Predefined roles in Keycloak
HES LoanBox is designed to work with a fixed set of role names. Every endpoint, every process task, and every menu permission is wired to one or more of these role names. For the platform to function, predefined roles are listed below.
Roles by realm
| Role | Realm | Display name | Description |
|---|---|---|---|
| Borrower | BorrowerRealm | Borrower | Self-service access to own profile, applications, loans, schedules, transactions, and contract signing. |
| Agent | AgentRealm | Agent (partner user) | Lead creation, agent-originated applications and access to loans linked to the agent’s partner organisation. |
| PartnerManager | Backoffice | Partner manager | Management of agent partners and agent users across all partner organisations. Cross-partner visibility. |
| CreditOfficer | Backoffice | Credit officer | Most-permissive backoffice role. Covers loan operations, borrower management, product group and product configuration, document and notification templates, scoring model settings, write-offs, manual disbursements, contract management and loan adjustments. |
| Underwriter | Backoffice | Underwriter | Application evaluation and credit decision (approve / decline), review of scoring errors, view access to loans, applications, borrowers, products and configuration. |
| Verifier | Backoffice | Verifier | Manual verification of borrower data and documents, collateral review, bank account verification data correction, and provision of financial data for legal entity applications. |
| CollectionManager | Backoffice | Collection manager | Overdue case management, calling the borrower, viewing and managing loans in collection, and contract management for collection. |
| LoanDataManager | Backoffice | Analytics user | Access to embedded analytics dashboards (Metabase). |
Access summary by role
The table below lists the user-visible capabilities that each role unlocks. Where the same area is shown for multiple roles, the level of access differs: read-only roles can view but not edit; full-access roles can create, edit, and approve.
| Role | Capabilities |
|---|---|
| Borrower | View own loan applications, active loans, repayment schedules, transactions; submit new applications; sign contracts; receive borrower-side tasks (provide bank details, etc.). |
| Agent | Create and manage leads; submit applications on behalf of leads; view loans assigned to their partner; fill in their own bank account details. |
| PartnerManager | Create, view and edit agents; view and manage agent users. |
| CreditOfficer | Full borrower management; full loan operations and recalculation; manage product groups; create, edit, activate, deactivate loan products; manage scoring model settings (add, deploy, activate, validate); manage interest rate settings, landing page settings, document templates, notification templates; verify applications; make a decision on applications when underwriter is unavailable in cross-role contexts; approve bank account changes; upload signed contracts; review loan adjustment requests; write off loans during collection. |
| Underwriter | Make a decision on an application (approve / decline); review scoring errors; view borrowers, loans, applications, products, product groups, templates and interest rate settings. |
| Verifier | Verify applications; review and update collateral data; edit bank account verification data; provide financial data for legal entity applications; view borrowers, applications and settings. |
| CollectionManager | View and operate on loans in collection; call the borrower and record the result; manage transactions; view loans, applications, borrowers, products and templates. |
| LoanDataManager | View the list of embedded dashboards; open individual dashboards. |
Note
A user can hold more than one role in the same realm. For example, a senior staff member may hold both
CreditOfficer and Underwriter. Permissions are additive.
Note
The platform never assigns roles itself.
Role assignment is always done by an administrator in Keycloak. When HES
LoanBox creates a borrower or agent user, it sets up the account but does not attach the
Borrower or
Agent role. That is part of the realm configuration in Keycloak (typically a default realm role, so every new user receives it
automatically).