# RFQ/EOI — Permissions and Access

Roles (internal)
- Procurement Admin: full control including configuration, publish, close, award, archive, reminders
- Approver: approve publish (if enabled), view all, comment
- Requester: create and edit draft RFQs, propose vendors, view invited responses, cannot publish unless granted

Roles (vendor)
- Vendor Admin: manage vendor users, view all org-invited RFQs, submit and revise, acknowledge addenda
- Vendor User: limited to specific invites granted by Vendor Admin or by invitation mapping; submit and revise

Access Rules
- Internal users are scoped by org; cross-org access is disallowed unless super-admin role
- Vendor users can see only RFQs they are invited to
- After due date, vendor portal blocks new submissions unless RFQ is reopened

Data Permissions
- rfq_headers and related child records are visible to internal users within the same org
- rfq_invites link vendors and control access to vendor portal entries
- rfq_events visible internally; vendor-visible timelines show only public events (e.g., addenda and Q and A)

Award Visibility
- Award outcomes disclosed to awarded vendors and optionally to all invitees depending on org policy

Audit and Logging
- All critical actions (publish, invitations, reminders, responses, awards, addenda) logged in rfq_events with actor and timestamp