from decimal import Decimal
from enum import Enum

from pydantic import BaseModel, ConfigDict, field_validator


class AccessLevel(str, Enum):
    READ_ONLY = "read"
    APPROVE = "approve"
    DENIED = "denied"


class CostCodeContext(BaseModel):
    # frozen=True makes the model hashable so an instance can serve as an
    # lru_cache key; without it, lru_cache raises TypeError at call time.
    model_config = ConfigDict(frozen=True)

    code: str
    category: str              # 'above_line' or 'below_line'
    union_agreement_id: str | None
    phase: str                 # 'prep' | 'principal' | 'wrap'

    @field_validator("code")
    @classmethod
    def _has_series_prefix(cls, v: str) -> str:
        if len(v) < 4 or not v[:4].isdigit():
            raise ValueError("cost code must expose a 4-digit series prefix")
        return v


class PermissionResolver:
    def __init__(self, schema_client):
        self._schema = schema_client
        # A short, fixed TTL bounds staleness across payroll windows; the
        # lru_cache size cap is the eviction lever, so we record the intended
        # TTL for the scheduled cache-flush task to honor.
        self._cache_ttl_seconds = 300

    @functools.lru_cache(maxsize=1024)
    def resolve_scope(self, user_id: str, context: CostCodeContext) -> AccessLevel:
        # Lazy query: the schema is only touched on a cache miss.
        policy = self._schema.fetch_rls_policy(
            cost_prefix=context.code[:4],
            agreement_id=context.union_agreement_id,
        )
        # Above-the-line talent pools are read-only for a line producer.
        if context.category == "above_line" and policy.requires_guild_approval:
            return AccessLevel.READ_ONLY
        if context.category == "below_line" and policy.allows_line_producer_edit:
            return AccessLevel.APPROVE
        return AccessLevel.DENIED


def authorize_write(
    resolver: PermissionResolver,
    user_id: str,
    context: CostCodeContext,
    amount: Decimal,
    delegated_authority: Decimal,
) -> AccessLevel:
    # Scope is cached; the per-transaction Decimal ceiling is applied outside
    # the cache so one role/series resolution serves every amount.
    scope = resolver.resolve_scope(user_id, context)
    if scope is AccessLevel.APPROVE and amount > delegated_authority:
        return AccessLevel.DENIED  # in series, but over the delegated ceiling
    return scope

This pattern follows the standard-library caching contract documented at functools.lru_cache: repeated evaluations during a single accounting cycle hit memory rather than the database. Enforcing the same checks at the query layer via PostgreSQL row-level security prevents bypass attempts entirely — refer to the official PostgreSQL Row-Level Security documentation for policy syntax that mirrors the resolver’s series-prefix and agreement-ID logic. The immutability discipline underneath — versioned rows rather than in-place UPDATEs on posted transactions — is the same one specified in Production Schema Design.

# Emergency Override Protocols and Audit Integrity

Production schedules rarely follow a static path. Weather delays, location strikes, and sudden talent availability force immediate reallocation, and a line producer sometimes needs elevated authority right now. Override protocols must allow temporary elevation while maintaining an immutable trail: bond lenders require cryptographic proof that every override was time-bound, authorized by a designated executive producer, and automatically revoked upon resolution — never a standing privilege left switched on after the crisis passed.

The state machine below captures the time-boxed override lifecycle enforced by the context manager: a granted elevation becomes active, then is always revoked on expiry, success, or failure, with each transition recorded to the audit log.

Implementing this safely requires a context manager that wraps elevated access in a transactional scope and anchors every timestamp to an IANA timezone — never a fixed UTC offset — so a shoot day that crosses a Daylight Saving Time boundary still produces an unambiguous audit record. The pattern below enforces time-boxed overrides with automatic revocation and audit logging on success, failure, and expiry alike:

from contextlib import contextmanager
from datetime import datetime, timedelta
from zoneinfo import ZoneInfo

# The production hub timezone anchors every override timestamp. An IANA
# identifier (not a fixed UTC offset) so DST transitions resolve correctly.
HUB_TZ = ZoneInfo("America/Los_Angeles")

# These collaborators represent your persistence and audit layers; replace
# the stubs with concrete Redis/DB and audit-trail implementations.
def grant_temporary_access(user_id, cost_center, expiry): ...
def revoke_temporary_access(user_id, cost_center): ...

class _AuditLog:
    def record_override(self, user_id, cost_center, start, expiry): ...
    def record_failure(self, user_id, cost_center, error): ...
    def record_revocation(self, user_id, cost_center, revoked_at): ...

audit_log = _AuditLog()


@contextmanager
def emergency_budget_override(user_id: str, cost_center: str, duration_minutes: int):
    # Timezone-aware timestamps anchored to an IANA zone keep audit records
    # unambiguous across international shoot locations and DST boundaries.
    start = datetime.now(HUB_TZ)
    expiry = start + timedelta(minutes=duration_minutes)

    grant_temporary_access(user_id, cost_center, expiry)
    audit_log.record_override(user_id, cost_center, start, expiry)
    try:
        yield
    except Exception as exc:
        audit_log.record_failure(user_id, cost_center, str(exc))
        raise
    finally:
        # Strict revocation regardless of success, failure, or expiry.
        revoke_temporary_access(user_id, cost_center)
        audit_log.record_revocation(user_id, cost_center, datetime.now(HUB_TZ))

This guarantees elevated privileges never persist beyond their authorized window. If an override still attempts to modify a locked union rate table, the underlying row-level security policy intercepts the transaction before it commits, so the elevation buys time, not immunity.

# Audit Trail Requirements

An override or an approval is only defensible if it is reconstructable. Every access decision — grant, denial, and elevation alike — must write a record carrying the requesting user ID, the resolved role context, the target cost code and its series prefix, the action attempted, the Decimal amount, the source IP, the timezone-aware timestamp, and a SHA-256 hash of the exact payload. That hash is both the tamper-evidence seal and the idempotency key: two requests that produce the same fingerprint are the same logical write, so a retried override does not double-post.

import hashlib
import json


def audit_fingerprint(record: dict) -> str:
    # Canonical JSON (sorted keys, Decimal rendered as a string) so the same
    # logical decision always hashes identically — the idempotency key.
    payload = json.dumps(record, sort_keys=True, separators=(",", ":"), default=str)
    return hashlib.sha256(payload.encode("utf-8")).hexdigest()

Audit rows belong in write-once (append-only) storage — a table with no UPDATE/DELETE grant, or WORM-configured object storage — so that history can be added to but never rewritten. A production accountant can then query the audit table to verify that every override aligns with an approved contingency budget line, and a guarantor can replay the full chain of custody months later at wrap.

# Gotchas and Production Edge Cases

Three checkpoints catch nearly every access anomaly, and each maps to a specific production hazard:

1. Cost code prefix drift. Verify the 4-digit prefix maps to the correct departmental bucket. A misaligned prefix causes a silent DENIED during payroll ingestion that looks like a permissions bug but is really a normalization gap upstream — the same failure class handled by Schema Validation & Error Handling.
2. Phase-aware cache invalidation. Cache entries must expire when a production transitions from prep to principal photography. Stale phase flags are the primary cause of mid-shoot access drift, where a scope that was correct during prep silently over-grants once shooting starts. The recorded TTL exists precisely so a scheduled flush can honor the phase boundary rather than trusting lru_cache to age out on its own.
3. DST and multi-location shoots. A unit in Europe/London and a hub in America/Los_Angeles disagree about when an override’s TTL window actually elapsed unless both timestamps are timezone-aware and anchored to IANA zones. Never subtract naive datetimes; a fixed offset that ignores a DST transition will revoke an override an hour early or an hour late.

Two further hazards deserve explicit handling. Overlapping elevations — two emergency overrides on the same cost center — must be idempotent: the audit_fingerprint collapses duplicate grants, and the resolver should treat the union of active windows rather than stacking privileges. And a line producer’s read access legitimately spans both compensation tiers, so any change that widens write scope must be reviewed against the frozen tier boundary; the append-only reasoning behind that boundary is worked through in Designing Immutable Cost Code Hierarchies for Multi-Unit Shoots. Rate-lock series in particular follow the same read-only-for-line-producers rule that the penalty engine in DGA Overtime & Turnaround Rules depends on to keep its computed liabilities from being edited out from under it.

Setting up role-based access for line producers is, in the end, an exercise in making the safe path the only path: derive the grant from standardized cost codes and production phase, partition above/below-the-line write access, cap it with a Decimal authority, and hash every decision into write-once storage. Do that, and the system satisfies bond-lender audits, protects union contract integrity, and lets a line producer manage a budget at the speed of the shoot without ever being one careless write away from a compliance incident.

# Frequently Asked Questions

Why derive a line producer’s grant from the cost code series instead of a department tag? Departmental tags are assigned by humans under time pressure and drift constantly; a normalized 4-digit series prefix is a deterministic key. Scoping to the series means the same role resolves identically every time and an above-the-line rate lock can never be reached through a mislabeled below-the-line node that happens to share a parent.

Why keep the spending ceiling in Decimal and outside the cache? The instant an approval depends on an amount, the comparison must use Decimal — binary floating point cannot represent most cents exactly, and a fractional-cent error that survives an access check is a variance a guarantor will ask about. Keeping the ceiling out of the lru_cache key lets one cached role resolution serve every transaction amount, so the cache stays small and the money math stays exact.

How do emergency overrides stay auditable without becoming standing privileges? The context manager grants a time-boxed scope, records the grant, and revokes in a finally block on success, failure, or expiry alike, so an elevation cannot outlive its window even if the work raises. Every transition is written with a SHA-256 payload hash to append-only storage, giving a bond lender cryptographic proof the override was bounded and revoked.

Why must every timestamp be timezone-aware via zoneinfo? A shoot spanning multiple locations and a DST boundary will disagree about when a TTL window elapsed if timestamps are naive or use fixed offsets. Anchoring both the grant and the revocation to an IANA zone through zoneinfo is the only way the override’s lifetime matches what auditors reconstruct later.

What happens when a resolved cost code fails validation? It never reaches a scope check. The Pydantic v2 model rejects a code without a 4-digit series prefix at the boundary, the request is denied as a validation error rather than a silent permission drop, and the malformed payload is logged with its hash for reconciliation instead of being guessed at.

# Related

• Security & Access Boundaries — the general request-to-ledger enforcement path this role-specific resolver specializes.
• Cost Code Standardization — the normalized, series-tagged keys that make prefix-based scoping deterministic.
• Above/Below-the-Line Mapping — the frozen compensation-tier classification the resolver reads to gate write access.
• Designing Immutable Cost Code Hierarchies for Multi-Unit Shoots — the append-only data model behind the boundaries this access layer enforces.
• DGA Overtime & Turnaround Rules — a penalty engine whose computed liabilities depend on the rate-lock series staying read-only to line producers.

Up: Core Production Architecture & Taxonomy