# Category 2: Stakeholders

> **Usage:** Identification of stakeholders and their needs
> **When to load:** ALWAYS (core)

---

## 2.1 Identification

| # | Question | Answer Type |
|---|----------|-------------|
| Q2.1 | Who are the direct end users? | List of roles |
| Q2.2 | Who are the indirect beneficiaries? | List |
| Q2.3 | Who is the sponsor/final decision maker? | Name + role |
| Q2.4 | Who can block the project? | List + reasons |

## 2.2 Needs by Role

| # | Question | Answer Type |
|---|----------|-------------|
| Q2.5 | For each role: What tasks should they accomplish? | Per role |
| Q2.6 | What frequency of use per role? | Daily/Weekly/Monthly |
| Q2.7 | What level of technical expertise per role? | Novice/Intermediate/Expert |
| Q2.8 | What current frustrations per role? | List of pain points |

---

## Role -> Permission Mapping

> **⚠️ RBAC RULE: Roles are platform permissions, NOT entity attributes.**
>
> When stakeholders mention "roles" (admin, manager, user...), these MUST be mapped
> to the platform's RBAC permission system (`business.{app}.{module}.{action}`).
>
> **NEVER** model a role as:
> - A property/column on a User entity (e.g. `User.Role`, `User.RoleType`)
> - An enum or string attribute on any business entity
> - A separate `Role` entity with a FK on User
>
> **ALWAYS** map roles to permission sets in the matrix below:

| Discovered Role | Platform Permission |
|-----------------|----------------------|
| Admin | `*.admin` |
| Manager | `*.read,create,update` |
| User | `*.read,create` |
| ReadOnly | `*.read` |

> If the business need requires **custom roles beyond these 4**, document them
> as additional permission sets — not as data model concepts.

## Elicitation Guide

### Follow-ups by Question

| Question | If answer is vague/insufficient | Probe |
|----------|-------------------------------|-------|
| Q2.1 (end users) | Only 1-2 roles listed | "Y a-t-il des auditeurs, des administrateurs système, du support, des processus automatisés ?" |
| Q2.5 (tasks per role) | Generic tasks ("manage data") | "Prenons le rôle {role} : en arrivant le matin, quelle est sa première action ? Et après ?" |
| Q2.6 (frequency) | "Régulièrement" | "Quotidien ? 10 fois/jour ou 1 fois ? Certains jours plus que d'autres ?" |
| Q2.8 (frustrations) | "Rien de particulier" | "Quel processus prend le plus de temps ? Qu'est-ce qui vous fait soupirer ?" |

### Anti-patterns to Detect

| Signal | Anti-pattern | Action |
|--------|-------------|--------|
| Un seul type d'utilisateur identifié | **Stakeholders manquants** | Proposer systématiquement : admin, utilisateur métier, lecteur, auditeur, support N1 |
| "Tous les utilisateurs font la même chose" | **Rôles non différenciés** | "Qui peut supprimer ? Qui ne fait que consulter ? Qui valide ?" |
| Mélange rôle organisationnel et accès | **Confusion rôle/permission** | Séparer : rôle métier (chef de projet) vs niveau d'accès (lecture/écriture) |
