From af842d42951986d373db2aa40145298f053f6b18 Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Tue, 19 May 2026 13:28:33 -0300
Subject: [PATCH 01/10] feat(auth): add Facility Storekeeper custom role
 enforcement

Introduce ROLE_FACILITY_STOREKEEPER across backend and frontend role catalogs,\nwith migration support for role creation.

Enforce role access across multiple layers:\n- Interceptor-level route and API restrictions for denied domains\n- Menu filtering policy for section/action visibility\n- Location chooser and filtered locations compatibility\n- User/role checks hardened via role-name comparisons to avoid enum identity issues

Also align purchase order UI actions and session capability flags with the\nnew policy while preserving higher-role precedence behavior.
---
 grails-app/conf/runtime.groovy                |   4 +-
 .../org/pih/warehouse/RoleInterceptor.groovy  | 111 +++++++++++++++++-
 .../pih/warehouse/api/ApiController.groovy    |   2 +
 .../api/LocationApiController.groovy          |   3 +-
 .../order/PurchaseOrderController.groovy      |   7 ++
 .../domain/org/pih/warehouse/core/User.groovy |  10 +-
 grails-app/i18n/messages.properties           |   1 +
 ...05-15-add-facility-storekeeper-role.groovy |  15 +++
 grails-app/migrations/custom/changelog.groovy |   2 +-
 .../pih/warehouse/api/MegamenuService.groovy  |  32 +++++
 .../pih/warehouse/core/LocationService.groovy |   3 +-
 .../org/pih/warehouse/core/UserService.groovy |  60 ++++++++--
 grails-app/views/order/_summary.gsp           |  20 ++--
 grails-app/views/order/list.gsp               |  18 +--
 .../purchaseOrder/PurchaseOrderListHeader.jsx |  16 ++-
 .../purchaseOrder/PurchaseOrderListTable.jsx  |  17 ++-
 src/js/consts/roleType.js                     |   1 +
 src/js/hooks/useUserHasPermissions.js         |   3 +
 src/js/reducers/sessionReducer.jsx            |   2 +
 .../org/pih/warehouse/core/RoleType.groovy    |   4 +
 20 files changed, 290 insertions(+), 41 deletions(-)
 create mode 100644 grails-app/migrations/custom/2026-05-15-add-facility-storekeeper-role.groovy

diff --git a/grails-app/conf/runtime.groovy b/grails-app/conf/runtime.groovy
index f3120f86866..c5ebed1a505 100644
--- a/grails-app/conf/runtime.groovy
+++ b/grails-app/conf/runtime.groovy
@@ -202,10 +202,10 @@ openboxes {
                     label: "",
                     defaultLabel: "Purchasing",
                     menuItems: [
-                        [label: "order.createPurchase.label", defaultLabel: "Create Purchase Order", href: "/purchaseOrder/create", requiredActivitiesAny: [ActivityCode.PLACE_ORDER]],
+                        [label: "order.createPurchase.label", defaultLabel: "Create Purchase Order", href: "/purchaseOrder/create", requiredActivitiesAny: [ActivityCode.PLACE_ORDER], minimumRequiredRole: RoleType.ROLE_ASSISTANT],
                         [label: "order.listPurchase.label", defaultLabel: "List Purchase Orders", href: "/purchaseOrder/list"],
                         [label: "location.listSuppliers.label", defaultLabel: "List Suppliers", href: "/supplier/list"],
-                        [label: "shipment.shipfromPO.label", defaultLabel: "Ship from Purchase Order", href: "/stockMovement/createCombinedShipments?direction=INBOUND"],
+                        [label: "shipment.shipfromPO.label", defaultLabel: "Ship from Purchase Order", href: "/stockMovement/createCombinedShipments?direction=INBOUND", minimumRequiredRole: RoleType.ROLE_ASSISTANT],
                         [label: "dashboard.supplierDashboard.label", defaultLabel: "Supplier Dashboard", href: "/dashboard/supplier"]
                     ]
                 ]
diff --git a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
index 9060825194d..1ce3ef7697e 100644
--- a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
+++ b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
@@ -68,6 +68,13 @@ class RoleInterceptor {
         'jobs'                      : ['*']
     ]
 
+    def static facilityStorekeeperActions = [
+        'inventory'    : ['createInboundTransfer', 'createConsumed', 'editTransaction', 'deleteTransaction', 'saveTransaction'],
+        'inventoryItem': ['showRecordInventory', 'adjustStock', 'transferStock'],
+        'stockTransfer': ['create', 'edit', 'createInboundReturn'],
+        'stockTransferApi': ['list', 'read', 'create', 'update', 'stockTransferCandidates', 'returnCandidates']
+    ]
+
     def static invoiceActions = [
         'invoice': ['*']
     ]
@@ -105,6 +112,18 @@ class RoleInterceptor {
     }
 
     boolean before() {
+        // Apply custom location-scoped role policy only after a warehouse context exists.
+        Boolean hasWarehouseContext = session?.warehouse?.id
+        Boolean hasFacilityStorekeeperPolicy = hasWarehouseContext &&
+                userService.hasFacilityStorekeeperPolicy(session.user, session?.warehouse?.id)
+        Boolean isStorekeeperAllowedAction = hasFacilityStorekeeperPolicy && needFacilityStorekeeper(controllerName, actionName, params, request)
+        Boolean isStorekeeperRestrictedAction = hasFacilityStorekeeperPolicy && needStorekeeperDeniedAction(controllerName, actionName, params, request)
+
+        if (isStorekeeperRestrictedAction) {
+            log.info("User ${session?.user?.username} does not have access to ${controllerName}/${actionName} in location ${session?.warehouse?.name}")
+            redirect(controller: "errors", action: "handleForbidden")
+            return false
+        }
 
         def rules = grailsApplication.config.openboxes.security.rbac.rules
         def rule = rules.find { it.controller == controllerName && it.actions.contains(actionName) ||
@@ -148,9 +167,11 @@ class RoleInterceptor {
         // Authorized users
         def isNotAuthenticated = !userService.isUserInRole(session.user, RoleType.ROLE_AUTHENTICATED)
         def isNotBrowser = !userService.canUserBrowse(session.user) && !needRequestorOrManager(controllerName, actionName)
-        def isNotManager = needManager(controllerName, actionName) && (needRequestorOrManager(controllerName, actionName) ? !userService.isUserManager(session.user) && !userService.isUserRequestor(session.user) : !userService.isUserManager(session.user))
+        def isNotManager = needManager(controllerName, actionName) &&
+            !isStorekeeperAllowedAction &&
+            (needRequestorOrManager(controllerName, actionName) ? !userService.isUserManager(session.user) && !userService.isUserRequestor(session.user) : !userService.isUserManager(session.user))
         def isNotAdmin = needAdmin(controllerName, actionName) && !userService.isUserAdmin(session.user)
-        def isNotSuperuser = needSuperuser(controllerName, actionName) && !userService.isSuperuser(session.user)
+        def isNotSuperuser = needSuperuser(controllerName, actionName) && !isStorekeeperAllowedAction && !userService.isSuperuser(session.user)
         def hasNoRoleInvoice = needInvoice(controllerName, actionName) && !userService.hasRoleInvoice(session.user)
         def isNotRequestor = needRequestorOrManager(controllerName, actionName) && !userService.isUserRequestor(session.user)
         def isNotRequestorOrManager = needRequestorOrManager(controllerName, actionName) ? !userService.isUserManager(session.user) && !userService.isUserRequestor(session.user) : false
@@ -202,4 +223,90 @@ class RoleInterceptor {
     static Boolean needAuthenticatedActions(controllerName, actionName) {
         authenticatedActions[controllerName]?.contains(actionName)
     }
+
+    static Boolean needFacilityStorekeeper(controllerName, actionName, params = null, request = null) {
+        if (needStorekeeperDeniedAction(controllerName, actionName, params, request)) {
+            return false
+        }
+        return facilityStorekeeperActions[controllerName]?.contains("*") ||
+            facilityStorekeeperActions[controllerName]?.contains(actionName)
+    }
+
+    static Boolean needStorekeeperDeniedAction(controllerName, actionName, params, request = null) {
+        // Purchasing: no access
+        if (controllerName in ['purchaseOrder', 'purchaseOrderApi']) {
+            return true
+        }
+        if (controllerName == 'supplier') {
+            return true
+        }
+
+        // Outbound: no access
+        if (controllerName == 'stockMovement') {
+            if (actionName in ['createOutbound', 'importOutboundStockMovement', 'verifyRequest']) {
+                return true
+            }
+            if (actionName == 'list' && params.direction?.toUpperCase() == "OUTBOUND") {
+                return true
+            }
+        }
+        if (controllerName == 'stockMovementApi') {
+            String direction = params.direction ?: request?.JSON?.direction
+            if (actionName == 'list' && direction?.toUpperCase() == "OUTBOUND") {
+                return true
+            }
+            if (actionName == 'create' && direction?.toUpperCase() == "OUTBOUND") {
+                return true
+            }
+        }
+        if (controllerName == 'stockTransfer' && actionName == 'createOutboundReturn') {
+            return true
+        }
+
+        // Stocklists: no access
+        if (controllerName in ['requisitionTemplate', 'stocklist', 'stocklistApi', 'stocklistItemApi', 'stocklistManagement']) {
+            return true
+        }
+
+        // Products: read-only
+        if (controllerName == 'product' && actionName in [
+            'batchEdit',
+            'batchEditProperties',
+            'create',
+            'save',
+            'edit',
+            'update',
+            'delete',
+            'deleteProducts',
+            'importAsCsv',
+            'savePackage',
+            'deleteDocument',
+            'deleteProductComponent',
+            'deleteProductGroup',
+            'editProductSynonym',
+            'editProductSynonymDialog',
+            'deleteSynonym',
+        ]) {
+            return true
+        }
+        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete']) {
+            return true
+        }
+
+        // Inbound: no access to "Create Inbound Movement" only
+        if (controllerName == 'stockMovement' && actionName == 'createInbound') {
+            return !params.id
+        }
+        if (controllerName == 'stockMovementApi' && actionName == 'create') {
+            String direction = params.direction ?: request?.JSON?.direction
+            return direction?.toUpperCase() == "INBOUND"
+        }
+
+        // Legacy inbound shipment creation should remain blocked for storekeeper
+        if (controllerName == 'createShipmentWorkflow' && actionName == 'createShipment') {
+            return !params.id && params.type?.toUpperCase() == "INCOMING"
+        }
+
+        return false
+    }
 }
diff --git a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
index 69e99ad3122..acca831537a 100644
--- a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
@@ -162,6 +162,7 @@ class ApiController {
         // TODO: investigate why in isUserManager method in userService there is Assistant role included
         ArrayList<RoleType> managerRoles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_MANAGER]
         boolean isUserManager = userService.getEffectiveRoles(user).any { managerRoles.contains(it.roleType) }
+        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session.warehouse?.id)
         def supportedActivities = location.supportedActivities ?: location.locationType.supportedActivities
         boolean isImpersonated = session.impersonateUserId ? true : false
         def buildNumber = gitProperties.shortCommitId
@@ -207,6 +208,7 @@ class ApiController {
                 isUserApprover                : isUserApprover,
                 isUserRequestApprover         : isUserRequestApprover,
                 isUserManager                 : isUserManager,
+                hasFacilityStorekeeperPolicy  : hasFacilityStorekeeperPolicy,
                 supportedActivities           : supportedActivities,
                 isImpersonated                : isImpersonated,
                 grailsVersion                 : grailsVersion,
diff --git a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
index 04bb10629a0..b0635e2a205 100644
--- a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
@@ -61,6 +61,7 @@ class LocationApiController extends BaseDomainApiController {
         def isRequestor = userService.isUserRequestor(currentUser)
         def requestorInAnyLocation = userService.hasRoleRequestorInAnyLocations(currentUser)
         def inRoleBrowser = currentUser.hasDefaultRole(RoleType.ROLE_BROWSER)
+        def inRoleFacilityStorekeeper = currentUser.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
         def inRoleAssistant = currentUser.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = currentUser.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = currentUser.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -81,7 +82,7 @@ class LocationApiController extends BaseDomainApiController {
                 locations += locationService.getRequestorLocations(currentUser)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (params.locationChooser && !inRoleBrowser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 currentUser.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/controllers/org/pih/warehouse/order/PurchaseOrderController.groovy b/grails-app/controllers/org/pih/warehouse/order/PurchaseOrderController.groovy
index 6d171b9a5ac..bf8e0713769 100644
--- a/grails-app/controllers/org/pih/warehouse/order/PurchaseOrderController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/order/PurchaseOrderController.groovy
@@ -18,6 +18,7 @@ class PurchaseOrderController {
 
 
     def orderService
+    def userService
 
     def index() {
         redirect(action: "create")
@@ -29,6 +30,9 @@ class PurchaseOrderController {
 
 
     def create() {
+        if (userService.hasFacilityStorekeeperPolicy(session.user, session?.warehouse?.id)) {
+            throw new UnsupportedOperationException("${warehouse.message(code: 'errors.noPermissions.label')}")
+        }
         Location currentLocation = Location.get(session.warehouse.id)
         User user = User.get(session.user.id)
         if (!currentLocation.supports(ActivityCode.PLACE_ORDER)) {
@@ -65,6 +69,9 @@ class PurchaseOrderController {
             return
         }
         Order order = params.order?.id ? Order.get(params.order.id) : new Order()
+        if (userService.hasFacilityStorekeeperPolicy(session.user, session?.warehouse?.id) && !order?.id) {
+            throw new UnsupportedOperationException("${warehouse.message(code: 'errors.noPermissions.label')}")
+        }
 
         if (order.orderItems && order.origin.id != params.origin.id) {
             order.errors.reject("purchaseOrder.supplierError.label", "Cannot change the supplier for a PO with item lines.")
diff --git a/grails-app/domain/org/pih/warehouse/core/User.groovy b/grails-app/domain/org/pih/warehouse/core/User.groovy
index 5ef75a70a4a..5d508573227 100755
--- a/grails-app/domain/org/pih/warehouse/core/User.groovy
+++ b/grails-app/domain/org/pih/warehouse/core/User.groovy
@@ -96,16 +96,18 @@ class User extends Person {
     }
 
     boolean hasPrimaryRole(Location currentLocation) {
-        def roles = getEffectiveRoles(currentLocation)
-        return roles.roleType.find { RoleType.listPrimaryRoleTypes().contains(it) }
+        def roleNames = getEffectiveRoles(currentLocation)*.roleType*.name().findAll { it } as Set<String>
+        def primaryRoleNames = RoleType.listPrimaryRoleTypes()*.name() as Set<String>
+        return roleNames.any { primaryRoleNames.contains(it) }
     }
 
     /**
      * @return does user have exact roles, either specified as global or location based
      */
     boolean hasRoles(Location location, List<RoleType> roleTypes) {
-        List userRoles = getEffectiveRoles(location)?.collect { it.roleType }
-        return roleTypes?.every { userRoles.contains(it) }
+        Set<String> userRoleNames = (getEffectiveRoles(location)?.collect { it.roleType?.name() }?.findAll { it } ?: []) as Set<String>
+        Set<String> requiredRoleNames = (roleTypes?.collect { it?.name() }?.findAll { it } ?: []) as Set<String>
+        return requiredRoleNames.every { userRoleNames.contains(it) }
     }
 
     /**
diff --git a/grails-app/i18n/messages.properties b/grails-app/i18n/messages.properties
index 4b8333fd77a..c50e76eaebe 100644
--- a/grails-app/i18n/messages.properties
+++ b/grails-app/i18n/messages.properties
@@ -1074,6 +1074,7 @@ enum.RoleType.ROLE_ADMIN=Administrator
 enum.RoleType.ROLE_MANAGER=Manager
 enum.RoleType.ROLE_ASSISTANT=Assistant
 enum.RoleType.ROLE_BROWSER=Browser
+enum.RoleType.ROLE_FACILITY_STOREKEEPER=Facility Storekeeper
 enum.RoleType.ROLE_PURCHASE_APPROVER=Purchase approver
 enum.RoleType.ROLE_REQUISITION_APPROVER=Request approver
 # Event messages
diff --git a/grails-app/migrations/custom/2026-05-15-add-facility-storekeeper-role.groovy b/grails-app/migrations/custom/2026-05-15-add-facility-storekeeper-role.groovy
new file mode 100644
index 00000000000..266a64138ff
--- /dev/null
+++ b/grails-app/migrations/custom/2026-05-15-add-facility-storekeeper-role.groovy
@@ -0,0 +1,15 @@
+databaseChangeLog = {
+    changeSet(author: "codex", id: "202605151200-0") {
+        preConditions(onFail: "MARK_RAN") {
+            sqlCheck(expectedResult: "0", "select count(*) from role where role_type = 'ROLE_FACILITY_STOREKEEPER'")
+        }
+
+        insert(tableName: "role") {
+            column(name: "id", value: "ROLE_FACILITY_STOREKEEPER")
+            column(name: "version", valueNumeric: "0")
+            column(name: "description", value: "Role for facility storekeepers with inventory-change access and restricted purchasing/shipment creation access")
+            column(name: "role_type", value: "ROLE_FACILITY_STOREKEEPER")
+            column(name: "name", value: "Facility Storekeeper")
+        }
+    }
+}
diff --git a/grails-app/migrations/custom/changelog.groovy b/grails-app/migrations/custom/changelog.groovy
index 9fc44bae2e8..1862773e321 100644
--- a/grails-app/migrations/custom/changelog.groovy
+++ b/grails-app/migrations/custom/changelog.groovy
@@ -12,5 +12,5 @@
  * See .claude/rules/custom-package-isolation.md for the full rules.
  */
 databaseChangeLog = {
-    // No custom migrations yet — append `include file:` lines here as they ship.
+    include file: '2026-05-15-add-facility-storekeeper-role.groovy'
 }
diff --git a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
index df02003980d..bb91d72f5bb 100644
--- a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
+++ b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
@@ -20,6 +20,14 @@ class MegamenuService {
     GrailsApplication grailsApplication
     def grailsLinkGenerator
 
+    private static final List<String> STOREKEEPER_HIDDEN_SECTIONS = [
+            "purchasing",
+            "outbound",
+            "requisitionTemplate",
+    ]
+
+    private static final String STOREKEEPER_INBOUND_CREATE_HREF = "/stockMovement/createInbound"
+
     private getMessageTagLib() {
         return grailsApplication.mainContext.getBean('org.pih.warehouse.MessageTagLib')
     }
@@ -150,6 +158,30 @@ class MegamenuService {
                 }
             }
         }
+        if (userService.hasFacilityStorekeeperPolicy(user, location?.id)) {
+            parsedMenuConfig = applyFacilityStorekeeperMenuPolicy(parsedMenuConfig)
+        }
         return parsedMenuConfig
     }
+
+    private ArrayList applyFacilityStorekeeperMenuPolicy(ArrayList menuConfig) {
+        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
+            !STOREKEEPER_HIDDEN_SECTIONS.contains(section?.id)
+        } as ArrayList
+
+        filteredMenu.each { section ->
+            if (section?.id == "inbound" && section?.subsections) {
+                section.subsections = section.subsections.findAll { it != null }.collect { subsection ->
+                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
+                        String href = menuItem?.href ?: ""
+                        !href.contains(STOREKEEPER_INBOUND_CREATE_HREF)
+                    } ?: []
+                    return subsection
+                }
+                section.subsections = section.subsections.findAll { it?.menuItems }
+            }
+        }
+
+        return filteredMenu
+    }
 }
diff --git a/grails-app/services/org/pih/warehouse/core/LocationService.groovy b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
index 8e76c53877e..14986843de3 100644
--- a/grails-app/services/org/pih/warehouse/core/LocationService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
@@ -260,6 +260,7 @@ class LocationService {
         def isRequestor = userService.isUserRequestor(user)
         def requestorInAnyLocation = userService.hasRoleRequestorInAnyLocations(user)
         def inRoleBrowser = user.hasDefaultRole(RoleType.ROLE_BROWSER)
+        def inRoleFacilityStorekeeper = user.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
         def inRoleAssistant = user.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = user.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = user.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -278,7 +279,7 @@ class LocationService {
                 locations += getRequestorLocations(user)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (!inRoleBrowser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 user.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/services/org/pih/warehouse/core/UserService.groovy b/grails-app/services/org/pih/warehouse/core/UserService.groovy
index 6d7bfa0b265..72fda66d96c 100644
--- a/grails-app/services/org/pih/warehouse/core/UserService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/UserService.groovy
@@ -149,8 +149,8 @@ class UserService {
     Boolean isSuperuser(User u) {
         if (u) {
             def user = User.get(u.id)
-            def roles = [RoleType.ROLE_SUPERUSER]
-            return getEffectiveRoles(user).any { roles.contains(it.roleType) }
+            Set<String> roleNames = [RoleType.ROLE_SUPERUSER.name()] as Set<String>
+            return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
         }
         return false
     }
@@ -158,8 +158,8 @@ class UserService {
     Boolean isUserAdmin(User u) {
         if (u) {
             def user = User.get(u.id)
-            def roles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN]
-            return getEffectiveRoles(user).any { roles.contains(it.roleType) }
+            Set<String> roleNames = [RoleType.ROLE_SUPERUSER.name(), RoleType.ROLE_ADMIN.name()] as Set<String>
+            return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
         }
         return false
     }
@@ -167,8 +167,13 @@ class UserService {
     Boolean isUserManager(User u) {
         if (u) {
             def user = User.get(u.id)
-            def roles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_MANAGER, RoleType.ROLE_ASSISTANT]
-            return getEffectiveRoles(user).any { roles.contains(it.roleType) }
+            Set<String> roleNames = [
+                    RoleType.ROLE_SUPERUSER.name(),
+                    RoleType.ROLE_ADMIN.name(),
+                    RoleType.ROLE_MANAGER.name(),
+                    RoleType.ROLE_ASSISTANT.name()
+            ] as Set<String>
+            return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
         }
         return false
     }
@@ -195,8 +200,15 @@ class UserService {
     Boolean canUserBrowse(User u) {
         if (u) {
             def user = User.get(u.id)
-            def roles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_MANAGER, RoleType.ROLE_BROWSER, RoleType.ROLE_ASSISTANT]
-            return getEffectiveRoles(user).any { roles.contains(it.roleType) }
+            Set<String> roleNames = [
+                    RoleType.ROLE_SUPERUSER.name(),
+                    RoleType.ROLE_ADMIN.name(),
+                    RoleType.ROLE_MANAGER.name(),
+                    RoleType.ROLE_BROWSER.name(),
+                    RoleType.ROLE_ASSISTANT.name(),
+                    RoleType.ROLE_FACILITY_STOREKEEPER.name()
+            ] as Set<String>
+            return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
         }
         return false
     }
@@ -256,6 +268,31 @@ class UserService {
         return false
     }
 
+    Boolean hasRoleFacilityStorekeeper(User u) {
+        if (u) {
+            def user = User.get(u.id)
+            return getEffectiveRoles(user).any { Role role -> role.roleType?.name() == RoleType.ROLE_FACILITY_STOREKEEPER.name() }
+        }
+        return false
+    }
+
+    Boolean hasFacilityStorekeeperPolicy(User u, String locationId) {
+        if (u) {
+            def user = User.get(u.id)
+            Location location = Location.get(locationId)
+            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
+            Set<String> higherCoreRoleNames = [
+                    RoleType.ROLE_SUPERUSER.name(),
+                    RoleType.ROLE_ADMIN.name(),
+                    RoleType.ROLE_MANAGER.name(),
+                    RoleType.ROLE_ASSISTANT.name()
+            ]
+            return effectiveRoleNames.contains(RoleType.ROLE_FACILITY_STOREKEEPER.name()) &&
+                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
+        }
+        return false
+    }
+
     // Checks if requestor role exist for any location - for location chooser purposes
     Boolean hasRoleRequestorInAnyLocations(User u) {
         if (u) {
@@ -287,11 +324,12 @@ class UserService {
     }
 
     Boolean isUserInRole(String userId, Collection roleTypes) {
-        Collection acceptedRoleTypes = RoleType.expand(roleTypes)
+        Set<String> acceptedRoleTypeNames = (RoleType.expand(roleTypes)*.name()) as Set<String>
         User user = getUser(userId)
         return getEffectiveRoles(user).any { Role role ->
-            boolean acceptedRoleType = acceptedRoleTypes.contains(role.roleType)
-            log.debug "Is role ${role.roleType} in ${acceptedRoleTypes} = ${acceptedRoleType}"
+            String roleName = role.roleType?.name()
+            boolean acceptedRoleType = acceptedRoleTypeNames.contains(roleName)
+            log.debug "Is role ${roleName} in ${acceptedRoleTypeNames} = ${acceptedRoleType}"
             return acceptedRoleType
         }
     }
diff --git a/grails-app/views/order/_summary.gsp b/grails-app/views/order/_summary.gsp
index 95e0740deed..ca819c138e0 100644
--- a/grails-app/views/order/_summary.gsp
+++ b/grails-app/views/order/_summary.gsp
@@ -62,10 +62,12 @@
 <div class="buttonBar">
     <div class="button-container">
         <g:if test="${!orderInstance?.id}">
-            <g:link controller="order" action="create" class="button">
-                <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-                <warehouse:message code="default.create.label" args="[g.message(code: 'order.label')]" default="Create purchase order" />
-            </g:link>
+            <g:isUserInRole roles="[org.pih.warehouse.core.RoleType.ROLE_ASSISTANT]">
+                <g:link controller="order" action="create" class="button">
+                    <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+                    <warehouse:message code="default.create.label" args="[g.message(code: 'order.label')]" default="Create purchase order" />
+                </g:link>
+            </g:isUserInRole>
         </g:if>
         <g:if test="${orderInstance?.id}">
             <g:hasRoleApprover>
@@ -88,10 +90,12 @@
                     <img src="${resource(dir: 'images/icons/silk', file: 'application_view_list.png')}" />&nbsp;
                     <warehouse:message code="default.list.label" args="[g.message(code: 'orders.label')]" default="List orders"/>
                 </g:link>
-                <g:link controller="order" action="create" class="button">
-                    <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-                    <warehouse:message code="default.create.label" args="[g.message(code: 'order.label')]" default="Create order" />
-                </g:link>
+                <g:isUserInRole roles="[org.pih.warehouse.core.RoleType.ROLE_ASSISTANT]">
+                    <g:link controller="order" action="create" class="button">
+                        <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+                        <warehouse:message code="default.create.label" args="[g.message(code: 'order.label')]" default="Create order" />
+                    </g:link>
+                </g:isUserInRole>
                 <div class="button-group right">
                     <g:link controller="order" action="addComment" id="${orderInstance?.id}" class="button">
                         <img src="${resource(dir: 'images/icons/silk', file: 'comment_add.png')}" />&nbsp;
diff --git a/grails-app/views/order/list.gsp b/grails-app/views/order/list.gsp
index 3b42682d770..b90ca3b8b2b 100644
--- a/grails-app/views/order/list.gsp
+++ b/grails-app/views/order/list.gsp
@@ -23,16 +23,18 @@
 			</g:if>
 
 			<div class="buttonBar">
-				<g:supports activityCode="${ActivityCode.PLACE_ORDER}">
-					<g:link data-testid="create-shipment-button" controller="order" action="create" class="button">
+				<g:isUserInRole roles="[org.pih.warehouse.core.RoleType.ROLE_ASSISTANT]">
+					<g:supports activityCode="${ActivityCode.PLACE_ORDER}">
+						<g:link data-testid="create-shipment-button" controller="order" action="create" class="button">
+							<img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+							<warehouse:message code="default.create.label" args="[g.message(code: 'order.label')]" default="Create purchase order" />
+						</g:link>
+					</g:supports>
+					<g:link data-testid="create-shipment-button" controller="stockMovement" action="createCombinedShipments" class="button" params="[direction:'INBOUND']">
 						<img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-						<warehouse:message code="default.create.label" args="[g.message(code: 'order.label')]" default="Create purchase order" />
+						<warehouse:message code="default.create.label" args="[warehouse.message(code: 'shipmentFromPO.label')]"/>
 					</g:link>
-				</g:supports>
-				<g:link data-testid="create-shipment-button" controller="stockMovement" action="createCombinedShipments" class="button" params="[direction:'INBOUND']">
-					<img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-					<warehouse:message code="default.create.label" args="[warehouse.message(code: 'shipmentFromPO.label')]"/>
-				</g:link>
+				</g:isUserInRole>
 			</div>
 
 			<div class="yui-gf">
diff --git a/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx b/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx
index 32bee5b2914..537466524ec 100644
--- a/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx
+++ b/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx
@@ -8,18 +8,24 @@ import Button from 'components/form-elements/Button';
 import { ORDER_URL, STOCK_MOVEMENT_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const PurchaseOrderListHeader = ({ history, supportedActivities }) => (
+const PurchaseOrderListHeader = ({
+  history,
+  supportedActivities,
+  hasFacilityStorekeeperPolicy,
+}) => (
   <div className="d-flex list-page-header">
     <span className="d-flex align-self-center title">
       <Translate id="react.purchaseOrder.list.label" defaultMessage="Purchase Order List" />
     </span>
     <div className="d-flex justify-content-end buttons align-items-center">
+      {!hasFacilityStorekeeperPolicy && (
       <Button
         defaultLabel="Create Shipment from PO"
         label="react.purchaseOrder.createShipmentFromPo.label"
         onClick={() => history.push({ pathname: STOCK_MOVEMENT_URL.createCombinedShipments(), search: 'direction=INBOUND' })}
       />
-      {supportedActivities.includes('PLACE_ORDER')
+      )}
+      {supportedActivities.includes('PLACE_ORDER') && !hasFacilityStorekeeperPolicy
         && (
         <a href={ORDER_URL.create()}>
           <Button
@@ -35,6 +41,7 @@ const PurchaseOrderListHeader = ({ history, supportedActivities }) => (
 
 const mapStateToProps = (state) => ({
   supportedActivities: state.session.supportedActivities,
+  hasFacilityStorekeeperPolicy: state.session.hasFacilityStorekeeperPolicy,
 });
 
 export default withRouter(connect(mapStateToProps)(PurchaseOrderListHeader));
@@ -44,4 +51,9 @@ PurchaseOrderListHeader.propTypes = {
     push: PropTypes.func.isRequired,
   }).isRequired,
   supportedActivities: PropTypes.arrayOf(PropTypes.string).isRequired,
+  hasFacilityStorekeeperPolicy: PropTypes.bool,
+};
+
+PurchaseOrderListHeader.defaultProps = {
+  hasFacilityStorekeeperPolicy: false,
 };
diff --git a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
index 5fbf3bb7bc4..bc584164fb2 100644
--- a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
+++ b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
@@ -32,6 +32,7 @@ import 'react-confirm-alert/src/react-confirm-alert.css';
 const PurchaseOrderListTable = ({
   supportedActivities,
   highestRole,
+  hasFacilityStorekeeperPolicy,
   translate,
   currencyCode,
   allStatuses,
@@ -81,6 +82,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.edit.label',
       defaultLabel: 'Edit order',
       leftIcon: <RiPencilLine />,
+      hiddenForFacilityStorekeeper: true,
       statuses: ['PENDING'],
       activityCode: ['PLACE_ORDER'],
       href: PURCHASE_ORDER_URL.edit,
@@ -89,6 +91,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.editLineItems.label',
       defaultLabel: 'Edit line items',
       leftIcon: <RiListUnordered />,
+      hiddenForFacilityStorekeeper: true,
       statuses: ['PENDING'],
       activityCode: ['PLACE_ORDER'],
       href: PURCHASE_ORDER_URL.addItems,
@@ -97,6 +100,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.placeOrder.label',
       defaultLabel: 'Place order',
       leftIcon: <RiShoppingCartLine />,
+      hiddenForFacilityStorekeeper: true,
       statuses: ['PENDING'],
       activityCode: ['PLACE_ORDER'],
       href: ORDER_URL.placeOrder,
@@ -112,6 +116,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.cancelOrder.label',
       defaultLabel: 'Cancel order',
       leftIcon: <RiCloseLine />,
+      hiddenForFacilityStorekeeper: true,
       activityCode: ['PLACE_ORDER'],
       onClick: () => cancelOrder(),
     },
@@ -119,6 +124,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.rollbackOrder.label',
       defaultLabel: 'Rollback Order',
       leftIcon: <RiArrowGoBackLine />,
+      hiddenForFacilityStorekeeper: true,
       minimumRequiredRole: 'Superuser',
       activityCode: ['PLACE_ORDER'],
       // Display for statuses > PENDING
@@ -130,6 +136,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.delete.label',
       defaultLabel: 'Delete',
       leftIcon: <RiDeleteBinLine />,
+      hiddenForFacilityStorekeeper: true,
       minimumRequiredRole: 'Assistant',
       variant: 'danger',
       onClick: (id) => deleteHandler(id),
@@ -154,6 +161,8 @@ const PurchaseOrderListTable = ({
           actions={findActions(actions, row, {
             supportedActivities,
             highestRole,
+            customFilter: (action) =>
+              !(hasFacilityStorekeeperPolicy && action.hiddenForFacilityStorekeeper),
           })}
           id={row.original.id}
         />
@@ -303,7 +312,7 @@ const PurchaseOrderListTable = ({
       sortable: false,
       minWidth: 260,
     },
-  ], [supportedActivities, highestRole, actions]);
+  ], [supportedActivities, highestRole, actions, hasFacilityStorekeeperPolicy]);
 
   const totalAmount = () => `${translate('react.purchaseOrder.totalAmount.label', 'Total amount')}: ${tableData.totalPrice.toLocaleString([locale, 'en'])} ${currencyCode}`;
 
@@ -375,6 +384,7 @@ const PurchaseOrderListTable = ({
 const mapStateToProps = (state) => ({
   supportedActivities: state.session.supportedActivities,
   highestRole: state.session.highestRole,
+  hasFacilityStorekeeperPolicy: state.session.hasFacilityStorekeeperPolicy,
   translate: translateWithDefaultMessage(getTranslate(state.localize)),
   currencyCode: state.session.currencyCode,
   allStatuses: state.purchaseOrder.statuses,
@@ -387,6 +397,7 @@ PurchaseOrderListTable.propTypes = {
   filterParams: PropTypes.shape({}).isRequired,
   supportedActivities: PropTypes.arrayOf(PropTypes.string).isRequired,
   highestRole: PropTypes.string.isRequired,
+  hasFacilityStorekeeperPolicy: PropTypes.bool,
   translate: PropTypes.func.isRequired,
   currencyCode: PropTypes.string.isRequired,
   allStatuses: PropTypes.arrayOf(PropTypes.shape({
@@ -397,3 +408,7 @@ PurchaseOrderListTable.propTypes = {
   })).isRequired,
   locale: PropTypes.string.isRequired,
 };
+
+PurchaseOrderListTable.defaultProps = {
+  hasFacilityStorekeeperPolicy: false,
+};
diff --git a/src/js/consts/roleType.js b/src/js/consts/roleType.js
index c8c7a7e1d75..b9f0d377bbb 100644
--- a/src/js/consts/roleType.js
+++ b/src/js/consts/roleType.js
@@ -36,6 +36,7 @@ const RoleType = {
   ROLE_RECEIVER: 'ROLE_RECEIVER',
   ROLE_SHIPMENT_CLERK: 'ROLE_SHIPMENT_CLERK',
   ROLE_STOCKER: 'ROLE_STOCKER',
+  ROLE_FACILITY_STOREKEEPER: 'ROLE_FACILITY_STOREKEEPER',
   ROLE_WORKER: 'ROLE_WORKER',
   ROLE_PHARMACIST: 'ROLE_PHARMACIST',
   ROLE_PHARMACY_TECH: 'ROLE_PHARMACY_TECH',
diff --git a/src/js/hooks/useUserHasPermissions.js b/src/js/hooks/useUserHasPermissions.js
index 693e78a63e5..f16c6eb1412 100644
--- a/src/js/hooks/useUserHasPermissions.js
+++ b/src/js/hooks/useUserHasPermissions.js
@@ -56,6 +56,9 @@ const useUserHasPermissions = ({ minRequiredRole, supplementalRoles = [] }) => {
         return isSuperuser;
       case RoleType.ROLE_ADMIN:
         return isAdmin;
+      case RoleType.ROLE_MANAGER:
+        return isSuperuser || isAdmin
+          || hasEveryRole([RoleType.ROLE_MANAGER]);
       case RoleType.ROLE_PURCHASE_APPROVER:
         return isApprover;
       case RoleType.ROLE_REQUISITION_APPROVER:
diff --git a/src/js/reducers/sessionReducer.jsx b/src/js/reducers/sessionReducer.jsx
index 86ab7732bf7..53fc014f293 100644
--- a/src/js/reducers/sessionReducer.jsx
+++ b/src/js/reducers/sessionReducer.jsx
@@ -24,6 +24,7 @@ const initialState = {
   isUserAdmin: false,
   isUserApprover: false,
   isUserRequestApprover: false,
+  hasFacilityStorekeeperPolicy: false,
   supportedActivities: [],
   menuConfig: [],
   menuSectionsUrlParts: {},
@@ -99,6 +100,7 @@ export default function (state = initialState, action) {
         isUserApprover: _.get(action, 'payload.data.data.isUserApprover', false),
         isUserRequestApprover: _.get(action, 'payload.data.data.isUserRequestApprover', false),
         isUserManager: _.get(action, 'payload.data.data.isUserManager', false),
+        hasFacilityStorekeeperPolicy: _.get(action, 'payload.data.data.hasFacilityStorekeeperPolicy', false),
         supportedActivities: _.get(action, 'payload.data.data.supportedActivities'),
         activeLanguage: _.get(action, 'payload.data.data.activeLanguage'),
         activeLanguageTag: _.get(action, 'payload.data.data.activeLanguageTag'),
diff --git a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
index 672368f538c..719926888a7 100644
--- a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
+++ b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
@@ -63,6 +63,7 @@ enum RoleType {
     ROLE_RECEIVER('Receiver', 50),
     ROLE_SHIPMENT_CLERK('Shipment Clerk', 50),
     ROLE_STOCKER('Stocker', 50),
+    ROLE_FACILITY_STOREKEEPER('Facility Storekeeper', 4),
     ROLE_WORKER('Worker', 50),
 
     // Pharmacy roles
@@ -114,6 +115,7 @@ enum RoleType {
         [
                 ROLE_AUTHENTICATED,
                 ROLE_BROWSER,
+                ROLE_FACILITY_STOREKEEPER,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -161,6 +163,7 @@ enum RoleType {
         [
                 ROLE_AUTHENTICATED,
                 ROLE_BROWSER,
+                ROLE_FACILITY_STOREKEEPER,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -188,6 +191,7 @@ enum RoleType {
     static listRoleTypesForLocationChooser() {
         return [
                 ROLE_ASSISTANT,
+                ROLE_FACILITY_STOREKEEPER,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
                 ROLE_SUPERUSER,

From 541183f2312d10649c8ec6f68b439ae04db42c9c Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Wed, 20 May 2026 09:50:16 -0300
Subject: [PATCH 02/10] feat(rbac): add regional warehouse role policy and UI
 restrictions

Introduce ROLE_REGIONAL_WAREHOUSE across backend and frontend role catalogs, including database migration and i18n label updates.

Add policy checks in interceptors/services to allow inventory and outbound operations while denying purchasing and inbound movement creation for regional warehouse users.

Update menu/session/location chooser and requisition/stock list UI behavior to expose role-aware client state and hide restricted actions.
---
 grails-app/conf/runtime.groovy                |   2 +-
 .../org/pih/warehouse/RoleInterceptor.groovy  | 104 +++++++++++++++++-
 .../pih/warehouse/api/ApiController.groovy    |   8 +-
 .../api/LocationApiController.groovy          |   3 +-
 .../warehouse/user/DashboardController.groovy |  18 ++-
 .../pih/warehouse/user/UserController.groovy  |   3 +-
 grails-app/i18n/messages.properties           |   1 +
 ...6-05-19-add-regional-warehouse-role.groovy |  15 +++
 grails-app/migrations/custom/changelog.groovy |   1 +
 .../pih/warehouse/api/MegamenuService.groovy  |  58 ++++++++--
 .../pih/warehouse/core/LocationService.groovy |   3 +-
 .../org/pih/warehouse/core/UserService.groovy |  28 ++++-
 .../org/pih/warehouse/AuthTagLib.groovy       |  18 ++-
 .../views/requisitionTemplate/_list.gsp       |   8 +-
 .../views/requisitionTemplate/_summary.gsp    |  12 +-
 grails-app/views/requisitionTemplate/edit.gsp |  12 +-
 grails-app/views/requisitionTemplate/list.gsp |   4 +-
 .../components/stock-list/StockListHeader.jsx |   6 +-
 .../components/stock-list/StockListTable.jsx  |  36 ++++--
 src/js/consts/roleType.js                     |   1 +
 src/js/reducers/sessionReducer.jsx            |   2 +
 .../org/pih/warehouse/core/RoleType.groovy    |   4 +
 22 files changed, 293 insertions(+), 54 deletions(-)
 create mode 100644 grails-app/migrations/custom/2026-05-19-add-regional-warehouse-role.groovy

diff --git a/grails-app/conf/runtime.groovy b/grails-app/conf/runtime.groovy
index c5ebed1a505..3d25a2a46ac 100644
--- a/grails-app/conf/runtime.groovy
+++ b/grails-app/conf/runtime.groovy
@@ -397,7 +397,7 @@ openboxes {
             defaultLabel = "Stock Lists"
             menuItems = [
                 [label: "requisitionTemplates.list.label", defaultLabel: "List stock lists", href: "/requisitionTemplate/list"],
-                [label: "requisitionTemplates.create.label", defaultLabel: "Create stock list", href: "/requisitionTemplate/create", minimumRequiredRole: RoleType.ROLE_ADMIN],
+                [label: "requisitionTemplates.create.label", defaultLabel: "Create stock list", href: "/requisitionTemplate/create", supplementalRoles: [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_REGIONAL_WAREHOUSE]],
             ]
         }
         configuration {
diff --git a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
index 1ce3ef7697e..576f1dd9fa2 100644
--- a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
+++ b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
@@ -74,6 +74,38 @@ class RoleInterceptor {
         'stockTransfer': ['create', 'edit', 'createInboundReturn'],
         'stockTransferApi': ['list', 'read', 'create', 'update', 'stockTransferCandidates', 'returnCandidates']
     ]
+    def static regionalWarehouseActions = [
+        'inventory'        : ['createInboundTransfer', 'createConsumed', 'editTransaction', 'deleteTransaction', 'saveTransaction'],
+        'inventoryItem'    : ['showRecordInventory', 'adjustStock', 'transferStock'],
+        'stockTransfer'    : ['create', 'edit', 'createInboundReturn', 'createOutboundReturn'],
+        'stockTransferApi' : ['list', 'read', 'create', 'update', 'stockTransferCandidates', 'returnCandidates'],
+        'stockMovement'    : ['createOutbound', 'importOutboundStockMovement', 'verifyRequest'],
+        'stockMovementApi' : ['list', 'create'],
+        'stocklistApi'     : ['list', 'read', 'create', 'update', 'delete', 'sendMail', 'clear', 'clone', 'publish', 'unpublish', 'export'],
+        'stocklistItemApi' : ['list', 'read', 'create', 'update', 'remove', 'availableStocklists'],
+        'requisitionTemplate': [
+                'create',
+                'save',
+                'edit',
+                'editHeader',
+                'update',
+                'delete',
+                'clear',
+                'clone',
+                'publish',
+                'unpublish',
+                'export',
+                'batch',
+                'importData',
+                'doImport',
+                'sendMail',
+                'addToRequisitionItems',
+                'removeFromRequisitionItems',
+                'changeSortOrderAlpha',
+                'changeSortOrderChrono',
+        ],
+        'json'               : ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems']
+    ]
 
     def static invoiceActions = [
         'invoice': ['*']
@@ -114,16 +146,24 @@ class RoleInterceptor {
     boolean before() {
         // Apply custom location-scoped role policy only after a warehouse context exists.
         Boolean hasWarehouseContext = session?.warehouse?.id
+        Boolean hasRegionalWarehousePolicy = hasWarehouseContext &&
+                userService.hasRegionalWarehousePolicy(session.user, session?.warehouse?.id)
         Boolean hasFacilityStorekeeperPolicy = hasWarehouseContext &&
+                !hasRegionalWarehousePolicy &&
                 userService.hasFacilityStorekeeperPolicy(session.user, session?.warehouse?.id)
         Boolean isStorekeeperAllowedAction = hasFacilityStorekeeperPolicy && needFacilityStorekeeper(controllerName, actionName, params, request)
         Boolean isStorekeeperRestrictedAction = hasFacilityStorekeeperPolicy && needStorekeeperDeniedAction(controllerName, actionName, params, request)
+        Boolean isRegionalWarehouseAllowedAction = hasRegionalWarehousePolicy && needRegionalWarehouse(controllerName, actionName, params, request)
+        Boolean isRegionalWarehouseRestrictedAction = hasRegionalWarehousePolicy && needRegionalWarehouseDeniedAction(controllerName, actionName, params, request)
 
-        if (isStorekeeperRestrictedAction) {
+        if (isStorekeeperRestrictedAction || isRegionalWarehouseRestrictedAction) {
             log.info("User ${session?.user?.username} does not have access to ${controllerName}/${actionName} in location ${session?.warehouse?.name}")
             redirect(controller: "errors", action: "handleForbidden")
             return false
         }
+        if (isStorekeeperAllowedAction || isRegionalWarehouseAllowedAction) {
+            return true
+        }
 
         def rules = grailsApplication.config.openboxes.security.rbac.rules
         def rule = rules.find { it.controller == controllerName && it.actions.contains(actionName) ||
@@ -147,7 +187,7 @@ class RoleInterceptor {
 
             Boolean isUserInRole = true
             if (session.user && supplementalRoles.size() > 0) {
-                isUserInRole = userService.isUserInRole(session.user, supplementalRoles)
+                isUserInRole = userService.hasAnyRoles(session.user, supplementalRoles)
             }
 
             if (isAnonymous || (session.user && isMinimumRequiredRole && isUserInRole)) {
@@ -168,10 +208,9 @@ class RoleInterceptor {
         def isNotAuthenticated = !userService.isUserInRole(session.user, RoleType.ROLE_AUTHENTICATED)
         def isNotBrowser = !userService.canUserBrowse(session.user) && !needRequestorOrManager(controllerName, actionName)
         def isNotManager = needManager(controllerName, actionName) &&
-            !isStorekeeperAllowedAction &&
             (needRequestorOrManager(controllerName, actionName) ? !userService.isUserManager(session.user) && !userService.isUserRequestor(session.user) : !userService.isUserManager(session.user))
         def isNotAdmin = needAdmin(controllerName, actionName) && !userService.isUserAdmin(session.user)
-        def isNotSuperuser = needSuperuser(controllerName, actionName) && !isStorekeeperAllowedAction && !userService.isSuperuser(session.user)
+        def isNotSuperuser = needSuperuser(controllerName, actionName) && !userService.isSuperuser(session.user)
         def hasNoRoleInvoice = needInvoice(controllerName, actionName) && !userService.hasRoleInvoice(session.user)
         def isNotRequestor = needRequestorOrManager(controllerName, actionName) && !userService.isUserRequestor(session.user)
         def isNotRequestorOrManager = needRequestorOrManager(controllerName, actionName) ? !userService.isUserManager(session.user) && !userService.isUserRequestor(session.user) : false
@@ -309,4 +348,61 @@ class RoleInterceptor {
 
         return false
     }
+
+    static Boolean needRegionalWarehouse(controllerName, actionName, params = null, request = null) {
+        if (needRegionalWarehouseDeniedAction(controllerName, actionName, params, request)) {
+            return false
+        }
+        return regionalWarehouseActions[controllerName]?.contains("*") ||
+                regionalWarehouseActions[controllerName]?.contains(actionName)
+    }
+
+    static Boolean needRegionalWarehouseDeniedAction(controllerName, actionName, params, request = null) {
+        // Purchasing: no access (including suppliers)
+        if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
+            return true
+        }
+        if (controllerName == 'dashboard' && actionName == 'supplier') {
+            return true
+        }
+
+        // Inbound: no access to "Create Inbound Movement" only
+        if (controllerName == 'stockMovement' && actionName == 'createInbound') {
+            return !params.id
+        }
+        if (controllerName == 'stockMovementApi' && actionName == 'create') {
+            String direction = params.direction ?: request?.JSON?.direction
+            return direction?.toUpperCase() == "INBOUND"
+        }
+        if (controllerName == 'createShipmentWorkflow' && actionName == 'createShipment') {
+            return !params.id && params.type?.toUpperCase() == "INCOMING"
+        }
+
+        // Products: read-only
+        if (controllerName == 'product' && actionName in [
+                'batchEdit',
+                'batchEditProperties',
+                'create',
+                'save',
+                'edit',
+                'update',
+                'delete',
+                'deleteProducts',
+                'importAsCsv',
+                'savePackage',
+                'deleteDocument',
+                'deleteProductComponent',
+                'deleteProductGroup',
+                'editProductSynonym',
+                'editProductSynonymDialog',
+                'deleteSynonym',
+        ]) {
+            return true
+        }
+        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete']) {
+            return true
+        }
+
+        return false
+    }
 }
diff --git a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
index acca831537a..4b6ad058c48 100644
--- a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
@@ -91,7 +91,11 @@ class ApiController {
         Map menuSectionsUrlParts = grailsApplication.config.openboxes.menuSectionsUrlParts
         User user = User.get(session?.user?.id)
 
-        if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED)) {
+        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(user, session?.warehouse?.id)
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, session?.warehouse?.id)
+        if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
+                !hasFacilityStorekeeperPolicy &&
+                !hasRegionalWarehousePolicy) {
             menuConfig = grailsApplication.config.openboxes.requestorMegamenu;
         }
         List translatedMenu = megamenuService.buildAndTranslateMenu(menuConfig, user, location)
@@ -163,6 +167,7 @@ class ApiController {
         ArrayList<RoleType> managerRoles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_MANAGER]
         boolean isUserManager = userService.getEffectiveRoles(user).any { managerRoles.contains(it.roleType) }
         boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session.warehouse?.id)
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session.warehouse?.id)
         def supportedActivities = location.supportedActivities ?: location.locationType.supportedActivities
         boolean isImpersonated = session.impersonateUserId ? true : false
         def buildNumber = gitProperties.shortCommitId
@@ -209,6 +214,7 @@ class ApiController {
                 isUserRequestApprover         : isUserRequestApprover,
                 isUserManager                 : isUserManager,
                 hasFacilityStorekeeperPolicy  : hasFacilityStorekeeperPolicy,
+                hasRegionalWarehousePolicy    : hasRegionalWarehousePolicy,
                 supportedActivities           : supportedActivities,
                 isImpersonated                : isImpersonated,
                 grailsVersion                 : grailsVersion,
diff --git a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
index b0635e2a205..d5e8ecad4a0 100644
--- a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
@@ -62,6 +62,7 @@ class LocationApiController extends BaseDomainApiController {
         def requestorInAnyLocation = userService.hasRoleRequestorInAnyLocations(currentUser)
         def inRoleBrowser = currentUser.hasDefaultRole(RoleType.ROLE_BROWSER)
         def inRoleFacilityStorekeeper = currentUser.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
+        def inRoleRegionalWarehouse = currentUser.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
         def inRoleAssistant = currentUser.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = currentUser.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = currentUser.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -82,7 +83,7 @@ class LocationApiController extends BaseDomainApiController {
                 locations += locationService.getRequestorLocations(currentUser)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 currentUser.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy b/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
index 8fb97419317..76f3b8933b1 100644
--- a/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
@@ -113,7 +113,11 @@ class DashboardController {
             redirect(controller: "mobile")
             return
         }
-        if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED)) {
+        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+        if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
+                !hasFacilityStorekeeperPolicy &&
+                !hasRegionalWarehousePolicy) {
             redirect(controller: "stockMovement", action: "list", params: [direction: 'INBOUND'] )
             return
         }
@@ -170,7 +174,11 @@ class DashboardController {
         Map menuConfig = grailsApplication.config.openboxes.megamenu;
         User user = User.get(session?.user?.id)
 
-        if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED)) {
+        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(user, session?.warehouse?.id)
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, session?.warehouse?.id)
+        if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
+                !hasFacilityStorekeeperPolicy &&
+                !hasRegionalWarehousePolicy) {
             menuConfig = grailsApplication.config.openboxes.requestorMegamenu;
         }
         List translatedMenu = megamenuService.buildAndTranslateMenu(menuConfig, user, location)
@@ -227,7 +235,11 @@ class DashboardController {
                 session.user = user
             }
 
-            if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED)) {
+            boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
+            boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+            if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
+                    !hasFacilityStorekeeperPolicy &&
+                    !hasRegionalWarehousePolicy) {
                 redirect(controller: 'stockMovement', action: 'list' , params: [direction: 'INBOUND'])
                 return
             }
diff --git a/grails-app/controllers/org/pih/warehouse/user/UserController.groovy b/grails-app/controllers/org/pih/warehouse/user/UserController.groovy
index 57c6acdecb1..cdbba15b7d9 100644
--- a/grails-app/controllers/org/pih/warehouse/user/UserController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/user/UserController.groovy
@@ -211,7 +211,8 @@ class UserController {
         }
     }
 
-
+    // Unrelated to role customizations: pre-existing fix for activation toggle flush without transaction.
+    @Transactional
     def toggleActivation() {
         def userInstance = User.get(params.id)
         if (!userInstance) {
diff --git a/grails-app/i18n/messages.properties b/grails-app/i18n/messages.properties
index c50e76eaebe..0a56a4aa905 100644
--- a/grails-app/i18n/messages.properties
+++ b/grails-app/i18n/messages.properties
@@ -1075,6 +1075,7 @@ enum.RoleType.ROLE_MANAGER=Manager
 enum.RoleType.ROLE_ASSISTANT=Assistant
 enum.RoleType.ROLE_BROWSER=Browser
 enum.RoleType.ROLE_FACILITY_STOREKEEPER=Facility Storekeeper
+enum.RoleType.ROLE_REGIONAL_WAREHOUSE=Regional Warehouse User
 enum.RoleType.ROLE_PURCHASE_APPROVER=Purchase approver
 enum.RoleType.ROLE_REQUISITION_APPROVER=Request approver
 # Event messages
diff --git a/grails-app/migrations/custom/2026-05-19-add-regional-warehouse-role.groovy b/grails-app/migrations/custom/2026-05-19-add-regional-warehouse-role.groovy
new file mode 100644
index 00000000000..633824863e8
--- /dev/null
+++ b/grails-app/migrations/custom/2026-05-19-add-regional-warehouse-role.groovy
@@ -0,0 +1,15 @@
+databaseChangeLog = {
+    changeSet(author: "codex", id: "202605191200-0") {
+        preConditions(onFail: "MARK_RAN") {
+            sqlCheck(expectedResult: "0", "select count(*) from role where role_type = 'ROLE_REGIONAL_WAREHOUSE'")
+        }
+
+        insert(tableName: "role") {
+            column(name: "id", value: "ROLE_REGIONAL_WAREHOUSE")
+            column(name: "version", valueNumeric: "0")
+            column(name: "description", value: "Role for regional warehouse users with inventory/inbound/outbound operations, no purchasing access, and no inbound movement creation")
+            column(name: "role_type", value: "ROLE_REGIONAL_WAREHOUSE")
+            column(name: "name", value: "Regional Warehouse User")
+        }
+    }
+}
diff --git a/grails-app/migrations/custom/changelog.groovy b/grails-app/migrations/custom/changelog.groovy
index 1862773e321..bebbcbe6a1b 100644
--- a/grails-app/migrations/custom/changelog.groovy
+++ b/grails-app/migrations/custom/changelog.groovy
@@ -13,4 +13,5 @@
  */
 databaseChangeLog = {
     include file: '2026-05-15-add-facility-storekeeper-role.groovy'
+    include file: '2026-05-19-add-regional-warehouse-role.groovy'
 }
diff --git a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
index bb91d72f5bb..c8b73e67e90 100644
--- a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
+++ b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
@@ -12,6 +12,7 @@ package org.pih.warehouse.api
 import grails.core.GrailsApplication
 import org.pih.warehouse.core.ActivityCode
 import org.pih.warehouse.core.Location
+import org.pih.warehouse.core.RoleType
 import org.pih.warehouse.core.User
 
 class MegamenuService {
@@ -25,6 +26,9 @@ class MegamenuService {
             "outbound",
             "requisitionTemplate",
     ]
+    private static final List<String> REGIONAL_WAREHOUSE_HIDDEN_SECTIONS = [
+            "purchasing",
+    ]
 
     private static final String STOREKEEPER_INBOUND_CREATE_HREF = "/stockMovement/createInbound"
 
@@ -32,6 +36,18 @@ class MegamenuService {
         return grailsApplication.mainContext.getBean('org.pih.warehouse.MessageTagLib')
     }
 
+    private boolean userHasMinimumMenuRole(User user, Location location, Collection roleTypes) {
+        Set<String> acceptedRoleTypeNames = (RoleType.expand(roleTypes)*.name()) as Set<String>
+        Set<String> effectiveRoleNames = (userService.getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
+        return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
+    }
+
+    private boolean userHasSupplementalMenuRole(User user, Location location, Collection roleTypes) {
+        Set<String> acceptedRoleTypeNames = (roleTypes*.name()) as Set<String>
+        Set<String> effectiveRoleNames = (userService.getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
+        return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
+    }
+
     Map buildAndTranslateSections(section, String key, User user, Location location) {
         def label = getMessageTagLib().message(code: section.label, default: section.defaultLabel)
         def translatedSection
@@ -67,11 +83,11 @@ class MegamenuService {
             if (it.enabled == false) {
                 return
             }
-            if (minRole && !userService.isUserInRole(user, minRole)) {
+            if (minRole && !userHasMinimumMenuRole(user, location, [minRole])) {
                 return
             }
             def roles = it.supplementalRoles
-            if (roles && !userService.hasAnyRoles(user, roles)) {
+            if (roles && !userHasSupplementalMenuRole(user, location, roles)) {
                 return
             }
             ActivityCode[] activitiesAny = it.requiredActivitiesAny ?: []
@@ -99,11 +115,11 @@ class MegamenuService {
                 return
             }
             def minRole = it.minimumRequiredRole
-            if (minRole && !userService.isUserInRole(user, minRole)) {
+            if (minRole && !userHasMinimumMenuRole(user, location, [minRole])) {
                 return
             }
             def roles = it.supplementalRoles
-            if (roles && !userService.hasAnyRoles(user, roles)) {
+            if (roles && !userHasSupplementalMenuRole(user, location, roles)) {
                 return
             }
             ActivityCode[] activitiesAny = it.requiredActivitiesAny ?: []
@@ -135,11 +151,11 @@ class MegamenuService {
         def parsedMenuConfig = []
         menuConfig.each { key, value ->
             def minRole = value.minimumRequiredRole
-            if (minRole && !userService.isUserInRole(user, minRole)) {
+            if (minRole && !userHasMinimumMenuRole(user, location, [minRole])) {
                 return
             }
             def roles = value.supplementalRoles
-            if (roles && !userService.hasAnyRoles(user, roles)) {
+            if (roles && !userHasSupplementalMenuRole(user, location, roles)) {
                 return
             }
             ActivityCode[] activitiesAny = value.requiredActivitiesAny ?: []
@@ -158,9 +174,16 @@ class MegamenuService {
                 }
             }
         }
-        if (userService.hasFacilityStorekeeperPolicy(user, location?.id)) {
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, location?.id)
+        boolean hasFacilityStorekeeperPolicy = !hasRegionalWarehousePolicy &&
+                userService.hasFacilityStorekeeperPolicy(user, location?.id)
+
+        if (hasFacilityStorekeeperPolicy) {
             parsedMenuConfig = applyFacilityStorekeeperMenuPolicy(parsedMenuConfig)
         }
+        if (hasRegionalWarehousePolicy) {
+            parsedMenuConfig = applyRegionalWarehouseMenuPolicy(parsedMenuConfig)
+        }
         return parsedMenuConfig
     }
 
@@ -184,4 +207,25 @@ class MegamenuService {
 
         return filteredMenu
     }
+
+    private ArrayList applyRegionalWarehouseMenuPolicy(ArrayList menuConfig) {
+        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
+            !REGIONAL_WAREHOUSE_HIDDEN_SECTIONS.contains(section?.id)
+        } as ArrayList
+
+        filteredMenu.each { section ->
+            if (section?.id == "inbound" && section?.subsections) {
+                section.subsections = section.subsections.findAll { it != null }.collect { subsection ->
+                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
+                        String href = menuItem?.href ?: ""
+                        !href.contains(STOREKEEPER_INBOUND_CREATE_HREF)
+                    } ?: []
+                    return subsection
+                }
+                section.subsections = section.subsections.findAll { it?.menuItems }
+            }
+        }
+
+        return filteredMenu
+    }
 }
diff --git a/grails-app/services/org/pih/warehouse/core/LocationService.groovy b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
index 14986843de3..c6756fadd1d 100644
--- a/grails-app/services/org/pih/warehouse/core/LocationService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
@@ -261,6 +261,7 @@ class LocationService {
         def requestorInAnyLocation = userService.hasRoleRequestorInAnyLocations(user)
         def inRoleBrowser = user.hasDefaultRole(RoleType.ROLE_BROWSER)
         def inRoleFacilityStorekeeper = user.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
+        def inRoleRegionalWarehouse = user.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
         def inRoleAssistant = user.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = user.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = user.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -279,7 +280,7 @@ class LocationService {
                 locations += getRequestorLocations(user)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 user.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/services/org/pih/warehouse/core/UserService.groovy b/grails-app/services/org/pih/warehouse/core/UserService.groovy
index 72fda66d96c..ad137187313 100644
--- a/grails-app/services/org/pih/warehouse/core/UserService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/UserService.groovy
@@ -206,7 +206,8 @@ class UserService {
                     RoleType.ROLE_MANAGER.name(),
                     RoleType.ROLE_BROWSER.name(),
                     RoleType.ROLE_ASSISTANT.name(),
-                    RoleType.ROLE_FACILITY_STOREKEEPER.name()
+                    RoleType.ROLE_FACILITY_STOREKEEPER.name(),
+                    RoleType.ROLE_REGIONAL_WAREHOUSE.name()
             ] as Set<String>
             return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
         }
@@ -276,6 +277,14 @@ class UserService {
         return false
     }
 
+    Boolean hasRoleRegionalWarehouse(User u) {
+        if (u) {
+            def user = User.get(u.id)
+            return getEffectiveRoles(user).any { Role role -> role.roleType?.name() == RoleType.ROLE_REGIONAL_WAREHOUSE.name() }
+        }
+        return false
+    }
+
     Boolean hasFacilityStorekeeperPolicy(User u, String locationId) {
         if (u) {
             def user = User.get(u.id)
@@ -293,6 +302,23 @@ class UserService {
         return false
     }
 
+    Boolean hasRegionalWarehousePolicy(User u, String locationId) {
+        if (u) {
+            def user = User.get(u.id)
+            Location location = Location.get(locationId)
+            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
+            Set<String> higherCoreRoleNames = [
+                    RoleType.ROLE_SUPERUSER.name(),
+                    RoleType.ROLE_ADMIN.name(),
+                    RoleType.ROLE_MANAGER.name(),
+                    RoleType.ROLE_ASSISTANT.name()
+            ]
+            return effectiveRoleNames.contains(RoleType.ROLE_REGIONAL_WAREHOUSE.name()) &&
+                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
+        }
+        return false
+    }
+
     // Checks if requestor role exist for any location - for location chooser purposes
     Boolean hasRoleRequestorInAnyLocations(User u) {
         if (u) {
diff --git a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
index 2764049dff2..e71635b0639 100644
--- a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
+++ b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
@@ -67,6 +67,12 @@ class AuthTagLib {
         if (userService.isUserAdmin(session?.user))
             out << body()
     }
+    def canManageStocklists = { attrs, body ->
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+        if (userService.isUserAdmin(session?.user) || hasRegionalWarehousePolicy) {
+            out << body()
+        }
+    }
     def isUserManager = { attrs, body ->
         if (userService.isUserManager(session?.user))
             out << body()
@@ -120,12 +126,20 @@ class AuthTagLib {
     }
 
     def hasHighestRoleAuthenticated = { attrs, body ->
-        if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED))
+        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+        if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
+                !hasFacilityStorekeeperPolicy &&
+                !hasRegionalWarehousePolicy)
             out << body()
     }
 
     def hasHigherRoleThanAuthenticated = { attrs, body ->
-        if (!userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED))
+        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
+        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+        if (!userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) ||
+                hasFacilityStorekeeperPolicy ||
+                hasRegionalWarehousePolicy)
             out << body()
     }
 }
diff --git a/grails-app/views/requisitionTemplate/_list.gsp b/grails-app/views/requisitionTemplate/_list.gsp
index cb559ef3ba4..7484ca5f5c7 100644
--- a/grails-app/views/requisitionTemplate/_list.gsp
+++ b/grails-app/views/requisitionTemplate/_list.gsp
@@ -1,11 +1,11 @@
 <table>
 	<thead>
 		<tr>
-            <g:isUserAdmin>
+            <g:canManageStocklists>
                 <th>
                     <warehouse:message code="default.actions.label"/>
                 </th>
-            </g:isUserAdmin>
+            </g:canManageStocklists>
             <th>
                 <warehouse:message code="requisition.isPublished.label"/>
             </th>
@@ -52,11 +52,11 @@
 		</g:unless>
 		<g:each in="${requisitions}" status="i" var="requisition">
 			<tr class="${(i % 2) == 0 ? 'odd' : 'even'}">
-                <g:isUserAdmin>
+                <g:canManageStocklists>
                     <td>
                         <g:render template="/requisitionTemplate/actions" model="[requisition:requisition]"/>
                     </td>
-                </g:isUserAdmin>
+                </g:canManageStocklists>
                 <td>
                     <g:if test="${requisition.isPublished}">
                         <div class="tag tag-alert">
diff --git a/grails-app/views/requisitionTemplate/_summary.gsp b/grails-app/views/requisitionTemplate/_summary.gsp
index 7d68805d740..3d1e7ac1714 100644
--- a/grails-app/views/requisitionTemplate/_summary.gsp
+++ b/grails-app/views/requisitionTemplate/_summary.gsp
@@ -3,11 +3,11 @@
 		<table>
 			<tbody>
 				<tr>
-					<g:isUserAdmin>
+					<g:canManageStocklists>
 						<td class="middle" width="1%">
 							<g:render template="actions" model="[requisition:requisition]" />
 						</td>
-					</g:isUserAdmin>
+					</g:canManageStocklists>
 					<td class="left">
 						<div class="title" id="description">
                             ${requisition.name}
@@ -69,17 +69,17 @@
 		<img src="${resource(dir:'images/icons/silk',file:'application_view_list.png')}" />&nbsp;
 		<warehouse:message code="default.list.label" args="[warehouse.message(code:'requisitionTemplates.label').toLowerCase()]"/>
 	</g:link>
-	<g:isUserAdmin>
+	<g:canManageStocklists>
 		<g:link class="button" controller="requisitionTemplate" action="create" params="[type:'STOCK']">
 			<img src="${resource(dir:'images/icons/silk',file:'add.png')}" />&nbsp;
 			<warehouse:message code="default.create.label" args="[warehouse.message(code:'requisitionTemplate.label').toLowerCase()]"/>
 		</g:link>
-	</g:isUserAdmin>
+	</g:canManageStocklists>
 
 	<div class="right">
 		<div class="button-container">
 			<div class="button-group">
-				<g:isUserAdmin>
+				<g:canManageStocklists>
 					<g:link controller="requisitionTemplate" action="show" id="${requisition?.id}" class="button">
 						<img src="${resource(dir:'images/icons/silk',file:'zoom.png')}" />&nbsp;
 						${warehouse.message(code: 'default.button.show.label')}
@@ -113,7 +113,7 @@
 							&nbsp;${warehouse.message(code: 'default.button.unpublish.label')}
 						</g:link>
 					</g:else>
-				</g:isUserAdmin>
+				</g:canManageStocklists>
 				<g:link controller="requisitionTemplate" action="sendMail" id="${requisition?.id}" class="button">
 					<img src="${resource(dir:'images/icons/silk',file:'email.png')}" />
 					${warehouse.message(code: 'default.button.email.label')}
diff --git a/grails-app/views/requisitionTemplate/edit.gsp b/grails-app/views/requisitionTemplate/edit.gsp
index ec7b74a7a1a..e116f1a55fc 100644
--- a/grails-app/views/requisitionTemplate/edit.gsp
+++ b/grails-app/views/requisitionTemplate/edit.gsp
@@ -80,11 +80,11 @@
                                             <warehouse:message code="requisitionTemplate.unitCost.label"/>
                                         </th>
                                     </g:hasRoleFinance>
-                                    <g:isUserAdmin>
+                                    <g:canManageStocklists>
                                         <th id="actions">
                                             <warehouse:message code="default.actions.label"/>
                                         </th>
-                                    </g:isUserAdmin>
+                                    </g:canManageStocklists>
                                 </tr>
                             </g:if>
                             <g:else>
@@ -115,11 +115,11 @@
                                             <warehouse:message code="requisitionTemplate.totalCost.label"/>
                                         </th>
                                     </g:hasRoleFinance>
-                                    <g:isUserAdmin>
+                                    <g:canManageStocklists>
                                         <th id="actions">
                                             <warehouse:message code="default.actions.label"/>
                                         </th>
-                                    </g:isUserAdmin>
+                                    </g:canManageStocklists>
                                 </tr>
                             </g:else>
                         </thead>
@@ -127,7 +127,7 @@
 
                         </tbody>
                         <tfoot>
-                            <g:isUserAdmin>
+                            <g:canManageStocklists>
                                 <tr class="prop" id="new-row">
                                     <g:if test="${requisition.replenishmentTypeCode == ReplenishmentTypeCode.PULL}">
                                         <td></td>
@@ -180,7 +180,7 @@
                                         </button>
                                     </td>
                                 </tr>
-                            </g:isUserAdmin>
+                            </g:canManageStocklists>
                             <tr>
                                 <td colspan="${requisition.replenishmentTypeCode == ReplenishmentTypeCode.PUSH || !requisition.replenishmentTypeCode ? 9 : 6}">
                                     <div class="buttons">
diff --git a/grails-app/views/requisitionTemplate/list.gsp b/grails-app/views/requisitionTemplate/list.gsp
index 236b3dc52a8..479466cb709 100644
--- a/grails-app/views/requisitionTemplate/list.gsp
+++ b/grails-app/views/requisitionTemplate/list.gsp
@@ -17,12 +17,12 @@
                     <img src="${resource(dir: 'images/icons/silk', file: 'application_side_list.png')}" />&nbsp;
                     <warehouse:message code="default.list.label" args="[warehouse.message(code:'requisitionTemplates.label').toLowerCase()]"/>
                 </g:link>
-                <g:isUserAdmin>
+                <g:canManageStocklists>
                     <g:link class="button" controller="requisitionTemplate" action="create" params="[type:'STOCK']">
                         <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
                         <warehouse:message code="default.add.label" args="[g.message(code:'requisitionTemplate.label')]"/>
                     </g:link>
-                </g:isUserAdmin>
+                </g:canManageStocklists>
             </div>
             <div class="yui-gf">
                 <div class="yui-u first">
diff --git a/src/js/components/stock-list/StockListHeader.jsx b/src/js/components/stock-list/StockListHeader.jsx
index 60ab0328151..033dc46e389 100644
--- a/src/js/components/stock-list/StockListHeader.jsx
+++ b/src/js/components/stock-list/StockListHeader.jsx
@@ -6,14 +6,14 @@ import { connect } from 'react-redux';
 import { REQUISITION_TEMPLATE_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const StockListHeader = ({ isUserAdmin }) => (
+const StockListHeader = ({ isUserAdmin, hasRegionalWarehousePolicy }) => (
   <div className="d-flex list-page-header">
     <span className="d-flex align-self-center title">
       <Translate id="react.stocklists.header.label" defaultMessage="Stock List" />
     </span>
     <div className="d-flex justify-content-end buttons align-items-center">
       {
-        isUserAdmin && (
+        (isUserAdmin || hasRegionalWarehousePolicy) && (
           <a className="primary-button" href={`${REQUISITION_TEMPLATE_URL.create()}?type=STOCK`}>
             <Translate id="react.stocklists.addStockList.label" defaultMessage="Add stocklist" />
           </a>
@@ -25,10 +25,12 @@ const StockListHeader = ({ isUserAdmin }) => (
 
 const mapStateToProps = (state) => ({
   isUserAdmin: state.session.isUserAdmin,
+  hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
 });
 
 export default connect(mapStateToProps)(StockListHeader);
 
 StockListHeader.propTypes = {
   isUserAdmin: PropTypes.bool.isRequired,
+  hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
 };
diff --git a/src/js/components/stock-list/StockListTable.jsx b/src/js/components/stock-list/StockListTable.jsx
index 5c4e9b283c9..c75bec8be29 100644
--- a/src/js/components/stock-list/StockListTable.jsx
+++ b/src/js/components/stock-list/StockListTable.jsx
@@ -32,6 +32,7 @@ const StockListTable = ({
   filterParams,
   translate,
   highestRole,
+  hasRegionalWarehousePolicy,
 }) => {
   const {
     tableData,
@@ -47,7 +48,9 @@ const StockListTable = ({
     exportStockListItems,
   } = useStockListTableData(filterParams);
 
-  const customActionFilter = ({ isPublished }, row) => {
+  const customActionFilter = ({ isPublished, requiresStocklistWrite }, row) => {
+    const canWriteStocklists = hasRegionalWarehousePolicy || highestRole === 'Admin' || highestRole === 'Superuser';
+    if (requiresStocklistWrite && !canWriteStocklists) return false;
     // skip actions that don't have isPublished property
     if (isPublished === undefined) return true;
     // show actions that have same boolean value in row and in action
@@ -67,35 +70,35 @@ const StockListTable = ({
       label: 'react.stocklists.editStock.label',
       leftIcon: <RiPencilLine />,
       href: REQUISITION_TEMPLATE_URL.editHeader,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Edit stock list items',
       label: 'react.stocklists.items.editStock.label',
       leftIcon: <RiListUnordered />,
       href: REQUISITION_TEMPLATE_URL.edit,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Import stock list items',
       label: 'react.stocklists.items.import.label',
       leftIcon: <RiUploadLine />,
       href: REQUISITION_TEMPLATE_URL.batch,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Export stock list items',
       label: 'react.stocklists.items.export.label',
       leftIcon: <RiDownloadLine />,
       onClick: exportStockListItems,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Clone stock list',
       label: 'react.stocklists.clone.label',
       leftIcon: <RiFileCopyLine />,
       onClick: cloneStocklists,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Publish stock list',
@@ -103,7 +106,7 @@ const StockListTable = ({
       leftIcon: <RiFile3Line />,
       isPublished: false,
       onClick: publishStocklists,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Unpublish stock list',
@@ -111,7 +114,7 @@ const StockListTable = ({
       leftIcon: <RiFileForbidLine />,
       isPublished: true,
       onClick: unpublishStocklists,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Clear stock list items',
@@ -119,7 +122,7 @@ const StockListTable = ({
       leftIcon: <RiEraserLine />,
       variant: 'danger',
       onClick: onClickClearStocklists,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
     {
       defaultLabel: 'Delete stock list',
@@ -127,9 +130,16 @@ const StockListTable = ({
       leftIcon: <RiDeleteBinLine />,
       variant: 'danger',
       onClick: onClickDeleteStocklists,
-      minimumRequiredRole: 'Admin',
+      requiresStocklistWrite: true,
     },
-  ], []);
+  ], [
+    cloneStocklists,
+    exportStockListItems,
+    onClickClearStocklists,
+    onClickDeleteStocklists,
+    publishStocklists,
+    unpublishStocklists,
+  ]);
 
   // Columns for react-table
   const columns = useMemo(() => [
@@ -218,7 +228,7 @@ const StockListTable = ({
       accessor: 'lastUpdated',
       width: 150,
     },
-  ], [highestRole]);
+  ], [highestRole, hasRegionalWarehousePolicy]);
 
   return (
     <div className="list-page-list-section">
@@ -258,6 +268,7 @@ const StockListTable = ({
 const mapStateToProps = (state) => ({
   translate: translateWithDefaultMessage(getTranslate(state.localize)),
   highestRole: state.session.highestRole,
+  hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
 });
 
 export default connect(mapStateToProps)(StockListTable);
@@ -266,4 +277,5 @@ StockListTable.propTypes = {
   filterParams: PropTypes.shape({}).isRequired,
   translate: PropTypes.func.isRequired,
   highestRole: PropTypes.string.isRequired,
+  hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
 };
diff --git a/src/js/consts/roleType.js b/src/js/consts/roleType.js
index b9f0d377bbb..9557950b100 100644
--- a/src/js/consts/roleType.js
+++ b/src/js/consts/roleType.js
@@ -37,6 +37,7 @@ const RoleType = {
   ROLE_SHIPMENT_CLERK: 'ROLE_SHIPMENT_CLERK',
   ROLE_STOCKER: 'ROLE_STOCKER',
   ROLE_FACILITY_STOREKEEPER: 'ROLE_FACILITY_STOREKEEPER',
+  ROLE_REGIONAL_WAREHOUSE: 'ROLE_REGIONAL_WAREHOUSE',
   ROLE_WORKER: 'ROLE_WORKER',
   ROLE_PHARMACIST: 'ROLE_PHARMACIST',
   ROLE_PHARMACY_TECH: 'ROLE_PHARMACY_TECH',
diff --git a/src/js/reducers/sessionReducer.jsx b/src/js/reducers/sessionReducer.jsx
index 53fc014f293..38bffd06272 100644
--- a/src/js/reducers/sessionReducer.jsx
+++ b/src/js/reducers/sessionReducer.jsx
@@ -25,6 +25,7 @@ const initialState = {
   isUserApprover: false,
   isUserRequestApprover: false,
   hasFacilityStorekeeperPolicy: false,
+  hasRegionalWarehousePolicy: false,
   supportedActivities: [],
   menuConfig: [],
   menuSectionsUrlParts: {},
@@ -101,6 +102,7 @@ export default function (state = initialState, action) {
         isUserRequestApprover: _.get(action, 'payload.data.data.isUserRequestApprover', false),
         isUserManager: _.get(action, 'payload.data.data.isUserManager', false),
         hasFacilityStorekeeperPolicy: _.get(action, 'payload.data.data.hasFacilityStorekeeperPolicy', false),
+        hasRegionalWarehousePolicy: _.get(action, 'payload.data.data.hasRegionalWarehousePolicy', false),
         supportedActivities: _.get(action, 'payload.data.data.supportedActivities'),
         activeLanguage: _.get(action, 'payload.data.data.activeLanguage'),
         activeLanguageTag: _.get(action, 'payload.data.data.activeLanguageTag'),
diff --git a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
index 719926888a7..119b400d36d 100644
--- a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
+++ b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
@@ -64,6 +64,7 @@ enum RoleType {
     ROLE_SHIPMENT_CLERK('Shipment Clerk', 50),
     ROLE_STOCKER('Stocker', 50),
     ROLE_FACILITY_STOREKEEPER('Facility Storekeeper', 4),
+    ROLE_REGIONAL_WAREHOUSE('Regional Warehouse User', 4),
     ROLE_WORKER('Worker', 50),
 
     // Pharmacy roles
@@ -116,6 +117,7 @@ enum RoleType {
                 ROLE_AUTHENTICATED,
                 ROLE_BROWSER,
                 ROLE_FACILITY_STOREKEEPER,
+                ROLE_REGIONAL_WAREHOUSE,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -164,6 +166,7 @@ enum RoleType {
                 ROLE_AUTHENTICATED,
                 ROLE_BROWSER,
                 ROLE_FACILITY_STOREKEEPER,
+                ROLE_REGIONAL_WAREHOUSE,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -192,6 +195,7 @@ enum RoleType {
         return [
                 ROLE_ASSISTANT,
                 ROLE_FACILITY_STOREKEEPER,
+                ROLE_REGIONAL_WAREHOUSE,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
                 ROLE_SUPERUSER,

From 01e373a8fffce1ca3119ef53077881199478bfe5 Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Wed, 20 May 2026 11:19:14 -0300
Subject: [PATCH 03/10] feat(auth): add RPC Superuser custom role and policy
 enforcement

Implement ROLE_RPC_SUPERUSER as a location-scoped custom policy with highest-role-wins semantics.

Wire role plumbing across backend and frontend session context, including migration and i18n.

Enforce access through RoleInterceptor allow/deny paths, menu policy filtering, and location-aware role checks.

Enable missing write UX paths for purchasing, products, and stocklists while preserving existing restricted-role behavior.
---
 .../org/pih/warehouse/RoleInterceptor.groovy  | 66 ++++++++++++++++++-
 .../pih/warehouse/api/ApiController.groovy    |  6 +-
 .../api/LocationApiController.groovy          |  3 +-
 .../warehouse/user/DashboardController.groovy | 12 +++-
 grails-app/i18n/messages.properties           |  1 +
 .../2026-05-20-add-rpc-superuser-role.groovy  | 15 +++++
 grails-app/migrations/custom/changelog.groovy |  1 +
 .../pih/warehouse/api/MegamenuService.groovy  | 49 +++++++++-----
 .../pih/warehouse/core/LocationService.groovy |  3 +-
 .../org/pih/warehouse/core/UserService.groovy | 28 +++++++-
 .../org/pih/warehouse/AuthTagLib.groovy       | 11 +++-
 .../productSupplier/ProductSupplierHeader.jsx |  6 +-
 .../ProductSupplierListTable.jsx              |  5 +-
 .../modals/PreferenceTypeModal.jsx            |  5 +-
 .../products/ProductsListHeader.jsx           |  6 +-
 .../purchaseOrder/PurchaseOrderListTable.jsx  |  8 ++-
 .../StocklistManagement.jsx                   | 17 +++--
 .../components/stock-list/StockListHeader.jsx |  6 +-
 .../components/stock-list/StockListTable.jsx  | 10 ++-
 src/js/consts/roleType.js                     |  1 +
 .../useProductSupplierActions.jsx             |  5 +-
 src/js/reducers/sessionReducer.jsx            |  2 +
 .../org/pih/warehouse/core/RoleType.groovy    |  4 ++
 23 files changed, 226 insertions(+), 44 deletions(-)
 create mode 100644 grails-app/migrations/custom/2026-05-20-add-rpc-superuser-role.groovy

diff --git a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
index 576f1dd9fa2..2e6baae6dc4 100644
--- a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
+++ b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
@@ -106,6 +106,47 @@ class RoleInterceptor {
         ],
         'json'               : ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems']
     ]
+    def static rpcSuperuserActions = [
+        'inventory'          : ['*'],
+        'inventoryItem'      : ['*'],
+        'stockTransfer'      : ['*'],
+        'stockTransferApi'   : ['*'],
+        'stockMovement'      : ['*'],
+        'stockMovementApi'   : ['*'],
+        'stocklist'          : ['*'],
+        'stocklistApi'       : ['*'],
+        'stocklistItemApi'   : ['*'],
+        'stocklistManagement': ['*'],
+        'requisitionTemplate': ['*'],
+        'json'               : ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems'],
+        'purchaseOrder'      : ['*'],
+        'purchaseOrderApi'   : ['*'],
+        'supplier'           : ['*'],
+        'product'            : ['*'],
+        'productApi'         : ['*'],
+        'productType'        : ['*'],
+        'category'           : ['*'],
+        'categoryApi'        : ['*'],
+        'productCatalog'     : ['*'],
+        'tag'                : ['*'],
+        'attribute'          : ['*'],
+        'attributeApi'       : ['*'],
+        'productAssociation' : ['*'],
+        'productSupplier'    : ['*'],
+        'productSupplierApi' : ['*'],
+        'productSupplierPreferenceApi': ['*'],
+        'productSupplierAttributeApi': ['*'],
+        'productPackage'     : ['*'],
+        'productPackageApi'  : ['*'],
+        'productComponent'   : ['*'],
+        'productGroup'       : ['*'],
+        'unitOfMeasure'      : ['*'],
+        'unitOfMeasureApi'   : ['*'],
+        'unitOfMeasureClass' : ['*'],
+        'unitOfMeasureConversion': ['*'],
+        'productsConfiguration': ['*'],
+        'productsConfigurationApi': ['*'],
+    ]
 
     def static invoiceActions = [
         'invoice': ['*']
@@ -146,22 +187,28 @@ class RoleInterceptor {
     boolean before() {
         // Apply custom location-scoped role policy only after a warehouse context exists.
         Boolean hasWarehouseContext = session?.warehouse?.id
+        Boolean hasRpcSuperuserPolicy = hasWarehouseContext &&
+                userService.hasRpcSuperuserPolicy(session.user, session?.warehouse?.id)
         Boolean hasRegionalWarehousePolicy = hasWarehouseContext &&
+                !hasRpcSuperuserPolicy &&
                 userService.hasRegionalWarehousePolicy(session.user, session?.warehouse?.id)
         Boolean hasFacilityStorekeeperPolicy = hasWarehouseContext &&
+                !hasRpcSuperuserPolicy &&
                 !hasRegionalWarehousePolicy &&
                 userService.hasFacilityStorekeeperPolicy(session.user, session?.warehouse?.id)
+        Boolean isRpcSuperuserAllowedAction = hasRpcSuperuserPolicy && needRpcSuperuser(controllerName, actionName, params, request)
+        Boolean isRpcSuperuserRestrictedAction = hasRpcSuperuserPolicy && needRpcSuperuserDeniedAction(controllerName, actionName, params, request)
         Boolean isStorekeeperAllowedAction = hasFacilityStorekeeperPolicy && needFacilityStorekeeper(controllerName, actionName, params, request)
         Boolean isStorekeeperRestrictedAction = hasFacilityStorekeeperPolicy && needStorekeeperDeniedAction(controllerName, actionName, params, request)
         Boolean isRegionalWarehouseAllowedAction = hasRegionalWarehousePolicy && needRegionalWarehouse(controllerName, actionName, params, request)
         Boolean isRegionalWarehouseRestrictedAction = hasRegionalWarehousePolicy && needRegionalWarehouseDeniedAction(controllerName, actionName, params, request)
 
-        if (isStorekeeperRestrictedAction || isRegionalWarehouseRestrictedAction) {
+        if (isRpcSuperuserRestrictedAction || isStorekeeperRestrictedAction || isRegionalWarehouseRestrictedAction) {
             log.info("User ${session?.user?.username} does not have access to ${controllerName}/${actionName} in location ${session?.warehouse?.name}")
             redirect(controller: "errors", action: "handleForbidden")
             return false
         }
-        if (isStorekeeperAllowedAction || isRegionalWarehouseAllowedAction) {
+        if (isRpcSuperuserAllowedAction || isStorekeeperAllowedAction || isRegionalWarehouseAllowedAction) {
             return true
         }
 
@@ -405,4 +452,19 @@ class RoleInterceptor {
 
         return false
     }
+
+    static Boolean needRpcSuperuser(controllerName, actionName, params = null, request = null) {
+        if (needRpcSuperuserDeniedAction(controllerName, actionName, params, request)) {
+            return false
+        }
+        return rpcSuperuserActions[controllerName]?.contains("*") ||
+                rpcSuperuserActions[controllerName]?.contains(actionName)
+    }
+
+    static Boolean needRpcSuperuserDeniedAction(controllerName, actionName, params, request = null) {
+        if (controllerName == 'dashboard' && actionName in ['hideTag', 'hideCatalog', 'flushCache']) {
+            return true
+        }
+        return false
+    }
 }
diff --git a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
index 4b6ad058c48..f045ebd4602 100644
--- a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
@@ -93,9 +93,11 @@ class ApiController {
 
         boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(user, session?.warehouse?.id)
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, session?.warehouse?.id)
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(user, session?.warehouse?.id)
         if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
                 !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy) {
+                !hasRegionalWarehousePolicy &&
+                !hasRpcSuperuserPolicy) {
             menuConfig = grailsApplication.config.openboxes.requestorMegamenu;
         }
         List translatedMenu = megamenuService.buildAndTranslateMenu(menuConfig, user, location)
@@ -168,6 +170,7 @@ class ApiController {
         boolean isUserManager = userService.getEffectiveRoles(user).any { managerRoles.contains(it.roleType) }
         boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session.warehouse?.id)
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session.warehouse?.id)
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session.warehouse?.id)
         def supportedActivities = location.supportedActivities ?: location.locationType.supportedActivities
         boolean isImpersonated = session.impersonateUserId ? true : false
         def buildNumber = gitProperties.shortCommitId
@@ -215,6 +218,7 @@ class ApiController {
                 isUserManager                 : isUserManager,
                 hasFacilityStorekeeperPolicy  : hasFacilityStorekeeperPolicy,
                 hasRegionalWarehousePolicy    : hasRegionalWarehousePolicy,
+                hasRpcSuperuserPolicy         : hasRpcSuperuserPolicy,
                 supportedActivities           : supportedActivities,
                 isImpersonated                : isImpersonated,
                 grailsVersion                 : grailsVersion,
diff --git a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
index d5e8ecad4a0..a346c0555cb 100644
--- a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
@@ -63,6 +63,7 @@ class LocationApiController extends BaseDomainApiController {
         def inRoleBrowser = currentUser.hasDefaultRole(RoleType.ROLE_BROWSER)
         def inRoleFacilityStorekeeper = currentUser.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
         def inRoleRegionalWarehouse = currentUser.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
+        def inRoleRpcSuperuser = currentUser.hasDefaultRole(RoleType.ROLE_RPC_SUPERUSER)
         def inRoleAssistant = currentUser.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = currentUser.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = currentUser.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -83,7 +84,7 @@ class LocationApiController extends BaseDomainApiController {
                 locations += locationService.getRequestorLocations(currentUser)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 currentUser.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy b/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
index 76f3b8933b1..6184ed131dc 100644
--- a/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
@@ -115,9 +115,11 @@ class DashboardController {
         }
         boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
         if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
                 !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy) {
+                !hasRegionalWarehousePolicy &&
+                !hasRpcSuperuserPolicy) {
             redirect(controller: "stockMovement", action: "list", params: [direction: 'INBOUND'] )
             return
         }
@@ -176,9 +178,11 @@ class DashboardController {
 
         boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(user, session?.warehouse?.id)
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, session?.warehouse?.id)
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(user, session?.warehouse?.id)
         if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
                 !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy) {
+                !hasRegionalWarehousePolicy &&
+                !hasRpcSuperuserPolicy) {
             menuConfig = grailsApplication.config.openboxes.requestorMegamenu;
         }
         List translatedMenu = megamenuService.buildAndTranslateMenu(menuConfig, user, location)
@@ -237,9 +241,11 @@ class DashboardController {
 
             boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
             boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+            boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
             if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
                     !hasFacilityStorekeeperPolicy &&
-                    !hasRegionalWarehousePolicy) {
+                    !hasRegionalWarehousePolicy &&
+                    !hasRpcSuperuserPolicy) {
                 redirect(controller: 'stockMovement', action: 'list' , params: [direction: 'INBOUND'])
                 return
             }
diff --git a/grails-app/i18n/messages.properties b/grails-app/i18n/messages.properties
index 0a56a4aa905..5dec4f7c658 100644
--- a/grails-app/i18n/messages.properties
+++ b/grails-app/i18n/messages.properties
@@ -1076,6 +1076,7 @@ enum.RoleType.ROLE_ASSISTANT=Assistant
 enum.RoleType.ROLE_BROWSER=Browser
 enum.RoleType.ROLE_FACILITY_STOREKEEPER=Facility Storekeeper
 enum.RoleType.ROLE_REGIONAL_WAREHOUSE=Regional Warehouse User
+enum.RoleType.ROLE_RPC_SUPERUSER=RPC Superuser
 enum.RoleType.ROLE_PURCHASE_APPROVER=Purchase approver
 enum.RoleType.ROLE_REQUISITION_APPROVER=Request approver
 # Event messages
diff --git a/grails-app/migrations/custom/2026-05-20-add-rpc-superuser-role.groovy b/grails-app/migrations/custom/2026-05-20-add-rpc-superuser-role.groovy
new file mode 100644
index 00000000000..8cd931c3873
--- /dev/null
+++ b/grails-app/migrations/custom/2026-05-20-add-rpc-superuser-role.groovy
@@ -0,0 +1,15 @@
+databaseChangeLog = {
+    changeSet(author: "codex", id: "202605201200-0") {
+        preConditions(onFail: "MARK_RAN") {
+            sqlCheck(expectedResult: "0", "select count(*) from role where role_type = 'ROLE_RPC_SUPERUSER'")
+        }
+
+        insert(tableName: "role") {
+            column(name: "id", value: "ROLE_RPC_SUPERUSER")
+            column(name: "version", valueNumeric: "0")
+            column(name: "description", value: "Role for RPC superusers with dashboard read and read/write access to inventory, purchasing, inbound, outbound, products, and stocklists")
+            column(name: "role_type", value: "ROLE_RPC_SUPERUSER")
+            column(name: "name", value: "RPC Superuser")
+        }
+    }
+}
diff --git a/grails-app/migrations/custom/changelog.groovy b/grails-app/migrations/custom/changelog.groovy
index bebbcbe6a1b..085c9f7e320 100644
--- a/grails-app/migrations/custom/changelog.groovy
+++ b/grails-app/migrations/custom/changelog.groovy
@@ -14,4 +14,5 @@
 databaseChangeLog = {
     include file: '2026-05-15-add-facility-storekeeper-role.groovy'
     include file: '2026-05-19-add-regional-warehouse-role.groovy'
+    include file: '2026-05-20-add-rpc-superuser-role.groovy'
 }
diff --git a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
index c8b73e67e90..e79a5410669 100644
--- a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
+++ b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
@@ -31,18 +31,35 @@ class MegamenuService {
     ]
 
     private static final String STOREKEEPER_INBOUND_CREATE_HREF = "/stockMovement/createInbound"
+    private static final Set<String> RPC_SUPERUSER_MENU_SECTIONS = ["purchasing", "products", "requisitionTemplate"] as Set<String>
+    private static final Set<RoleType> RPC_SUPERUSER_MENU_MIN_ROLES = [
+            RoleType.ROLE_ASSISTANT,
+            RoleType.ROLE_MANAGER,
+            RoleType.ROLE_ADMIN,
+            RoleType.ROLE_SUPERUSER
+    ] as Set<RoleType>
 
     private getMessageTagLib() {
         return grailsApplication.mainContext.getBean('org.pih.warehouse.MessageTagLib')
     }
 
-    private boolean userHasMinimumMenuRole(User user, Location location, Collection roleTypes) {
+    private boolean userHasMinimumMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
+        if (sectionId in RPC_SUPERUSER_MENU_SECTIONS &&
+                userService.hasRpcSuperuserPolicy(user, location?.id) &&
+                roleTypes?.any { RPC_SUPERUSER_MENU_MIN_ROLES.contains(it as RoleType) }) {
+            return true
+        }
         Set<String> acceptedRoleTypeNames = (RoleType.expand(roleTypes)*.name()) as Set<String>
         Set<String> effectiveRoleNames = (userService.getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
         return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
     }
 
-    private boolean userHasSupplementalMenuRole(User user, Location location, Collection roleTypes) {
+    private boolean userHasSupplementalMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
+        if (sectionId in RPC_SUPERUSER_MENU_SECTIONS &&
+                userService.hasRpcSuperuserPolicy(user, location?.id) &&
+                roleTypes?.any { it in [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_REGIONAL_WAREHOUSE] }) {
+            return true
+        }
         Set<String> acceptedRoleTypeNames = (roleTypes*.name()) as Set<String>
         Set<String> effectiveRoleNames = (userService.getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
         return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
@@ -62,32 +79,32 @@ class MegamenuService {
             translatedSection = [
                     id: key,
                     label: label,
-                    subsections: buildAndTranslateSubsections(section.subsections, user, location)
+                    subsections: buildAndTranslateSubsections(section.subsections, user, location, key)
             ]
             return translatedSection
         } else if (section.menuItems) {
             translatedSection = [
                     id: key,
                     label: label,
-                    menuItems: buildAndTranslateMenuItems(section.menuItems, user, location)
+                    menuItems: buildAndTranslateMenuItems(section.menuItems, user, location, key)
             ]
             return translatedSection
         }
         return [:]
     }
 
-    List buildAndTranslateSubsections(List subsections, User user, Location location) {
+    List buildAndTranslateSubsections(List subsections, User user, Location location, String sectionId = null) {
         def builtSubsections = []
         subsections.each {
             def minRole = it.minimumRequiredRole
             if (it.enabled == false) {
                 return
             }
-            if (minRole && !userHasMinimumMenuRole(user, location, [minRole])) {
+            if (minRole && !userHasMinimumMenuRole(user, location, [minRole], sectionId)) {
                 return
             }
             def roles = it.supplementalRoles
-            if (roles && !userHasSupplementalMenuRole(user, location, roles)) {
+            if (roles && !userHasSupplementalMenuRole(user, location, roles, sectionId)) {
                 return
             }
             ActivityCode[] activitiesAny = it.requiredActivitiesAny ?: []
@@ -102,24 +119,24 @@ class MegamenuService {
             def label = getMessageTagLib().message(code: it.label, default: it.defaultLabel)
             builtSubsections << [
                 label: label,
-                menuItems: buildAndTranslateMenuItems(it.menuItems, user, location)
+                menuItems: buildAndTranslateMenuItems(it.menuItems, user, location, sectionId)
             ]
         }
         return builtSubsections
     }
 
-    List buildAndTranslateMenuItems(List menuItems, User user, Location location) {
+    List buildAndTranslateMenuItems(List menuItems, User user, Location location, String sectionId = null) {
         def builtMenuItems = []
         menuItems.each {
             if (it.enabled == false) {
                 return
             }
             def minRole = it.minimumRequiredRole
-            if (minRole && !userHasMinimumMenuRole(user, location, [minRole])) {
+            if (minRole && !userHasMinimumMenuRole(user, location, [minRole], sectionId)) {
                 return
             }
             def roles = it.supplementalRoles
-            if (roles && !userHasSupplementalMenuRole(user, location, roles)) {
+            if (roles && !userHasSupplementalMenuRole(user, location, roles, sectionId)) {
                 return
             }
             ActivityCode[] activitiesAny = it.requiredActivitiesAny ?: []
@@ -140,7 +157,7 @@ class MegamenuService {
             } else if (it.subsections) {
                 builtMenuItems << [
                     label: label,
-                    subsections: buildAndTranslateSubsections(it.subsections, user, location)
+                    subsections: buildAndTranslateSubsections(it.subsections, user, location, sectionId)
                 ]
             }
         }
@@ -151,11 +168,11 @@ class MegamenuService {
         def parsedMenuConfig = []
         menuConfig.each { key, value ->
             def minRole = value.minimumRequiredRole
-            if (minRole && !userHasMinimumMenuRole(user, location, [minRole])) {
+            if (minRole && !userHasMinimumMenuRole(user, location, [minRole], key)) {
                 return
             }
             def roles = value.supplementalRoles
-            if (roles && !userHasSupplementalMenuRole(user, location, roles)) {
+            if (roles && !userHasSupplementalMenuRole(user, location, roles, key)) {
                 return
             }
             ActivityCode[] activitiesAny = value.requiredActivitiesAny ?: []
@@ -175,13 +192,15 @@ class MegamenuService {
             }
         }
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, location?.id)
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(user, location?.id)
         boolean hasFacilityStorekeeperPolicy = !hasRegionalWarehousePolicy &&
+                !hasRpcSuperuserPolicy &&
                 userService.hasFacilityStorekeeperPolicy(user, location?.id)
 
         if (hasFacilityStorekeeperPolicy) {
             parsedMenuConfig = applyFacilityStorekeeperMenuPolicy(parsedMenuConfig)
         }
-        if (hasRegionalWarehousePolicy) {
+        if (hasRegionalWarehousePolicy && !hasRpcSuperuserPolicy) {
             parsedMenuConfig = applyRegionalWarehouseMenuPolicy(parsedMenuConfig)
         }
         return parsedMenuConfig
diff --git a/grails-app/services/org/pih/warehouse/core/LocationService.groovy b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
index c6756fadd1d..3c473fb73e5 100644
--- a/grails-app/services/org/pih/warehouse/core/LocationService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
@@ -262,6 +262,7 @@ class LocationService {
         def inRoleBrowser = user.hasDefaultRole(RoleType.ROLE_BROWSER)
         def inRoleFacilityStorekeeper = user.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
         def inRoleRegionalWarehouse = user.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
+        def inRoleRpcSuperuser = user.hasDefaultRole(RoleType.ROLE_RPC_SUPERUSER)
         def inRoleAssistant = user.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = user.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = user.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -280,7 +281,7 @@ class LocationService {
                 locations += getRequestorLocations(user)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 user.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/services/org/pih/warehouse/core/UserService.groovy b/grails-app/services/org/pih/warehouse/core/UserService.groovy
index ad137187313..31078b957a8 100644
--- a/grails-app/services/org/pih/warehouse/core/UserService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/UserService.groovy
@@ -207,7 +207,8 @@ class UserService {
                     RoleType.ROLE_BROWSER.name(),
                     RoleType.ROLE_ASSISTANT.name(),
                     RoleType.ROLE_FACILITY_STOREKEEPER.name(),
-                    RoleType.ROLE_REGIONAL_WAREHOUSE.name()
+                    RoleType.ROLE_REGIONAL_WAREHOUSE.name(),
+                    RoleType.ROLE_RPC_SUPERUSER.name()
             ] as Set<String>
             return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
         }
@@ -285,6 +286,14 @@ class UserService {
         return false
     }
 
+    Boolean hasRoleRpcSuperuser(User u) {
+        if (u) {
+            def user = User.get(u.id)
+            return getEffectiveRoles(user).any { Role role -> role.roleType?.name() == RoleType.ROLE_RPC_SUPERUSER.name() }
+        }
+        return false
+    }
+
     Boolean hasFacilityStorekeeperPolicy(User u, String locationId) {
         if (u) {
             def user = User.get(u.id)
@@ -319,6 +328,23 @@ class UserService {
         return false
     }
 
+    Boolean hasRpcSuperuserPolicy(User u, String locationId) {
+        if (u) {
+            def user = User.get(u.id)
+            Location location = Location.get(locationId)
+            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
+            Set<String> higherCoreRoleNames = [
+                    RoleType.ROLE_SUPERUSER.name(),
+                    RoleType.ROLE_ADMIN.name(),
+                    RoleType.ROLE_MANAGER.name(),
+                    RoleType.ROLE_ASSISTANT.name()
+            ]
+            return effectiveRoleNames.contains(RoleType.ROLE_RPC_SUPERUSER.name()) &&
+                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
+        }
+        return false
+    }
+
     // Checks if requestor role exist for any location - for location chooser purposes
     Boolean hasRoleRequestorInAnyLocations(User u) {
         if (u) {
diff --git a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
index e71635b0639..1e10523c202 100644
--- a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
+++ b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
@@ -69,7 +69,8 @@ class AuthTagLib {
     }
     def canManageStocklists = { attrs, body ->
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
-        if (userService.isUserAdmin(session?.user) || hasRegionalWarehousePolicy) {
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
+        if (userService.isUserAdmin(session?.user) || hasRegionalWarehousePolicy || hasRpcSuperuserPolicy) {
             out << body()
         }
     }
@@ -128,18 +129,22 @@ class AuthTagLib {
     def hasHighestRoleAuthenticated = { attrs, body ->
         boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
         if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
                 !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy)
+                !hasRegionalWarehousePolicy &&
+                !hasRpcSuperuserPolicy)
             out << body()
     }
 
     def hasHigherRoleThanAuthenticated = { attrs, body ->
         boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
+        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
         if (!userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) ||
                 hasFacilityStorekeeperPolicy ||
-                hasRegionalWarehousePolicy)
+                hasRegionalWarehousePolicy ||
+                hasRpcSuperuserPolicy)
             out << body()
     }
 }
diff --git a/src/js/components/productSupplier/ProductSupplierHeader.jsx b/src/js/components/productSupplier/ProductSupplierHeader.jsx
index 671c0715fac..d7580abd0f5 100644
--- a/src/js/components/productSupplier/ProductSupplierHeader.jsx
+++ b/src/js/components/productSupplier/ProductSupplierHeader.jsx
@@ -1,5 +1,7 @@
 import React from 'react';
 
+import { useSelector } from 'react-redux';
+
 import Button from 'components/form-elements/Button';
 import ListTitle from 'components/listPagesUtils/ListTitle';
 import { PRODUCT_SUPPLIER_URL } from 'consts/applicationUrls';
@@ -9,10 +11,12 @@ import HeaderButtonsWrapper from 'wrappers/HeaderButtonsWrapper';
 import HeaderWrapper from 'wrappers/HeaderWrapper';
 
 const ProductSupplierHeader = () => {
-  const canManageProducts = useUserHasPermissions({
+  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
+  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
 
   return (
     <HeaderWrapper>
diff --git a/src/js/components/productSupplier/ProductSupplierListTable.jsx b/src/js/components/productSupplier/ProductSupplierListTable.jsx
index a4c19dd7e5c..31a251247bf 100644
--- a/src/js/components/productSupplier/ProductSupplierListTable.jsx
+++ b/src/js/components/productSupplier/ProductSupplierListTable.jsx
@@ -2,6 +2,7 @@ import React, { useMemo } from 'react';
 
 import PropTypes from 'prop-types';
 import { RiDownload2Line } from 'react-icons/ri';
+import { useSelector } from 'react-redux';
 
 import DataTable, { TableCell } from 'components/DataTable';
 import DateCell from 'components/DataTable/DateCell';
@@ -31,10 +32,12 @@ const ProductSupplierListTable = ({ filterParams }) => {
     exportProductSuppliers,
   } = useProductSupplierActions({ fireFetchData, filterParams });
 
-  const canManageProducts = useUserHasPermissions({
+  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
+  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
 
   const columns = useMemo(() => [
     {
diff --git a/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx b/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx
index 594f4aa25ae..c6687baa3b8 100644
--- a/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx
+++ b/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx
@@ -4,6 +4,7 @@ import _ from 'lodash';
 import PropTypes from 'prop-types';
 import { RiCloseFill } from 'react-icons/all';
 import Modal from 'react-modal';
+import { useSelector } from 'react-redux';
 
 import Button from 'components/form-elements/Button';
 import { PRODUCT_SUPPLIER_URL } from 'consts/applicationUrls';
@@ -17,10 +18,12 @@ const PreferenceTypeModal = ({
   modalData,
   productSupplierId,
 }) => {
-  const canManageProducts = useUserHasPermissions({
+  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
+  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
 
   useEffect(() => {
     if (isOpen) {
diff --git a/src/js/components/products/ProductsListHeader.jsx b/src/js/components/products/ProductsListHeader.jsx
index d13061b4239..60b8d47e938 100644
--- a/src/js/components/products/ProductsListHeader.jsx
+++ b/src/js/components/products/ProductsListHeader.jsx
@@ -7,12 +7,12 @@ import Button from 'components/form-elements/Button';
 import { PRODUCT_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const ProductsListHeader = ({ isUserAdmin }) => (
+const ProductsListHeader = ({ isUserAdmin, hasRpcSuperuserPolicy }) => (
   <div className="d-flex list-page-header">
     <span className="d-flex align-self-center title">
       <Translate id="react.productsList.header.label" defaultMessage="Product List" />
     </span>
-    {isUserAdmin
+    {(isUserAdmin || hasRpcSuperuserPolicy)
       && (
       <div className="d-flex justify-content-end buttons align-items-center">
         <a href={PRODUCT_URL.importCSV()}>
@@ -35,10 +35,12 @@ const ProductsListHeader = ({ isUserAdmin }) => (
 
 const mapStateToProps = (state) => ({
   isUserAdmin: state.session.isUserAdmin,
+  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
 });
 
 export default connect(mapStateToProps)(ProductsListHeader);
 
 ProductsListHeader.propTypes = {
   isUserAdmin: PropTypes.bool.isRequired,
+  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
 };
diff --git a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
index bc584164fb2..a3406551416 100644
--- a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
+++ b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
@@ -32,6 +32,7 @@ import 'react-confirm-alert/src/react-confirm-alert.css';
 const PurchaseOrderListTable = ({
   supportedActivities,
   highestRole,
+  hasRpcSuperuserPolicy,
   hasFacilityStorekeeperPolicy,
   translate,
   currencyCode,
@@ -50,6 +51,7 @@ const PurchaseOrderListTable = ({
     downloadOrders,
     onFetchHandler,
   } = usePurchaseOrderListTableData(filterParams);
+  const effectiveHighestRole = hasRpcSuperuserPolicy ? 'Superuser' : highestRole;
 
   const getStatusTooltip = (status) => translate(
     `react.purchaseOrder.status.${status.toLowerCase()}.description.label`,
@@ -160,7 +162,7 @@ const PurchaseOrderListTable = ({
           dropdownClasses="action-dropdown-offset"
           actions={findActions(actions, row, {
             supportedActivities,
-            highestRole,
+            highestRole: effectiveHighestRole,
             customFilter: (action) =>
               !(hasFacilityStorekeeperPolicy && action.hiddenForFacilityStorekeeper),
           })}
@@ -312,7 +314,7 @@ const PurchaseOrderListTable = ({
       sortable: false,
       minWidth: 260,
     },
-  ], [supportedActivities, highestRole, actions, hasFacilityStorekeeperPolicy]);
+  ], [supportedActivities, effectiveHighestRole, actions, hasFacilityStorekeeperPolicy]);
 
   const totalAmount = () => `${translate('react.purchaseOrder.totalAmount.label', 'Total amount')}: ${tableData.totalPrice.toLocaleString([locale, 'en'])} ${currencyCode}`;
 
@@ -384,6 +386,7 @@ const PurchaseOrderListTable = ({
 const mapStateToProps = (state) => ({
   supportedActivities: state.session.supportedActivities,
   highestRole: state.session.highestRole,
+  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
   hasFacilityStorekeeperPolicy: state.session.hasFacilityStorekeeperPolicy,
   translate: translateWithDefaultMessage(getTranslate(state.localize)),
   currencyCode: state.session.currencyCode,
@@ -397,6 +400,7 @@ PurchaseOrderListTable.propTypes = {
   filterParams: PropTypes.shape({}).isRequired,
   supportedActivities: PropTypes.arrayOf(PropTypes.string).isRequired,
   highestRole: PropTypes.string.isRequired,
+  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
   hasFacilityStorekeeperPolicy: PropTypes.bool,
   translate: PropTypes.func.isRequired,
   currencyCode: PropTypes.string.isRequired,
diff --git a/src/js/components/stock-list-management/StocklistManagement.jsx b/src/js/components/stock-list-management/StocklistManagement.jsx
index 49b50c0b511..a422f75c3be 100644
--- a/src/js/components/stock-list-management/StocklistManagement.jsx
+++ b/src/js/components/stock-list-management/StocklistManagement.jsx
@@ -222,6 +222,9 @@ class StocklistManagement extends Component {
 
   render() {
     const { data } = this.state;
+    const canWriteStocklists = this.props.isUserAdmin
+      || this.props.hasRegionalWarehousePolicy
+      || this.props.hasRpcSuperuserPolicy;
     return (
       <div className="main-container">
         { this.state.productInfo
@@ -529,13 +532,13 @@ class StocklistManagement extends Component {
 
                 return (
                   <div className="d-flex flex-wrap">
-                    {this.props.isUserAdmin
+                    {canWriteStocklists
                       ? (
                         <div>
                           <button
                             type="button"
                             className="btn btn-outline-primary btn-xs mr-1"
-                            disabled={original.edit || original.new || !this.props.isUserAdmin}
+                            disabled={original.edit || original.new || !canWriteStocklists}
                             onClick={() => this.editItem(index)}
                           >
                             <Translate id="react.default.button.edit.label" defaultMessage="Edit" />
@@ -544,7 +547,7 @@ class StocklistManagement extends Component {
                             type="button"
                             className="btn btn-outline-primary btn-xs mr-1"
                             disabled={(!original.edit && !original.new) || !original.stocklistId
-                          || _.isNil(original.maxQuantity) || original.maxQuantity === '' || !this.props.isUserAdmin}
+                          || _.isNil(original.maxQuantity) || original.maxQuantity === '' || !canWriteStocklists}
                             onClick={() => this.saveItem(index, original)}
                           >
                             <Translate id="react.default.button.save.label" defaultMessage="Save" />
@@ -552,7 +555,7 @@ class StocklistManagement extends Component {
                           <button
                             type="button"
                             className="btn btn-outline-danger btn-xs mr-1"
-                            disabled={!this.props.isUserAdmin}
+                            disabled={!canWriteStocklists}
                             onClick={() => this.deleteItem(index)}
                           >
                             <Translate id="react.default.button.delete.label" defaultMessage="Delete" />
@@ -596,7 +599,7 @@ class StocklistManagement extends Component {
             },
           ]}
         />
-        {this.props.isUserAdmin
+        {canWriteStocklists
           ? (
             <div className="d-flex flex-row my-1">
               <Select
@@ -632,6 +635,8 @@ const mapStateToProps = (state) => ({
   locale: state.session.activeLanguage,
   stockListManagementTranslationsFetched: state.session.fetchedTranslations.stockListManagement,
   isUserAdmin: state.session.isUserAdmin,
+  hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
+  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
 });
 
 export default connect(mapStateToProps, {
@@ -652,4 +657,6 @@ StocklistManagement.propTypes = {
   stockListManagementTranslationsFetched: PropTypes.bool.isRequired,
   fetchTranslations: PropTypes.func.isRequired,
   isUserAdmin: PropTypes.bool.isRequired,
+  hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
+  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
 };
diff --git a/src/js/components/stock-list/StockListHeader.jsx b/src/js/components/stock-list/StockListHeader.jsx
index 033dc46e389..51624d4f416 100644
--- a/src/js/components/stock-list/StockListHeader.jsx
+++ b/src/js/components/stock-list/StockListHeader.jsx
@@ -6,14 +6,14 @@ import { connect } from 'react-redux';
 import { REQUISITION_TEMPLATE_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const StockListHeader = ({ isUserAdmin, hasRegionalWarehousePolicy }) => (
+const StockListHeader = ({ isUserAdmin, hasRegionalWarehousePolicy, hasRpcSuperuserPolicy }) => (
   <div className="d-flex list-page-header">
     <span className="d-flex align-self-center title">
       <Translate id="react.stocklists.header.label" defaultMessage="Stock List" />
     </span>
     <div className="d-flex justify-content-end buttons align-items-center">
       {
-        (isUserAdmin || hasRegionalWarehousePolicy) && (
+        (isUserAdmin || hasRegionalWarehousePolicy || hasRpcSuperuserPolicy) && (
           <a className="primary-button" href={`${REQUISITION_TEMPLATE_URL.create()}?type=STOCK`}>
             <Translate id="react.stocklists.addStockList.label" defaultMessage="Add stocklist" />
           </a>
@@ -26,6 +26,7 @@ const StockListHeader = ({ isUserAdmin, hasRegionalWarehousePolicy }) => (
 const mapStateToProps = (state) => ({
   isUserAdmin: state.session.isUserAdmin,
   hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
+  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
 });
 
 export default connect(mapStateToProps)(StockListHeader);
@@ -33,4 +34,5 @@ export default connect(mapStateToProps)(StockListHeader);
 StockListHeader.propTypes = {
   isUserAdmin: PropTypes.bool.isRequired,
   hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
+  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
 };
diff --git a/src/js/components/stock-list/StockListTable.jsx b/src/js/components/stock-list/StockListTable.jsx
index c75bec8be29..56ad51c17cf 100644
--- a/src/js/components/stock-list/StockListTable.jsx
+++ b/src/js/components/stock-list/StockListTable.jsx
@@ -33,6 +33,7 @@ const StockListTable = ({
   translate,
   highestRole,
   hasRegionalWarehousePolicy,
+  hasRpcSuperuserPolicy,
 }) => {
   const {
     tableData,
@@ -49,7 +50,10 @@ const StockListTable = ({
   } = useStockListTableData(filterParams);
 
   const customActionFilter = ({ isPublished, requiresStocklistWrite }, row) => {
-    const canWriteStocklists = hasRegionalWarehousePolicy || highestRole === 'Admin' || highestRole === 'Superuser';
+    const canWriteStocklists = hasRegionalWarehousePolicy ||
+      hasRpcSuperuserPolicy ||
+      highestRole === 'Admin' ||
+      highestRole === 'Superuser';
     if (requiresStocklistWrite && !canWriteStocklists) return false;
     // skip actions that don't have isPublished property
     if (isPublished === undefined) return true;
@@ -228,7 +232,7 @@ const StockListTable = ({
       accessor: 'lastUpdated',
       width: 150,
     },
-  ], [highestRole, hasRegionalWarehousePolicy]);
+  ], [highestRole, hasRegionalWarehousePolicy, hasRpcSuperuserPolicy]);
 
   return (
     <div className="list-page-list-section">
@@ -269,6 +273,7 @@ const mapStateToProps = (state) => ({
   translate: translateWithDefaultMessage(getTranslate(state.localize)),
   highestRole: state.session.highestRole,
   hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
+  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
 });
 
 export default connect(mapStateToProps)(StockListTable);
@@ -278,4 +283,5 @@ StockListTable.propTypes = {
   translate: PropTypes.func.isRequired,
   highestRole: PropTypes.string.isRequired,
   hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
+  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
 };
diff --git a/src/js/consts/roleType.js b/src/js/consts/roleType.js
index 9557950b100..e01a4c4fc97 100644
--- a/src/js/consts/roleType.js
+++ b/src/js/consts/roleType.js
@@ -38,6 +38,7 @@ const RoleType = {
   ROLE_STOCKER: 'ROLE_STOCKER',
   ROLE_FACILITY_STOREKEEPER: 'ROLE_FACILITY_STOREKEEPER',
   ROLE_REGIONAL_WAREHOUSE: 'ROLE_REGIONAL_WAREHOUSE',
+  ROLE_RPC_SUPERUSER: 'ROLE_RPC_SUPERUSER',
   ROLE_WORKER: 'ROLE_WORKER',
   ROLE_PHARMACIST: 'ROLE_PHARMACIST',
   ROLE_PHARMACY_TECH: 'ROLE_PHARMACY_TECH',
diff --git a/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx b/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx
index 67802c5b36f..6b2fdf0c94d 100644
--- a/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx
+++ b/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx
@@ -1,6 +1,7 @@
 import React, { useCallback } from 'react';
 
 import { RiDeleteBinLine, RiPencilLine } from 'react-icons/ri';
+import { useSelector } from 'react-redux';
 
 import productSupplierApi from 'api/services/ProductSupplierApi';
 import { PRODUCT_SUPPLIER_EXPORT } from 'api/urls';
@@ -16,10 +17,12 @@ import translate from 'utils/Translate';
 
 const useProductSupplierActions = ({ fireFetchData, filterParams }) => {
   const spinner = useSpinner();
-  const canManageProducts = useUserHasPermissions({
+  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
+  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
 
   const deleteProductSupplier = async (onClose, productSupplierId) => {
     try {
diff --git a/src/js/reducers/sessionReducer.jsx b/src/js/reducers/sessionReducer.jsx
index 38bffd06272..98a22fa2c68 100644
--- a/src/js/reducers/sessionReducer.jsx
+++ b/src/js/reducers/sessionReducer.jsx
@@ -26,6 +26,7 @@ const initialState = {
   isUserRequestApprover: false,
   hasFacilityStorekeeperPolicy: false,
   hasRegionalWarehousePolicy: false,
+  hasRpcSuperuserPolicy: false,
   supportedActivities: [],
   menuConfig: [],
   menuSectionsUrlParts: {},
@@ -103,6 +104,7 @@ export default function (state = initialState, action) {
         isUserManager: _.get(action, 'payload.data.data.isUserManager', false),
         hasFacilityStorekeeperPolicy: _.get(action, 'payload.data.data.hasFacilityStorekeeperPolicy', false),
         hasRegionalWarehousePolicy: _.get(action, 'payload.data.data.hasRegionalWarehousePolicy', false),
+        hasRpcSuperuserPolicy: _.get(action, 'payload.data.data.hasRpcSuperuserPolicy', false),
         supportedActivities: _.get(action, 'payload.data.data.supportedActivities'),
         activeLanguage: _.get(action, 'payload.data.data.activeLanguage'),
         activeLanguageTag: _.get(action, 'payload.data.data.activeLanguageTag'),
diff --git a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
index 119b400d36d..2afdbbb744a 100644
--- a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
+++ b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
@@ -65,6 +65,7 @@ enum RoleType {
     ROLE_STOCKER('Stocker', 50),
     ROLE_FACILITY_STOREKEEPER('Facility Storekeeper', 4),
     ROLE_REGIONAL_WAREHOUSE('Regional Warehouse User', 4),
+    ROLE_RPC_SUPERUSER('RPC Superuser', 4),
     ROLE_WORKER('Worker', 50),
 
     // Pharmacy roles
@@ -118,6 +119,7 @@ enum RoleType {
                 ROLE_BROWSER,
                 ROLE_FACILITY_STOREKEEPER,
                 ROLE_REGIONAL_WAREHOUSE,
+                ROLE_RPC_SUPERUSER,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -167,6 +169,7 @@ enum RoleType {
                 ROLE_BROWSER,
                 ROLE_FACILITY_STOREKEEPER,
                 ROLE_REGIONAL_WAREHOUSE,
+                ROLE_RPC_SUPERUSER,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -196,6 +199,7 @@ enum RoleType {
                 ROLE_ASSISTANT,
                 ROLE_FACILITY_STOREKEEPER,
                 ROLE_REGIONAL_WAREHOUSE,
+                ROLE_RPC_SUPERUSER,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
                 ROLE_SUPERUSER,

From 2bde6f8cfa0dba0996298a66a2e85928827e1122 Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Wed, 20 May 2026 12:06:33 -0300
Subject: [PATCH 04/10] feat(auth): add reporting user role policy and
 read-only enforcement

Implement ROLE_REPORTING_USER as a location-scoped operational role with highest-role-wins behavior and explicit policy predicates.

Wire role plumbing across backend and frontend (RoleType, JS constants, session payload/reducer, i18n label, location chooser support, and Liquibase role seed migration).

Enforce permissions in RoleInterceptor and MegamenuService: deny purchasing, keep reporting/menu visibility for reads, block write/mutation routes, and hide inbound/outbound create actions for reporting users.
---
 .../org/pih/warehouse/RoleInterceptor.groovy  | 121 +++++++++++++++++-
 .../pih/warehouse/api/ApiController.groovy    |  12 +-
 .../api/LocationApiController.groovy          |   3 +-
 grails-app/i18n/messages.properties           |   1 +
 .../2026-05-20-add-reporting-user-role.groovy |  15 +++
 grails-app/migrations/custom/changelog.groovy |   1 +
 .../pih/warehouse/api/MegamenuService.groovy  |  51 ++++++++
 .../pih/warehouse/core/LocationService.groovy |   3 +-
 .../org/pih/warehouse/core/UserService.groovy |  28 +++-
 .../inbound/StockMovementInboundHeader.jsx    |  47 ++++---
 .../inbound/StockMovementInboundList.jsx      |  11 +-
 .../outbound/StockMovementOutboundHeader.jsx  |  31 +++--
 .../outbound/StockMovementOutboundList.jsx    |   7 +
 src/js/consts/roleType.js                     |   1 +
 src/js/reducers/sessionReducer.jsx            |   2 +
 .../org/pih/warehouse/core/RoleType.groovy    |   4 +
 16 files changed, 300 insertions(+), 38 deletions(-)
 create mode 100644 grails-app/migrations/custom/2026-05-20-add-reporting-user-role.groovy

diff --git a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
index 2e6baae6dc4..034b4374a21 100644
--- a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
+++ b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
@@ -147,6 +147,22 @@ class RoleInterceptor {
         'productsConfiguration': ['*'],
         'productsConfigurationApi': ['*'],
     ]
+    def static reportingUserActions = [
+        'api'                 : ['getAppContext', 'getRequestTypes', 'getMenuConfig'],
+        'dashboard'           : ['megamenu'],
+        'grails'              : ['errors'],
+        'localizationApi'     : ['list'],
+        'locationApi'         : ['list'],
+        'productApi'          : ['list', 'productDemand', 'productAvailabilityAndDemand'],
+        'requisitionTemplate' : ['list', 'show'],
+        'stocklistApi'        : ['list', 'read'],
+        'stocklistItemApi'    : ['list', 'read', 'availableStocklists'],
+        'stockMovement'       : ['list'],
+        'stockMovementApi'    : ['read', 'list'],
+        'stockMovementItemApi': ['getStockMovementItems'],
+        'stockTransferApi'    : ['list', 'read', 'stockTransferCandidates', 'returnCandidates'],
+        'stockTransfer'       : ['list'],
+    ]
 
     def static invoiceActions = [
         'invoice': ['*']
@@ -192,9 +208,14 @@ class RoleInterceptor {
         Boolean hasRegionalWarehousePolicy = hasWarehouseContext &&
                 !hasRpcSuperuserPolicy &&
                 userService.hasRegionalWarehousePolicy(session.user, session?.warehouse?.id)
+        Boolean hasReportingUserPolicy = hasWarehouseContext &&
+                !hasRpcSuperuserPolicy &&
+                !hasRegionalWarehousePolicy &&
+                userService.hasReportingUserPolicy(session.user, session?.warehouse?.id)
         Boolean hasFacilityStorekeeperPolicy = hasWarehouseContext &&
                 !hasRpcSuperuserPolicy &&
                 !hasRegionalWarehousePolicy &&
+                !hasReportingUserPolicy &&
                 userService.hasFacilityStorekeeperPolicy(session.user, session?.warehouse?.id)
         Boolean isRpcSuperuserAllowedAction = hasRpcSuperuserPolicy && needRpcSuperuser(controllerName, actionName, params, request)
         Boolean isRpcSuperuserRestrictedAction = hasRpcSuperuserPolicy && needRpcSuperuserDeniedAction(controllerName, actionName, params, request)
@@ -202,13 +223,15 @@ class RoleInterceptor {
         Boolean isStorekeeperRestrictedAction = hasFacilityStorekeeperPolicy && needStorekeeperDeniedAction(controllerName, actionName, params, request)
         Boolean isRegionalWarehouseAllowedAction = hasRegionalWarehousePolicy && needRegionalWarehouse(controllerName, actionName, params, request)
         Boolean isRegionalWarehouseRestrictedAction = hasRegionalWarehousePolicy && needRegionalWarehouseDeniedAction(controllerName, actionName, params, request)
+        Boolean isReportingUserAllowedAction = hasReportingUserPolicy && needReportingUser(controllerName, actionName, params, request)
+        Boolean isReportingUserRestrictedAction = hasReportingUserPolicy && needReportingUserDeniedAction(controllerName, actionName, params, request)
 
-        if (isRpcSuperuserRestrictedAction || isStorekeeperRestrictedAction || isRegionalWarehouseRestrictedAction) {
+        if (isRpcSuperuserRestrictedAction || isStorekeeperRestrictedAction || isRegionalWarehouseRestrictedAction || isReportingUserRestrictedAction) {
             log.info("User ${session?.user?.username} does not have access to ${controllerName}/${actionName} in location ${session?.warehouse?.name}")
             redirect(controller: "errors", action: "handleForbidden")
             return false
         }
-        if (isRpcSuperuserAllowedAction || isStorekeeperAllowedAction || isRegionalWarehouseAllowedAction) {
+        if (isRpcSuperuserAllowedAction || isStorekeeperAllowedAction || isRegionalWarehouseAllowedAction || isReportingUserAllowedAction) {
             return true
         }
 
@@ -375,7 +398,7 @@ class RoleInterceptor {
         ]) {
             return true
         }
-        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete']) {
+        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete', 'importCsv']) {
             return true
         }
 
@@ -467,4 +490,96 @@ class RoleInterceptor {
         }
         return false
     }
+
+    static Boolean needReportingUser(controllerName, actionName, params = null, request = null) {
+        if (needReportingUserDeniedAction(controllerName, actionName, params, request)) {
+            return false
+        }
+        return reportingUserActions[controllerName]?.contains("*") ||
+                reportingUserActions[controllerName]?.contains(actionName)
+    }
+
+    static Boolean needReportingUserDeniedAction(controllerName, actionName, params, request = null) {
+        if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
+            return true
+        }
+        if (controllerName == 'dashboard' && actionName == 'supplier') {
+            return true
+        }
+
+        if (controllerName in ['inventory', 'inventoryItem', 'stockTransfer', 'stockTransferApi', 'stockMovement', 'stockMovementApi', 'stockMovementItemApi', 'stocklist', 'stocklistApi', 'stocklistItemApi', 'stocklistManagement', 'requisitionTemplate', 'json']) {
+            if (needManager(controllerName, actionName)) {
+                return true
+            }
+        }
+
+        if (controllerName == 'stockMovement' && actionName in ['createInbound', 'createOutbound', 'importOutboundStockMovement', 'verifyRequest', 'createRequest']) {
+            return true
+        }
+        if (controllerName == 'stockMovementApi' && actionName in ['create', 'update', 'updateStatus', 'delete']) {
+            return true
+        }
+
+        if (controllerName == 'stocklistApi' && actionName in ['create', 'update', 'delete', 'sendMail', 'clear', 'clone', 'publish', 'unpublish', 'export']) {
+            return true
+        }
+        if (controllerName == 'stocklistItemApi' && actionName in ['create', 'update', 'remove']) {
+            return true
+        }
+        if (controllerName == 'requisitionTemplate' && actionName in [
+                'create',
+                'save',
+                'edit',
+                'editHeader',
+                'update',
+                'delete',
+                'clear',
+                'clone',
+                'publish',
+                'unpublish',
+                'export',
+                'batch',
+                'importData',
+                'doImport',
+                'sendMail',
+                'addToRequisitionItems',
+                'removeFromRequisitionItems',
+                'changeSortOrderAlpha',
+                'changeSortOrderChrono',
+        ]) {
+            return true
+        }
+        if (controllerName == 'stocklistManagement') {
+            return true
+        }
+        if (controllerName == 'json' && actionName in ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems']) {
+            return true
+        }
+
+        if (controllerName == 'product' && actionName in [
+                'batchEdit',
+                'batchEditProperties',
+                'create',
+                'save',
+                'edit',
+                'update',
+                'delete',
+                'deleteProducts',
+                'importAsCsv',
+                'savePackage',
+                'deleteDocument',
+                'deleteProductComponent',
+                'deleteProductGroup',
+                'editProductSynonym',
+                'editProductSynonymDialog',
+                'deleteSynonym',
+        ]) {
+            return true
+        }
+        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete', 'importCsv']) {
+            return true
+        }
+
+        return false
+    }
 }
diff --git a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
index f045ebd4602..bfe99af65e2 100644
--- a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
@@ -168,9 +168,16 @@ class ApiController {
         // TODO: investigate why in isUserManager method in userService there is Assistant role included
         ArrayList<RoleType> managerRoles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_MANAGER]
         boolean isUserManager = userService.getEffectiveRoles(user).any { managerRoles.contains(it.roleType) }
-        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session.warehouse?.id)
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session.warehouse?.id)
         boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session.warehouse?.id)
+        boolean hasRegionalWarehousePolicy = !hasRpcSuperuserPolicy &&
+                userService.hasRegionalWarehousePolicy(session?.user, session.warehouse?.id)
+        boolean hasReportingUserPolicy = !hasRpcSuperuserPolicy &&
+                !hasRegionalWarehousePolicy &&
+                userService.hasReportingUserPolicy(session?.user, session.warehouse?.id)
+        boolean hasFacilityStorekeeperPolicy = !hasRpcSuperuserPolicy &&
+                !hasRegionalWarehousePolicy &&
+                !hasReportingUserPolicy &&
+                userService.hasFacilityStorekeeperPolicy(session?.user, session.warehouse?.id)
         def supportedActivities = location.supportedActivities ?: location.locationType.supportedActivities
         boolean isImpersonated = session.impersonateUserId ? true : false
         def buildNumber = gitProperties.shortCommitId
@@ -219,6 +226,7 @@ class ApiController {
                 hasFacilityStorekeeperPolicy  : hasFacilityStorekeeperPolicy,
                 hasRegionalWarehousePolicy    : hasRegionalWarehousePolicy,
                 hasRpcSuperuserPolicy         : hasRpcSuperuserPolicy,
+                hasReportingUserPolicy        : hasReportingUserPolicy,
                 supportedActivities           : supportedActivities,
                 isImpersonated                : isImpersonated,
                 grailsVersion                 : grailsVersion,
diff --git a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
index a346c0555cb..7b421271dc5 100644
--- a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
@@ -64,6 +64,7 @@ class LocationApiController extends BaseDomainApiController {
         def inRoleFacilityStorekeeper = currentUser.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
         def inRoleRegionalWarehouse = currentUser.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
         def inRoleRpcSuperuser = currentUser.hasDefaultRole(RoleType.ROLE_RPC_SUPERUSER)
+        def inRoleReportingUser = currentUser.hasDefaultRole(RoleType.ROLE_REPORTING_USER)
         def inRoleAssistant = currentUser.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = currentUser.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = currentUser.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -84,7 +85,7 @@ class LocationApiController extends BaseDomainApiController {
                 locations += locationService.getRequestorLocations(currentUser)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleReportingUser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 currentUser.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/i18n/messages.properties b/grails-app/i18n/messages.properties
index 5dec4f7c658..b6e626743b3 100644
--- a/grails-app/i18n/messages.properties
+++ b/grails-app/i18n/messages.properties
@@ -1077,6 +1077,7 @@ enum.RoleType.ROLE_BROWSER=Browser
 enum.RoleType.ROLE_FACILITY_STOREKEEPER=Facility Storekeeper
 enum.RoleType.ROLE_REGIONAL_WAREHOUSE=Regional Warehouse User
 enum.RoleType.ROLE_RPC_SUPERUSER=RPC Superuser
+enum.RoleType.ROLE_REPORTING_USER=Reporting User
 enum.RoleType.ROLE_PURCHASE_APPROVER=Purchase approver
 enum.RoleType.ROLE_REQUISITION_APPROVER=Request approver
 # Event messages
diff --git a/grails-app/migrations/custom/2026-05-20-add-reporting-user-role.groovy b/grails-app/migrations/custom/2026-05-20-add-reporting-user-role.groovy
new file mode 100644
index 00000000000..425bd681f4a
--- /dev/null
+++ b/grails-app/migrations/custom/2026-05-20-add-reporting-user-role.groovy
@@ -0,0 +1,15 @@
+databaseChangeLog = {
+    changeSet(author: "codex", id: "202605201400-0") {
+        preConditions(onFail: "MARK_RAN") {
+            sqlCheck(expectedResult: "0", "select count(*) from role where role_type = 'ROLE_REPORTING_USER'")
+        }
+
+        insert(tableName: "role") {
+            column(name: "id", value: "ROLE_REPORTING_USER")
+            column(name: "version", valueNumeric: "0")
+            column(name: "description", value: "Role for reporting users with dashboard/reporting and read-only access to inventory, inbound, outbound, products, and stocklists")
+            column(name: "role_type", value: "ROLE_REPORTING_USER")
+            column(name: "name", value: "Reporting User")
+        }
+    }
+}
diff --git a/grails-app/migrations/custom/changelog.groovy b/grails-app/migrations/custom/changelog.groovy
index 085c9f7e320..c295323414b 100644
--- a/grails-app/migrations/custom/changelog.groovy
+++ b/grails-app/migrations/custom/changelog.groovy
@@ -15,4 +15,5 @@ databaseChangeLog = {
     include file: '2026-05-15-add-facility-storekeeper-role.groovy'
     include file: '2026-05-19-add-regional-warehouse-role.groovy'
     include file: '2026-05-20-add-rpc-superuser-role.groovy'
+    include file: '2026-05-20-add-reporting-user-role.groovy'
 }
diff --git a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
index e79a5410669..162f28dbdd6 100644
--- a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
+++ b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
@@ -29,8 +29,25 @@ class MegamenuService {
     private static final List<String> REGIONAL_WAREHOUSE_HIDDEN_SECTIONS = [
             "purchasing",
     ]
+    private static final List<String> REPORTING_USER_HIDDEN_SECTIONS = [
+            "purchasing",
+    ]
 
     private static final String STOREKEEPER_INBOUND_CREATE_HREF = "/stockMovement/createInbound"
+    private static final List<String> REPORTING_USER_HIDDEN_HREF_FRAGMENTS = [
+            "/create",
+            "/edit",
+            "/delete",
+            "/import",
+            "/upload",
+            "/batch",
+            "/replenishment/create",
+            "/stockMovement/importOutboundStockMovement",
+            "/product/mergeProducts",
+            "/product/add",
+            "/inventoryItem/adjustStock",
+            "/inventoryItem/transferStock",
+    ]
     private static final Set<String> RPC_SUPERUSER_MENU_SECTIONS = ["purchasing", "products", "requisitionTemplate"] as Set<String>
     private static final Set<RoleType> RPC_SUPERUSER_MENU_MIN_ROLES = [
             RoleType.ROLE_ASSISTANT,
@@ -193,8 +210,12 @@ class MegamenuService {
         }
         boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, location?.id)
         boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(user, location?.id)
+        boolean hasReportingUserPolicy = !hasRegionalWarehousePolicy &&
+                !hasRpcSuperuserPolicy &&
+                userService.hasReportingUserPolicy(user, location?.id)
         boolean hasFacilityStorekeeperPolicy = !hasRegionalWarehousePolicy &&
                 !hasRpcSuperuserPolicy &&
+                !hasReportingUserPolicy &&
                 userService.hasFacilityStorekeeperPolicy(user, location?.id)
 
         if (hasFacilityStorekeeperPolicy) {
@@ -203,6 +224,9 @@ class MegamenuService {
         if (hasRegionalWarehousePolicy && !hasRpcSuperuserPolicy) {
             parsedMenuConfig = applyRegionalWarehouseMenuPolicy(parsedMenuConfig)
         }
+        if (hasReportingUserPolicy) {
+            parsedMenuConfig = applyReportingUserMenuPolicy(parsedMenuConfig)
+        }
         return parsedMenuConfig
     }
 
@@ -247,4 +271,31 @@ class MegamenuService {
 
         return filteredMenu
     }
+
+    private ArrayList applyReportingUserMenuPolicy(ArrayList menuConfig) {
+        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
+            !REPORTING_USER_HIDDEN_SECTIONS.contains(section?.id)
+        } as ArrayList
+
+        filteredMenu.each { section ->
+            if (section?.menuItems) {
+                section.menuItems = (section.menuItems ?: []).findAll { menuItem ->
+                    String href = menuItem?.href ?: ""
+                    !REPORTING_USER_HIDDEN_HREF_FRAGMENTS.any { href.contains(it) }
+                } ?: []
+            }
+            if (section?.subsections) {
+                section.subsections = (section.subsections ?: []).findAll { it != null }.collect { subsection ->
+                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
+                        String href = menuItem?.href ?: ""
+                        !REPORTING_USER_HIDDEN_HREF_FRAGMENTS.any { href.contains(it) }
+                    } ?: []
+                    return subsection
+                }
+                section.subsections = section.subsections.findAll { it?.menuItems }
+            }
+        }
+
+        return filteredMenu
+    }
 }
diff --git a/grails-app/services/org/pih/warehouse/core/LocationService.groovy b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
index 3c473fb73e5..44103083938 100644
--- a/grails-app/services/org/pih/warehouse/core/LocationService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
@@ -263,6 +263,7 @@ class LocationService {
         def inRoleFacilityStorekeeper = user.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
         def inRoleRegionalWarehouse = user.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
         def inRoleRpcSuperuser = user.hasDefaultRole(RoleType.ROLE_RPC_SUPERUSER)
+        def inRoleReportingUser = user.hasDefaultRole(RoleType.ROLE_REPORTING_USER)
         def inRoleAssistant = user.hasDefaultRole(RoleType.ROLE_ASSISTANT)
         def inRoleManager = user.hasDefaultRole(RoleType.ROLE_MANAGER)
         def inRoleAdmin = user.hasDefaultRole(RoleType.ROLE_ADMIN)
@@ -281,7 +282,7 @@ class LocationService {
                 locations += getRequestorLocations(user)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleReportingUser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
                 user.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/services/org/pih/warehouse/core/UserService.groovy b/grails-app/services/org/pih/warehouse/core/UserService.groovy
index 31078b957a8..20fdb7731f9 100644
--- a/grails-app/services/org/pih/warehouse/core/UserService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/UserService.groovy
@@ -208,7 +208,8 @@ class UserService {
                     RoleType.ROLE_ASSISTANT.name(),
                     RoleType.ROLE_FACILITY_STOREKEEPER.name(),
                     RoleType.ROLE_REGIONAL_WAREHOUSE.name(),
-                    RoleType.ROLE_RPC_SUPERUSER.name()
+                    RoleType.ROLE_RPC_SUPERUSER.name(),
+                    RoleType.ROLE_REPORTING_USER.name()
             ] as Set<String>
             return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
         }
@@ -294,6 +295,14 @@ class UserService {
         return false
     }
 
+    Boolean hasRoleReportingUser(User u) {
+        if (u) {
+            def user = User.get(u.id)
+            return getEffectiveRoles(user).any { Role role -> role.roleType?.name() == RoleType.ROLE_REPORTING_USER.name() }
+        }
+        return false
+    }
+
     Boolean hasFacilityStorekeeperPolicy(User u, String locationId) {
         if (u) {
             def user = User.get(u.id)
@@ -345,6 +354,23 @@ class UserService {
         return false
     }
 
+    Boolean hasReportingUserPolicy(User u, String locationId) {
+        if (u) {
+            def user = User.get(u.id)
+            Location location = Location.get(locationId)
+            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
+            Set<String> higherCoreRoleNames = [
+                    RoleType.ROLE_SUPERUSER.name(),
+                    RoleType.ROLE_ADMIN.name(),
+                    RoleType.ROLE_MANAGER.name(),
+                    RoleType.ROLE_ASSISTANT.name()
+            ]
+            return effectiveRoleNames.contains(RoleType.ROLE_REPORTING_USER.name()) &&
+                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
+        }
+        return false
+    }
+
     // Checks if requestor role exist for any location - for location chooser purposes
     Boolean hasRoleRequestorInAnyLocations(User u) {
         if (u) {
diff --git a/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx b/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx
index 549f14618a1..9f636827597 100644
--- a/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx
+++ b/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx
@@ -7,7 +7,7 @@ import Button from 'components/form-elements/Button';
 import { STOCK_MOVEMENT_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const StockMovementInboundHeader = ({ showMyStockMovements }) => (
+const StockMovementInboundHeader = ({ showMyStockMovements, hasReportingUserPolicy }) => (
   <div className="d-flex list-page-header">
     <span className="d-flex align-self-center title">
       <Translate id="react.stockMovement.inbound.list.label" defaultMessage="Inbound Movement List" />
@@ -19,30 +19,39 @@ const StockMovementInboundHeader = ({ showMyStockMovements }) => (
         label="react.stockMovement.myStockMovement.label"
         onClick={showMyStockMovements}
       />
-      <Link
-        className="primary-button"
-        to={{ pathname: STOCK_MOVEMENT_URL.createCombinedShipments(), search: 'direction=INBOUND' }}
-      >
-        <Translate
-          id="react.stockMovement.createShipmentFromPO.label"
-          defaultMessage="Create Shipment from PO"
-        />
-      </Link>
-      <Link
-        className="primary-button"
-        to={STOCK_MOVEMENT_URL.createInbound()}
-      >
-        <Translate
-          id="react.stockMovement.createStockMovement.label"
-          defaultMessage="Create Stock Movement"
-        />
-      </Link>
+      {!hasReportingUserPolicy && (
+        <Link
+          className="primary-button"
+          to={{ pathname: STOCK_MOVEMENT_URL.createCombinedShipments(), search: 'direction=INBOUND' }}
+        >
+          <Translate
+            id="react.stockMovement.createShipmentFromPO.label"
+            defaultMessage="Create Shipment from PO"
+          />
+        </Link>
+      )}
+      {!hasReportingUserPolicy && (
+        <Link
+          className="primary-button"
+          to={STOCK_MOVEMENT_URL.createInbound()}
+        >
+          <Translate
+            id="react.stockMovement.createStockMovement.label"
+            defaultMessage="Create Stock Movement"
+          />
+        </Link>
+      )}
     </div>
   </div>
 );
 
 StockMovementInboundHeader.propTypes = {
   showMyStockMovements: PropTypes.func.isRequired,
+  hasReportingUserPolicy: PropTypes.bool,
+};
+
+StockMovementInboundHeader.defaultProps = {
+  hasReportingUserPolicy: false,
 };
 
 export default StockMovementInboundHeader;
diff --git a/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx b/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx
index a5a104b60f9..c24ad978860 100644
--- a/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx
+++ b/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx
@@ -24,7 +24,10 @@ const StockMovementInboundList = (props) => {
 
   return (
     <div className="d-flex flex-column list-page-main">
-      <StockMovementInboundHeader showMyStockMovements={selectFiltersForMyStockMovements} />
+      <StockMovementInboundHeader
+        showMyStockMovements={selectFiltersForMyStockMovements}
+        hasReportingUserPolicy={props.hasReportingUserPolicy}
+      />
       <StockMovementInboundFilters
         defaultValues={defaultFilterValues}
         setFilterParams={setFilterValues}
@@ -43,6 +46,7 @@ const mapStateToProps = (state) => ({
   shipmentStatuses: state.shipmentStatuses.data,
   isShipmentStatusesFetched: state.shipmentStatuses.fetched,
   shipmentTypes: state.stockMovementCommon.shipmentTypes,
+  hasReportingUserPolicy: state.session.hasReportingUserPolicy,
 });
 
 export default withRouter(connect(mapStateToProps, {
@@ -62,4 +66,9 @@ StockMovementInboundList.propTypes = {
     label: PropTypes.string,
     description: PropTypes.string,
   })).isRequired,
+  hasReportingUserPolicy: PropTypes.bool,
+};
+
+StockMovementInboundList.defaultProps = {
+  hasReportingUserPolicy: false,
 };
diff --git a/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx b/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx
index 052b392dab3..3507b45b482 100644
--- a/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx
+++ b/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx
@@ -7,7 +7,11 @@ import Button from 'components/form-elements/Button';
 import { STOCK_MOVEMENT_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const StockMovementOutboundHeader = ({ showMyStockMovements, isRequestsOpen }) => (
+const StockMovementOutboundHeader = ({
+  showMyStockMovements,
+  isRequestsOpen,
+  hasReportingUserPolicy,
+}) => (
   <div className="d-flex list-page-header">
     <span className="d-flex align-self-center title">
       {
@@ -33,15 +37,17 @@ const StockMovementOutboundHeader = ({ showMyStockMovements, isRequestsOpen }) =
         label="react.stockMovement.myStockMovement.label"
         onClick={showMyStockMovements}
       />
-      <Link
-        className="primary-button"
-        to={STOCK_MOVEMENT_URL.createOutbound()}
-      >
-        <Translate
-          id="react.stockMovement.createStockMovement.label"
-          defaultMessage="Create Stock Movement"
-        />
-      </Link>
+      {!hasReportingUserPolicy && (
+        <Link
+          className="primary-button"
+          to={STOCK_MOVEMENT_URL.createOutbound()}
+        >
+          <Translate
+            id="react.stockMovement.createStockMovement.label"
+            defaultMessage="Create Stock Movement"
+          />
+        </Link>
+      )}
     </div>
   </div>
 );
@@ -49,6 +55,11 @@ const StockMovementOutboundHeader = ({ showMyStockMovements, isRequestsOpen }) =
 StockMovementOutboundHeader.propTypes = {
   showMyStockMovements: PropTypes.func.isRequired,
   isRequestsOpen: PropTypes.bool.isRequired,
+  hasReportingUserPolicy: PropTypes.bool,
+};
+
+StockMovementOutboundHeader.defaultProps = {
+  hasReportingUserPolicy: false,
 };
 
 export default StockMovementOutboundHeader;
diff --git a/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx b/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx
index 835b373a5c7..74e8f490cd5 100644
--- a/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx
+++ b/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx
@@ -28,6 +28,7 @@ const StockMovementOutboundList = (props) => {
       <StockMovementOutboundHeader
         isRequestsOpen={isRequestsList}
         showMyStockMovements={selectFiltersForMyStockMovements}
+        hasReportingUserPolicy={props.hasReportingUserPolicy}
       />
       <StockMovementOutboundFilters
         defaultValues={defaultFilterValues}
@@ -54,6 +55,7 @@ const mapStateToProps = (state) => ({
   isRequisitionStatusesFetched: state.requisitionStatuses.fetched,
   shipmentTypes: state.stockMovementCommon.shipmentTypes,
   approvers: state.approvers.data,
+  hasReportingUserPolicy: state.session.hasReportingUserPolicy,
 });
 
 export default withRouter(connect(mapStateToProps, {
@@ -80,4 +82,9 @@ StockMovementOutboundList.propTypes = {
     label: PropTypes.string,
     value: PropTypes.string,
   })).isRequired,
+  hasReportingUserPolicy: PropTypes.bool,
+};
+
+StockMovementOutboundList.defaultProps = {
+  hasReportingUserPolicy: false,
 };
diff --git a/src/js/consts/roleType.js b/src/js/consts/roleType.js
index e01a4c4fc97..52290250143 100644
--- a/src/js/consts/roleType.js
+++ b/src/js/consts/roleType.js
@@ -39,6 +39,7 @@ const RoleType = {
   ROLE_FACILITY_STOREKEEPER: 'ROLE_FACILITY_STOREKEEPER',
   ROLE_REGIONAL_WAREHOUSE: 'ROLE_REGIONAL_WAREHOUSE',
   ROLE_RPC_SUPERUSER: 'ROLE_RPC_SUPERUSER',
+  ROLE_REPORTING_USER: 'ROLE_REPORTING_USER',
   ROLE_WORKER: 'ROLE_WORKER',
   ROLE_PHARMACIST: 'ROLE_PHARMACIST',
   ROLE_PHARMACY_TECH: 'ROLE_PHARMACY_TECH',
diff --git a/src/js/reducers/sessionReducer.jsx b/src/js/reducers/sessionReducer.jsx
index 98a22fa2c68..53afad9cfeb 100644
--- a/src/js/reducers/sessionReducer.jsx
+++ b/src/js/reducers/sessionReducer.jsx
@@ -27,6 +27,7 @@ const initialState = {
   hasFacilityStorekeeperPolicy: false,
   hasRegionalWarehousePolicy: false,
   hasRpcSuperuserPolicy: false,
+  hasReportingUserPolicy: false,
   supportedActivities: [],
   menuConfig: [],
   menuSectionsUrlParts: {},
@@ -105,6 +106,7 @@ export default function (state = initialState, action) {
         hasFacilityStorekeeperPolicy: _.get(action, 'payload.data.data.hasFacilityStorekeeperPolicy', false),
         hasRegionalWarehousePolicy: _.get(action, 'payload.data.data.hasRegionalWarehousePolicy', false),
         hasRpcSuperuserPolicy: _.get(action, 'payload.data.data.hasRpcSuperuserPolicy', false),
+        hasReportingUserPolicy: _.get(action, 'payload.data.data.hasReportingUserPolicy', false),
         supportedActivities: _.get(action, 'payload.data.data.supportedActivities'),
         activeLanguage: _.get(action, 'payload.data.data.activeLanguage'),
         activeLanguageTag: _.get(action, 'payload.data.data.activeLanguageTag'),
diff --git a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
index 2afdbbb744a..47cab5f3411 100644
--- a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
+++ b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
@@ -66,6 +66,7 @@ enum RoleType {
     ROLE_FACILITY_STOREKEEPER('Facility Storekeeper', 4),
     ROLE_REGIONAL_WAREHOUSE('Regional Warehouse User', 4),
     ROLE_RPC_SUPERUSER('RPC Superuser', 4),
+    ROLE_REPORTING_USER('Reporting User', 4),
     ROLE_WORKER('Worker', 50),
 
     // Pharmacy roles
@@ -120,6 +121,7 @@ enum RoleType {
                 ROLE_FACILITY_STOREKEEPER,
                 ROLE_REGIONAL_WAREHOUSE,
                 ROLE_RPC_SUPERUSER,
+                ROLE_REPORTING_USER,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -170,6 +172,7 @@ enum RoleType {
                 ROLE_FACILITY_STOREKEEPER,
                 ROLE_REGIONAL_WAREHOUSE,
                 ROLE_RPC_SUPERUSER,
+                ROLE_REPORTING_USER,
                 ROLE_ASSISTANT,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
@@ -200,6 +203,7 @@ enum RoleType {
                 ROLE_FACILITY_STOREKEEPER,
                 ROLE_REGIONAL_WAREHOUSE,
                 ROLE_RPC_SUPERUSER,
+                ROLE_REPORTING_USER,
                 ROLE_MANAGER,
                 ROLE_ADMIN,
                 ROLE_SUPERUSER,

From c8d53669a33d19fb4eea4d37453b2e0053bbe73f Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Thu, 21 May 2026 09:57:06 -0300
Subject: [PATCH 05/10] fix(openspec): fix yaml indentation in openspec config

---
 openspec/config.yaml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/openspec/config.yaml b/openspec/config.yaml
index 6cbbe24b2df..c76c393d484 100644
--- a/openspec/config.yaml
+++ b/openspec/config.yaml
@@ -1,5 +1,5 @@
 # OpenSpec project configuration
-context:
+context: |
   Project: OpenBoxes (EyeSeeTea fork)
   What it is: |
     Open-source Logistics Management Information System (LMIS) for healthcare
@@ -35,12 +35,12 @@ context:
     openspec/            # change proposals and archive (this directory)
     .claude/             # Claude Code tooling (tracked except .context/)
 
-  Custom code isolation (CRITICAL):
+  Custom code isolation (CRITICAL): |
     - Backend: org.pih.warehouse.custom.<feature>/
     - Frontend: src/js/custom/<feature>/
     - Migrations: grails-app/migrations/custom/ (or clearly-prefixed)
-    Every custom file lives under one of these paths so "what's custom?" is a
-    file listing rather than a patch diff against upstream.
+      Every custom file lives under one of these paths so "what's custom?" is a
+      file listing rather than a patch diff against upstream.
 
   Configuration:
     - grails-app/conf/application.yml      # Grails config (upstream; prefer external overrides)
@@ -109,7 +109,7 @@ context:
       - Run with npm test
     Assertions are concrete values, not toBeDefined/toBeTruthy (team-wide rule).
 
-rules:
+rules: {}
   # The team-wide CLAUDE.md and auto-loaded path-scoped rules cover commit style,
   # functional style, test quality, Boy Scout, etc. This section is for project-specific
   # rules that deviate from or extend those defaults. See .claude/CLAUDE.md for the

From 3eb98c76d5b76bd29b476d7eb4550cdcff35144d Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Thu, 21 May 2026 09:57:49 -0300
Subject: [PATCH 06/10] docs(openspec): add custom roles specs

---
 .../2026-05-21-custom-roles/.openspec.yaml    |   2 +
 .../archive/2026-05-21-custom-roles/design.md |  79 +++++++++
 .../2026-05-21-custom-roles/proposal.md       |  27 +++
 .../specs/custom-roles-access/spec.md         | 152 +++++++++++++++++
 .../archive/2026-05-21-custom-roles/tasks.md  |  48 ++++++
 openspec/specs/custom-roles-access/spec.md    | 160 ++++++++++++++++++
 6 files changed, 468 insertions(+)
 create mode 100644 openspec/changes/archive/2026-05-21-custom-roles/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-05-21-custom-roles/design.md
 create mode 100644 openspec/changes/archive/2026-05-21-custom-roles/proposal.md
 create mode 100644 openspec/changes/archive/2026-05-21-custom-roles/specs/custom-roles-access/spec.md
 create mode 100644 openspec/changes/archive/2026-05-21-custom-roles/tasks.md
 create mode 100644 openspec/specs/custom-roles-access/spec.md

diff --git a/openspec/changes/archive/2026-05-21-custom-roles/.openspec.yaml b/openspec/changes/archive/2026-05-21-custom-roles/.openspec.yaml
new file mode 100644
index 00000000000..af43829ce6a
--- /dev/null
+++ b/openspec/changes/archive/2026-05-21-custom-roles/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-21
diff --git a/openspec/changes/archive/2026-05-21-custom-roles/design.md b/openspec/changes/archive/2026-05-21-custom-roles/design.md
new file mode 100644
index 00000000000..ff5e27930f5
--- /dev/null
+++ b/openspec/changes/archive/2026-05-21-custom-roles/design.md
@@ -0,0 +1,79 @@
+## Context
+
+OpenBoxes authorization is built around fixed `RoleType` values, seeded `Role` rows, location-scoped user roles, a core role hierarchy, runtime RBAC rules, controller/interceptor checks, menu filtering, and page-level permission checks. It does not provide a database-driven permission matrix that can create a new operational role by configuration alone.
+
+This change retroactively documents the implemented branch that adds four customer-specific operational roles: Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User. The roles need different access than the upstream hierarchy provides, so the implementation extends the fixed role model and applies explicit policies at the existing enforcement points.
+
+## Goals / Non-Goals
+
+**Goals:**
+- Add fixed custom role types and seed assignable role records.
+- Enforce the provided access matrix across backend guards and frontend/server-rendered UI.
+- Keep existing OpenBoxes roles and higher-role behavior unchanged.
+- Preserve current architecture and avoid broad upstream refactors.
+- Make direct URL/API access match menu and page-action visibility.
+
+**Non-Goals:**
+- Build a generic permission framework.
+- Make permissions admin-configurable per controller/action.
+- Replace `RoleInterceptor` or the existing RBAC rule configuration.
+- Convert every OpenBoxes screen to a new authorization abstraction.
+- Resolve unrelated authorization debt outside the modules named in the role matrix.
+
+## Decisions
+
+1. Represent custom roles as fixed `RoleType` values.
+
+   Rationale: OpenBoxes authorization already keys behavior off `RoleType`. Adding enum values, frontend constants, i18n labels, and seeded `Role` rows gives admins assignable roles without introducing a second authorization model.
+
+   Alternative considered: create new `Role` database rows using existing role types. This was rejected because a new row with `ROLE_MANAGER` or `ROLE_BROWSER` still authorizes like that existing role type and cannot express manager-minus-purchasing or read-only-reporting behavior.
+
+2. Enforce custom role policies through explicit predicates and allow/deny lists.
+
+   Rationale: The matrix cuts across module boundaries and does not map cleanly to the existing hierarchy. Explicit predicates in user/session authorization code keep the policy readable and avoid accidental access through broad manager-style checks.
+
+   Alternative considered: fold the roles into the core hierarchy. This was rejected because the custom roles are not strictly higher or lower than existing roles; each is a distinct operational mix.
+
+3. Apply policy at both presentation and backend layers.
+
+   Rationale: Menu and button hiding is necessary for usability but insufficient for security. Controller/API/interceptor guards must deny prohibited direct requests even when the UI does not expose the action.
+
+   Alternative considered: only hide menu entries and React/GSP actions. This was rejected because users could still reach controllers and APIs directly.
+
+4. Preserve higher-role behavior when mixed with custom roles.
+
+   Rationale: Existing OpenBoxes authorization expects higher core roles to satisfy lower requirements. When a user has Assistant, Manager, Admin, or Superuser access in the effective current-location roles, custom role restrictions should not unexpectedly reduce access.
+
+   Alternative considered: make custom restrictions always subtractive. This was rejected because it would create surprising regressions for users who carry a custom role plus a higher operational/admin role.
+
+5. Keep the change localized to known authorization surfaces.
+
+   Rationale: This is a customer-specific branch change. Touching upstream files is unavoidable because the current authorization architecture is not extension-only, but the implementation should stay limited to role definitions, migrations, user/session helpers, menu/action visibility, and selected controller/API guards.
+
+   Alternative considered: introduce a new custom authorization service wrapping all OpenBoxes checks. This was rejected as too large for the immediate requirement and risky for upstream maintenance.
+
+## Risks / Trade-offs
+
+- Custom roles assigned globally can broaden access across locations -> Administrators should prefer location-scoped assignment for operational roles, and future hardening can restrict these roles to location assignment if required.
+- Legacy `JsonController` action allow-lists are fragile -> Tests should cover stocklist JSON actions that custom roles need and deny unrelated JSON actions.
+- Product/configuration write scope for RPC Superuser is broad -> Product owners should validate whether all exposed product/configuration write actions are intended.
+- Authorization is distributed across several layers -> Regression coverage must include backend direct access and frontend/server-rendered visibility, not only menu checks.
+- Upstream files are touched -> Keep edits minimal and avoid incidental formatting so future upstream replays remain manageable.
+
+## Migration Plan
+
+1. Deploy code containing the new `RoleType` values, frontend constants, authorization predicates, menu/action filters, and controller/API guards.
+2. Run custom Liquibase migrations to insert the four `Role` records.
+3. Assign the new roles to users, preferably as location roles for operational access.
+4. Verify each role against the Dashboard, Inventory, Purchasing, Inbound, Outbound, Reporting, Products, and Stocklists matrix.
+
+Rollback strategy:
+- Remove or stop assigning the new custom roles to users before rolling back code.
+- Roll back the application to the prior branch revision.
+- If necessary, mark or remove the seeded custom `Role` rows after confirming no users still reference them.
+
+## Open Questions
+
+- Should custom operational roles be prevented from default/global assignment and allowed only as location roles?
+- Should stocklist item mutation endpoints be moved away from broad legacy JSON controller actions?
+- Should RPC Superuser have write access to every product/configuration resource exposed by the Products menu, or should specific product configuration areas be read-only?
diff --git a/openspec/changes/archive/2026-05-21-custom-roles/proposal.md b/openspec/changes/archive/2026-05-21-custom-roles/proposal.md
new file mode 100644
index 00000000000..031c12153c8
--- /dev/null
+++ b/openspec/changes/archive/2026-05-21-custom-roles/proposal.md
@@ -0,0 +1,27 @@
+## Why
+
+OpenBoxes needs customer-specific operational roles that match warehouse responsibilities more closely than the built-in hierarchical roles. The implemented branch adds four fixed custom role types and enforces their access matrix across menu visibility, page actions, controller guards, and API endpoints.
+
+## What Changes
+
+- Add `Facility Storekeeper`, `Regional Warehouse User`, `RPC Superuser`, and `Reporting User` as assignable custom role types.
+- Seed database `Role` records for the new role types through custom Liquibase migrations.
+- Enforce role-specific access for Dashboard, Inventory, Purchasing, Inbound, Outbound, Reporting, Products, and Stocklists.
+- Hide menus and page-level create/edit/delete actions that the current custom role cannot use.
+- Guard direct URL and API access so hidden actions cannot be reached by bypassing the UI.
+- Preserve the higher-role override model: Assistant, Manager, Admin, and Superuser retain their existing access when present with a custom role.
+- No generic permission framework or admin-configurable permission matrix is introduced.
+
+## Capabilities
+
+### New Capabilities
+- `custom-roles-access`: Fixed custom-role authorization policies for the four customer roles, including menu visibility, page action visibility, controller/API enforcement, seeded role records, and role constants.
+
+### Modified Capabilities
+- None.
+
+## Impact
+
+- Affected backend code includes `RoleType`, `User`, `UserService`, `RoleInterceptor`, selected controllers/APIs, `MegamenuService`, `LocationService`, `AuthTagLib`, runtime RBAC configuration, messages, and custom database migrations.
+- Affected frontend code includes role constants, session permission derivation, permission hooks, and list/header/table components for purchasing, products, stock movements, stocklists, and product suppliers.
+- The change is intentionally instance-specific and does not add new external dependencies or replace the existing OpenBoxes authorization architecture.
diff --git a/openspec/changes/archive/2026-05-21-custom-roles/specs/custom-roles-access/spec.md b/openspec/changes/archive/2026-05-21-custom-roles/specs/custom-roles-access/spec.md
new file mode 100644
index 00000000000..91cd7845c17
--- /dev/null
+++ b/openspec/changes/archive/2026-05-21-custom-roles/specs/custom-roles-access/spec.md
@@ -0,0 +1,152 @@
+## ADDED Requirements
+
+### Requirement: Custom operational roles SHALL be assignable role types
+The system SHALL define and seed assignable role records for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, and `ROLE_REPORTING_USER`. The backend `RoleType` enum and frontend role constants SHALL expose the same role identifiers.
+
+#### Scenario: Custom roles are available for assignment
+- **WHEN** an administrator opens user role assignment for a location
+- **THEN** the role options SHALL include Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User
+
+#### Scenario: Frontend and backend use matching role identifiers
+- **WHEN** the session payload includes one of the custom role identifiers
+- **THEN** frontend permission checks SHALL evaluate the same identifier used by backend authorization checks
+
+### Requirement: Facility Storekeeper SHALL follow the approved access matrix
+The system SHALL enforce the Facility Storekeeper policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | No access |
+| Inbound | Read/Write, except Create Inbound Movement is denied |
+| Outbound | No access |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | No access |
+
+#### Scenario: Facility Storekeeper cannot access purchasing
+- **WHEN** a Facility Storekeeper opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Facility Storekeeper cannot create inbound movements
+- **WHEN** a Facility Storekeeper opens the Inbound menu or calls an inbound-movement creation endpoint directly
+- **THEN** the Create Inbound Movement action SHALL be hidden
+- **AND** the direct creation request SHALL be denied
+
+#### Scenario: Facility Storekeeper cannot access outbound or stocklists
+- **WHEN** a Facility Storekeeper opens the menu or calls outbound or stocklist controllers/APIs directly
+- **THEN** Outbound and Stocklists menu entries SHALL be hidden
+- **AND** direct outbound and stocklist requests SHALL be denied
+
+#### Scenario: Facility Storekeeper can manage inventory
+- **WHEN** a Facility Storekeeper performs an inventory read or write action
+- **THEN** the action SHALL be allowed when the user is authorized for the current location
+
+### Requirement: Regional Warehouse User SHALL follow the approved access matrix
+The system SHALL enforce the Regional Warehouse User policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | No access |
+| Inbound | Read/Write, except Create Inbound Movement is denied |
+| Outbound | Read/Write |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | Read/Write |
+
+#### Scenario: Regional Warehouse User cannot access purchasing
+- **WHEN** a Regional Warehouse User opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Regional Warehouse User cannot create inbound movements
+- **WHEN** a Regional Warehouse User opens the Inbound menu or calls an inbound-movement creation endpoint directly
+- **THEN** the Create Inbound Movement action SHALL be hidden
+- **AND** the direct creation request SHALL be denied
+
+#### Scenario: Regional Warehouse User can manage outbound and stocklists
+- **WHEN** a Regional Warehouse User performs outbound or stocklist read/write actions
+- **THEN** the actions SHALL be allowed when the user is authorized for the current location
+
+#### Scenario: Regional Warehouse User has read-only product access
+- **WHEN** a Regional Warehouse User opens product pages or calls product read endpoints
+- **THEN** read access SHALL be allowed
+- **AND** product create, update, import, preference, and delete actions SHALL be hidden or denied
+
+### Requirement: RPC Superuser SHALL follow the approved access matrix
+The system SHALL enforce the RPC Superuser policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | Read/Write |
+| Inbound | Read/Write |
+| Outbound | Read/Write |
+| Reporting | Read |
+| Products | Read/Write |
+| Stocklists | Read/Write |
+
+#### Scenario: RPC Superuser can use operational write workflows
+- **WHEN** an RPC Superuser performs inventory, purchasing, inbound, outbound, product, or stocklist write actions
+- **THEN** the actions SHALL be allowed when the user is authorized for the current location
+
+#### Scenario: RPC Superuser has read-only dashboard access
+- **WHEN** an RPC Superuser calls dashboard state-changing actions
+- **THEN** the request SHALL be denied
+
+#### Scenario: RPC Superuser can see write actions for allowed modules
+- **WHEN** an RPC Superuser opens list pages for purchasing, products, stock movements, or stocklists
+- **THEN** create, edit, import, and related write actions SHALL be visible for modules where the role has Read/Write access
+
+### Requirement: Reporting User SHALL follow the approved access matrix
+The system SHALL enforce the Reporting User policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read |
+| Purchasing | No access |
+| Inbound | Read |
+| Outbound | Read |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | Read |
+
+#### Scenario: Reporting User cannot access purchasing
+- **WHEN** a Reporting User opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Reporting User cannot perform write actions
+- **WHEN** a Reporting User calls inventory, inbound, outbound, product, or stocklist create/update/delete/status-changing endpoints
+- **THEN** the request SHALL be denied
+
+#### Scenario: Reporting User can read operational data
+- **WHEN** a Reporting User opens dashboard, inventory, inbound, outbound, reporting, product, or stocklist read views
+- **THEN** the views SHALL be available when the user is authorized for the current location
+
+### Requirement: Custom role enforcement SHALL be applied consistently across UI and backend
+The system SHALL enforce custom role policy at menu visibility, page action visibility, server-rendered views, React views, controller interceptors, and API/controller endpoints. UI hiding SHALL improve usability but SHALL NOT be the only enforcement layer.
+
+#### Scenario: Hidden action is still denied by direct URL
+- **WHEN** a custom-role user calls a hidden action directly by URL or API
+- **THEN** the backend SHALL deny the request according to that role's policy
+
+#### Scenario: Allowed action remains visible and executable
+- **WHEN** a custom-role user opens a module with Read/Write access
+- **THEN** the allowed page actions SHALL be visible
+- **AND** the matching backend request SHALL be accepted
+
+#### Scenario: Higher core role takes precedence
+- **WHEN** a user has a custom role and also has Assistant, Manager, Admin, or Superuser access in the effective current-location roles
+- **THEN** the higher core role SHALL retain its existing authorization behavior
+- **AND** custom role restrictions SHALL NOT reduce that higher-role access
+
+#### Scenario: Unrelated existing roles are unchanged
+- **WHEN** a user has only pre-existing OpenBoxes roles
+- **THEN** authorization, menu visibility, and page actions SHALL behave as they did before this change
diff --git a/openspec/changes/archive/2026-05-21-custom-roles/tasks.md b/openspec/changes/archive/2026-05-21-custom-roles/tasks.md
new file mode 100644
index 00000000000..7f9f7239b5b
--- /dev/null
+++ b/openspec/changes/archive/2026-05-21-custom-roles/tasks.md
@@ -0,0 +1,48 @@
+## 1. Role Model and Seed Data
+
+- [x] 1.1 Add `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, and `ROLE_REPORTING_USER` to the backend `RoleType` enum.
+- [x] 1.2 Add matching role constants to the frontend role type constants.
+- [x] 1.3 Add localized display labels for the four custom role types.
+- [x] 1.4 Add custom Liquibase migrations that insert assignable `Role` rows for each custom role.
+- [x] 1.5 Register the custom migrations in the custom changelog.
+
+## 2. Authorization Predicates and Session State
+
+- [x] 2.1 Extend user/session authorization helpers to expose custom role membership for the current location.
+- [x] 2.2 Implement highest-core-role-wins behavior so Assistant, Manager, Admin, and Superuser access is not reduced by custom roles.
+- [x] 2.3 Add frontend session permission derivation for custom role policies.
+- [x] 2.4 Update reusable frontend permission hooks to evaluate custom roles consistently with backend policy.
+
+## 3. Backend Enforcement
+
+- [x] 3.1 Add RoleInterceptor allow/deny handling for Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User.
+- [x] 3.2 Deny direct purchasing and supplier access for Facility Storekeeper, Regional Warehouse User, and Reporting User.
+- [x] 3.3 Deny Create Inbound Movement routes for Facility Storekeeper and Regional Warehouse User.
+- [x] 3.4 Deny outbound and stocklist routes for Facility Storekeeper.
+- [x] 3.5 Deny write/status-changing inventory, inbound, outbound, product, and stocklist routes for Reporting User.
+- [x] 3.6 Allow RPC Superuser read/write access across inventory, purchasing, inbound, outbound, products, and stocklists while preserving read-only Dashboard behavior.
+- [x] 3.7 Update selected controllers/APIs whose direct checks need explicit custom-role handling.
+
+## 4. Menu and Server-Rendered UI
+
+- [x] 4.1 Filter megamenu sections and links according to the role matrix.
+- [x] 4.2 Hide Purchasing for Facility Storekeeper, Regional Warehouse User, and Reporting User.
+- [x] 4.3 Hide Create Inbound Movement for Facility Storekeeper and Regional Warehouse User.
+- [x] 4.4 Hide Outbound and Stocklists for Facility Storekeeper.
+- [x] 4.5 Update GSP/taglib action visibility for order and stocklist pages.
+
+## 5. React UI Enforcement
+
+- [x] 5.1 Hide purchasing create/edit/delete actions for roles without Purchasing access.
+- [x] 5.2 Hide product write/import/configuration actions for read-only product roles.
+- [x] 5.3 Hide inbound, outbound, and stock movement write actions according to each role policy.
+- [x] 5.4 Hide or show stocklist create/edit/delete actions according to each role policy.
+- [x] 5.5 Keep RPC Superuser write actions visible for modules where the matrix grants Read/Write access.
+- [x] 5.6 Keep Reporting User views read-only across inventory, inbound, outbound, products, and stocklists.
+
+## 6. Validation
+
+- [x] 6.1 Verify each role against the Dashboard, Inventory, Purchasing, Inbound, Outbound, Reporting, Products, and Stocklists matrix.
+- [x] 6.2 Verify prohibited direct URL/API requests are denied even when UI actions are hidden.
+- [x] 6.3 Verify users with only existing OpenBoxes roles retain previous behavior.
+- [x] 6.4 Verify mixed custom role plus higher core role follows existing higher-role authorization behavior.
diff --git a/openspec/specs/custom-roles-access/spec.md b/openspec/specs/custom-roles-access/spec.md
new file mode 100644
index 00000000000..97720e37f2e
--- /dev/null
+++ b/openspec/specs/custom-roles-access/spec.md
@@ -0,0 +1,160 @@
+# custom-roles-access
+
+> Capability: fixed custom-role authorization policies for the four customer roles,
+> including menu visibility, page action visibility, controller/API enforcement,
+> seeded role records, and role constants.
+>
+> Source change: `openspec/changes/archive/2026-05-21-custom-roles/`
+
+## Requirements
+
+### Requirement: Custom operational roles SHALL be assignable role types
+The system SHALL define and seed assignable role records for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, and `ROLE_REPORTING_USER`. The backend `RoleType` enum and frontend role constants SHALL expose the same role identifiers.
+
+#### Scenario: Custom roles are available for assignment
+- **WHEN** an administrator opens user role assignment for a location
+- **THEN** the role options SHALL include Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User
+
+#### Scenario: Frontend and backend use matching role identifiers
+- **WHEN** the session payload includes one of the custom role identifiers
+- **THEN** frontend permission checks SHALL evaluate the same identifier used by backend authorization checks
+
+### Requirement: Facility Storekeeper SHALL follow the approved access matrix
+The system SHALL enforce the Facility Storekeeper policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | No access |
+| Inbound | Read/Write, except Create Inbound Movement is denied |
+| Outbound | No access |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | No access |
+
+#### Scenario: Facility Storekeeper cannot access purchasing
+- **WHEN** a Facility Storekeeper opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Facility Storekeeper cannot create inbound movements
+- **WHEN** a Facility Storekeeper opens the Inbound menu or calls an inbound-movement creation endpoint directly
+- **THEN** the Create Inbound Movement action SHALL be hidden
+- **AND** the direct creation request SHALL be denied
+
+#### Scenario: Facility Storekeeper cannot access outbound or stocklists
+- **WHEN** a Facility Storekeeper opens the menu or calls outbound or stocklist controllers/APIs directly
+- **THEN** Outbound and Stocklists menu entries SHALL be hidden
+- **AND** direct outbound and stocklist requests SHALL be denied
+
+#### Scenario: Facility Storekeeper can manage inventory
+- **WHEN** a Facility Storekeeper performs an inventory read or write action
+- **THEN** the action SHALL be allowed when the user is authorized for the current location
+
+### Requirement: Regional Warehouse User SHALL follow the approved access matrix
+The system SHALL enforce the Regional Warehouse User policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | No access |
+| Inbound | Read/Write, except Create Inbound Movement is denied |
+| Outbound | Read/Write |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | Read/Write |
+
+#### Scenario: Regional Warehouse User cannot access purchasing
+- **WHEN** a Regional Warehouse User opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Regional Warehouse User cannot create inbound movements
+- **WHEN** a Regional Warehouse User opens the Inbound menu or calls an inbound-movement creation endpoint directly
+- **THEN** the Create Inbound Movement action SHALL be hidden
+- **AND** the direct creation request SHALL be denied
+
+#### Scenario: Regional Warehouse User can manage outbound and stocklists
+- **WHEN** a Regional Warehouse User performs outbound or stocklist read/write actions
+- **THEN** the actions SHALL be allowed when the user is authorized for the current location
+
+#### Scenario: Regional Warehouse User has read-only product access
+- **WHEN** a Regional Warehouse User opens product pages or calls product read endpoints
+- **THEN** read access SHALL be allowed
+- **AND** product create, update, import, preference, and delete actions SHALL be hidden or denied
+
+### Requirement: RPC Superuser SHALL follow the approved access matrix
+The system SHALL enforce the RPC Superuser policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | Read/Write |
+| Inbound | Read/Write |
+| Outbound | Read/Write |
+| Reporting | Read |
+| Products | Read/Write |
+| Stocklists | Read/Write |
+
+#### Scenario: RPC Superuser can use operational write workflows
+- **WHEN** an RPC Superuser performs inventory, purchasing, inbound, outbound, product, or stocklist write actions
+- **THEN** the actions SHALL be allowed when the user is authorized for the current location
+
+#### Scenario: RPC Superuser has read-only dashboard access
+- **WHEN** an RPC Superuser calls dashboard state-changing actions
+- **THEN** the request SHALL be denied
+
+#### Scenario: RPC Superuser can see write actions for allowed modules
+- **WHEN** an RPC Superuser opens list pages for purchasing, products, stock movements, or stocklists
+- **THEN** create, edit, import, and related write actions SHALL be visible for modules where the role has Read/Write access
+
+### Requirement: Reporting User SHALL follow the approved access matrix
+The system SHALL enforce the Reporting User policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read |
+| Purchasing | No access |
+| Inbound | Read |
+| Outbound | Read |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | Read |
+
+#### Scenario: Reporting User cannot access purchasing
+- **WHEN** a Reporting User opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Reporting User cannot perform write actions
+- **WHEN** a Reporting User calls inventory, inbound, outbound, product, or stocklist create/update/delete/status-changing endpoints
+- **THEN** the request SHALL be denied
+
+#### Scenario: Reporting User can read operational data
+- **WHEN** a Reporting User opens dashboard, inventory, inbound, outbound, reporting, product, or stocklist read views
+- **THEN** the views SHALL be available when the user is authorized for the current location
+
+### Requirement: Custom role enforcement SHALL be applied consistently across UI and backend
+The system SHALL enforce custom role policy at menu visibility, page action visibility, server-rendered views, React views, controller interceptors, and API/controller endpoints. UI hiding SHALL improve usability but SHALL NOT be the only enforcement layer.
+
+#### Scenario: Hidden action is still denied by direct URL
+- **WHEN** a custom-role user calls a hidden action directly by URL or API
+- **THEN** the backend SHALL deny the request according to that role's policy
+
+#### Scenario: Allowed action remains visible and executable
+- **WHEN** a custom-role user opens a module with Read/Write access
+- **THEN** the allowed page actions SHALL be visible
+- **AND** the matching backend request SHALL be accepted
+
+#### Scenario: Higher core role takes precedence
+- **WHEN** a user has a custom role and also has Assistant, Manager, Admin, or Superuser access in the effective current-location roles
+- **THEN** the higher core role SHALL retain its existing authorization behavior
+- **AND** custom role restrictions SHALL NOT reduce that higher-role access
+
+#### Scenario: Unrelated existing roles are unchanged
+- **WHEN** a user has only pre-existing OpenBoxes roles
+- **THEN** authorization, menu visibility, and page actions SHALL behave as they did before this change

From 48ab03d01ff2c30b1eb4d6663d27fc7951afa377 Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Fri, 22 May 2026 12:11:53 -0300
Subject: [PATCH 07/10] feat(custom-roles): isolate role policy and archive
 spec change

- centralize custom role authorization in CustomRolePolicyService

- align backend/frontend visibility and route enforcement for custom roles

- fix detached-session lazy role access in role-policy/user-role checks

- archive openspec change custom-roles-refactor and sync main specs
---
 .../org/pih/warehouse/RoleInterceptor.groovy  | 395 +----------
 .../pih/warehouse/api/ApiController.groovy    |  25 +-
 grails-app/migrations/custom/changelog.groovy |  10 +-
 .../pih/warehouse/api/MegamenuService.groovy  | 134 +---
 .../org/pih/warehouse/core/UserService.groovy |  78 +--
 .../roles/CustomRolePolicyService.groovy      | 614 ++++++++++++++++++
 .../org/pih/warehouse/AuthTagLib.groovy       |  26 +-
 grails-app/views/order/list.gsp               |  14 +-
 .../views/requisitionTemplate/_summary.gsp    |  12 +-
 grails-app/views/stockMovement/list.gsp       |  32 +-
 .../.openspec.yaml                            |   2 +
 .../design.md                                 |  73 +++
 .../implementation-notes.md                   | 100 +++
 .../proposal.md                               |  29 +
 .../custom-role-policy-isolation/spec.md      |  41 ++
 .../specs/custom-roles-access/spec.md         | 121 ++++
 .../2026-05-22-custom-roles-refactor/tasks.md |  52 ++
 .../custom-role-policy-isolation/spec.md      |  45 ++
 openspec/specs/custom-roles-access/spec.md    |  22 +-
 .../productSupplier/ProductSupplierHeader.jsx |   6 +-
 .../ProductSupplierListTable.jsx              |   8 +-
 .../modals/PreferenceTypeModal.jsx            |   6 +-
 .../products/ProductsListHeader.jsx           |  65 +-
 .../purchaseOrder/PurchaseOrderListHeader.jsx |  59 +-
 .../purchaseOrder/PurchaseOrderListTable.jsx  |  36 +-
 .../StocklistManagement.jsx                   |  19 +-
 .../components/stock-list/StockListHeader.jsx |  48 +-
 .../components/stock-list/StockListTable.jsx  |  28 +-
 .../inbound/StockMovementInboundHeader.jsx    |  85 +--
 .../inbound/StockMovementInboundList.jsx      |  12 +-
 .../outbound/StockMovementOutboundHeader.jsx  |  87 +--
 .../outbound/StockMovementOutboundList.jsx    |  11 +-
 src/js/custom/roles/customRolePermissions.js  |  36 +
 .../useProductSupplierActions.jsx             |   6 +-
 src/js/reducers/sessionReducer.jsx            |   3 +
 .../roles/customRolePermissions.test.js       |  42 ++
 .../StockMovementInboundHeader.test.jsx       |  60 ++
 .../StockMovementOutboundHeader.test.jsx      |  42 ++
 .../AuthTagLibCustomRolesSpec.groovy          |  46 ++
 .../roles/CustomRolePolicyServiceSpec.groovy  | 208 ++++++
 40 files changed, 1919 insertions(+), 819 deletions(-)
 create mode 100644 grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
 create mode 100644 openspec/changes/archive/2026-05-22-custom-roles-refactor/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-05-22-custom-roles-refactor/design.md
 create mode 100644 openspec/changes/archive/2026-05-22-custom-roles-refactor/implementation-notes.md
 create mode 100644 openspec/changes/archive/2026-05-22-custom-roles-refactor/proposal.md
 create mode 100644 openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-role-policy-isolation/spec.md
 create mode 100644 openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-roles-access/spec.md
 create mode 100644 openspec/changes/archive/2026-05-22-custom-roles-refactor/tasks.md
 create mode 100644 openspec/specs/custom-role-policy-isolation/spec.md
 create mode 100644 src/js/custom/roles/customRolePermissions.js
 create mode 100644 src/js/tests/custom/roles/customRolePermissions.test.js
 create mode 100644 src/js/tests/stock-movement/StockMovementInboundHeader.test.jsx
 create mode 100644 src/js/tests/stock-movement/StockMovementOutboundHeader.test.jsx
 create mode 100644 src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
 create mode 100644 src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy

diff --git a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
index 034b4374a21..604bc00a3f9 100644
--- a/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
+++ b/grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
@@ -13,6 +13,7 @@ import org.pih.warehouse.core.RoleType
  * */
 class RoleInterceptor {
     def userService
+    def customRolePolicyService
 
     // this interceptor depends on SecurityInterceptor
     int order = LOWEST_PRECEDENCE
@@ -68,102 +69,6 @@ class RoleInterceptor {
         'jobs'                      : ['*']
     ]
 
-    def static facilityStorekeeperActions = [
-        'inventory'    : ['createInboundTransfer', 'createConsumed', 'editTransaction', 'deleteTransaction', 'saveTransaction'],
-        'inventoryItem': ['showRecordInventory', 'adjustStock', 'transferStock'],
-        'stockTransfer': ['create', 'edit', 'createInboundReturn'],
-        'stockTransferApi': ['list', 'read', 'create', 'update', 'stockTransferCandidates', 'returnCandidates']
-    ]
-    def static regionalWarehouseActions = [
-        'inventory'        : ['createInboundTransfer', 'createConsumed', 'editTransaction', 'deleteTransaction', 'saveTransaction'],
-        'inventoryItem'    : ['showRecordInventory', 'adjustStock', 'transferStock'],
-        'stockTransfer'    : ['create', 'edit', 'createInboundReturn', 'createOutboundReturn'],
-        'stockTransferApi' : ['list', 'read', 'create', 'update', 'stockTransferCandidates', 'returnCandidates'],
-        'stockMovement'    : ['createOutbound', 'importOutboundStockMovement', 'verifyRequest'],
-        'stockMovementApi' : ['list', 'create'],
-        'stocklistApi'     : ['list', 'read', 'create', 'update', 'delete', 'sendMail', 'clear', 'clone', 'publish', 'unpublish', 'export'],
-        'stocklistItemApi' : ['list', 'read', 'create', 'update', 'remove', 'availableStocklists'],
-        'requisitionTemplate': [
-                'create',
-                'save',
-                'edit',
-                'editHeader',
-                'update',
-                'delete',
-                'clear',
-                'clone',
-                'publish',
-                'unpublish',
-                'export',
-                'batch',
-                'importData',
-                'doImport',
-                'sendMail',
-                'addToRequisitionItems',
-                'removeFromRequisitionItems',
-                'changeSortOrderAlpha',
-                'changeSortOrderChrono',
-        ],
-        'json'               : ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems']
-    ]
-    def static rpcSuperuserActions = [
-        'inventory'          : ['*'],
-        'inventoryItem'      : ['*'],
-        'stockTransfer'      : ['*'],
-        'stockTransferApi'   : ['*'],
-        'stockMovement'      : ['*'],
-        'stockMovementApi'   : ['*'],
-        'stocklist'          : ['*'],
-        'stocklistApi'       : ['*'],
-        'stocklistItemApi'   : ['*'],
-        'stocklistManagement': ['*'],
-        'requisitionTemplate': ['*'],
-        'json'               : ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems'],
-        'purchaseOrder'      : ['*'],
-        'purchaseOrderApi'   : ['*'],
-        'supplier'           : ['*'],
-        'product'            : ['*'],
-        'productApi'         : ['*'],
-        'productType'        : ['*'],
-        'category'           : ['*'],
-        'categoryApi'        : ['*'],
-        'productCatalog'     : ['*'],
-        'tag'                : ['*'],
-        'attribute'          : ['*'],
-        'attributeApi'       : ['*'],
-        'productAssociation' : ['*'],
-        'productSupplier'    : ['*'],
-        'productSupplierApi' : ['*'],
-        'productSupplierPreferenceApi': ['*'],
-        'productSupplierAttributeApi': ['*'],
-        'productPackage'     : ['*'],
-        'productPackageApi'  : ['*'],
-        'productComponent'   : ['*'],
-        'productGroup'       : ['*'],
-        'unitOfMeasure'      : ['*'],
-        'unitOfMeasureApi'   : ['*'],
-        'unitOfMeasureClass' : ['*'],
-        'unitOfMeasureConversion': ['*'],
-        'productsConfiguration': ['*'],
-        'productsConfigurationApi': ['*'],
-    ]
-    def static reportingUserActions = [
-        'api'                 : ['getAppContext', 'getRequestTypes', 'getMenuConfig'],
-        'dashboard'           : ['megamenu'],
-        'grails'              : ['errors'],
-        'localizationApi'     : ['list'],
-        'locationApi'         : ['list'],
-        'productApi'          : ['list', 'productDemand', 'productAvailabilityAndDemand'],
-        'requisitionTemplate' : ['list', 'show'],
-        'stocklistApi'        : ['list', 'read'],
-        'stocklistItemApi'    : ['list', 'read', 'availableStocklists'],
-        'stockMovement'       : ['list'],
-        'stockMovementApi'    : ['read', 'list'],
-        'stockMovementItemApi': ['getStockMovementItems'],
-        'stockTransferApi'    : ['list', 'read', 'stockTransferCandidates', 'returnCandidates'],
-        'stockTransfer'       : ['list'],
-    ]
-
     def static invoiceActions = [
         'invoice': ['*']
     ]
@@ -201,38 +106,23 @@ class RoleInterceptor {
     }
 
     boolean before() {
-        // Apply custom location-scoped role policy only after a warehouse context exists.
-        Boolean hasWarehouseContext = session?.warehouse?.id
-        Boolean hasRpcSuperuserPolicy = hasWarehouseContext &&
-                userService.hasRpcSuperuserPolicy(session.user, session?.warehouse?.id)
-        Boolean hasRegionalWarehousePolicy = hasWarehouseContext &&
-                !hasRpcSuperuserPolicy &&
-                userService.hasRegionalWarehousePolicy(session.user, session?.warehouse?.id)
-        Boolean hasReportingUserPolicy = hasWarehouseContext &&
-                !hasRpcSuperuserPolicy &&
-                !hasRegionalWarehousePolicy &&
-                userService.hasReportingUserPolicy(session.user, session?.warehouse?.id)
-        Boolean hasFacilityStorekeeperPolicy = hasWarehouseContext &&
-                !hasRpcSuperuserPolicy &&
-                !hasRegionalWarehousePolicy &&
-                !hasReportingUserPolicy &&
-                userService.hasFacilityStorekeeperPolicy(session.user, session?.warehouse?.id)
-        Boolean isRpcSuperuserAllowedAction = hasRpcSuperuserPolicy && needRpcSuperuser(controllerName, actionName, params, request)
-        Boolean isRpcSuperuserRestrictedAction = hasRpcSuperuserPolicy && needRpcSuperuserDeniedAction(controllerName, actionName, params, request)
-        Boolean isStorekeeperAllowedAction = hasFacilityStorekeeperPolicy && needFacilityStorekeeper(controllerName, actionName, params, request)
-        Boolean isStorekeeperRestrictedAction = hasFacilityStorekeeperPolicy && needStorekeeperDeniedAction(controllerName, actionName, params, request)
-        Boolean isRegionalWarehouseAllowedAction = hasRegionalWarehousePolicy && needRegionalWarehouse(controllerName, actionName, params, request)
-        Boolean isRegionalWarehouseRestrictedAction = hasRegionalWarehousePolicy && needRegionalWarehouseDeniedAction(controllerName, actionName, params, request)
-        Boolean isReportingUserAllowedAction = hasReportingUserPolicy && needReportingUser(controllerName, actionName, params, request)
-        Boolean isReportingUserRestrictedAction = hasReportingUserPolicy && needReportingUserDeniedAction(controllerName, actionName, params, request)
-
-        if (isRpcSuperuserRestrictedAction || isStorekeeperRestrictedAction || isRegionalWarehouseRestrictedAction || isReportingUserRestrictedAction) {
-            log.info("User ${session?.user?.username} does not have access to ${controllerName}/${actionName} in location ${session?.warehouse?.name}")
-            redirect(controller: "errors", action: "handleForbidden")
-            return false
-        }
-        if (isRpcSuperuserAllowedAction || isStorekeeperAllowedAction || isRegionalWarehouseAllowedAction || isReportingUserAllowedAction) {
-            return true
+        if (session?.warehouse?.id) {
+            Map customRoleAccess = customRolePolicyService.evaluateRouteAccess(
+                    session?.user,
+                    session?.warehouse?.id,
+                    controllerName,
+                    actionName,
+                    params,
+                    request
+            )
+            if (customRoleAccess.denied) {
+                log.info("User ${session?.user?.username} does not have access to ${controllerName}/${actionName} in location ${session?.warehouse?.name}")
+                redirect(controller: "errors", action: "handleForbidden")
+                return false
+            }
+            if (customRoleAccess.allowed) {
+                return true
+            }
         }
 
         def rules = grailsApplication.config.openboxes.security.rbac.rules
@@ -333,253 +223,4 @@ class RoleInterceptor {
         authenticatedActions[controllerName]?.contains(actionName)
     }
 
-    static Boolean needFacilityStorekeeper(controllerName, actionName, params = null, request = null) {
-        if (needStorekeeperDeniedAction(controllerName, actionName, params, request)) {
-            return false
-        }
-        return facilityStorekeeperActions[controllerName]?.contains("*") ||
-            facilityStorekeeperActions[controllerName]?.contains(actionName)
-    }
-
-    static Boolean needStorekeeperDeniedAction(controllerName, actionName, params, request = null) {
-        // Purchasing: no access
-        if (controllerName in ['purchaseOrder', 'purchaseOrderApi']) {
-            return true
-        }
-        if (controllerName == 'supplier') {
-            return true
-        }
-
-        // Outbound: no access
-        if (controllerName == 'stockMovement') {
-            if (actionName in ['createOutbound', 'importOutboundStockMovement', 'verifyRequest']) {
-                return true
-            }
-            if (actionName == 'list' && params.direction?.toUpperCase() == "OUTBOUND") {
-                return true
-            }
-        }
-        if (controllerName == 'stockMovementApi') {
-            String direction = params.direction ?: request?.JSON?.direction
-            if (actionName == 'list' && direction?.toUpperCase() == "OUTBOUND") {
-                return true
-            }
-            if (actionName == 'create' && direction?.toUpperCase() == "OUTBOUND") {
-                return true
-            }
-        }
-        if (controllerName == 'stockTransfer' && actionName == 'createOutboundReturn') {
-            return true
-        }
-
-        // Stocklists: no access
-        if (controllerName in ['requisitionTemplate', 'stocklist', 'stocklistApi', 'stocklistItemApi', 'stocklistManagement']) {
-            return true
-        }
-
-        // Products: read-only
-        if (controllerName == 'product' && actionName in [
-            'batchEdit',
-            'batchEditProperties',
-            'create',
-            'save',
-            'edit',
-            'update',
-            'delete',
-            'deleteProducts',
-            'importAsCsv',
-            'savePackage',
-            'deleteDocument',
-            'deleteProductComponent',
-            'deleteProductGroup',
-            'editProductSynonym',
-            'editProductSynonymDialog',
-            'deleteSynonym',
-        ]) {
-            return true
-        }
-        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete', 'importCsv']) {
-            return true
-        }
-
-        // Inbound: no access to "Create Inbound Movement" only
-        if (controllerName == 'stockMovement' && actionName == 'createInbound') {
-            return !params.id
-        }
-        if (controllerName == 'stockMovementApi' && actionName == 'create') {
-            String direction = params.direction ?: request?.JSON?.direction
-            return direction?.toUpperCase() == "INBOUND"
-        }
-
-        // Legacy inbound shipment creation should remain blocked for storekeeper
-        if (controllerName == 'createShipmentWorkflow' && actionName == 'createShipment') {
-            return !params.id && params.type?.toUpperCase() == "INCOMING"
-        }
-
-        return false
-    }
-
-    static Boolean needRegionalWarehouse(controllerName, actionName, params = null, request = null) {
-        if (needRegionalWarehouseDeniedAction(controllerName, actionName, params, request)) {
-            return false
-        }
-        return regionalWarehouseActions[controllerName]?.contains("*") ||
-                regionalWarehouseActions[controllerName]?.contains(actionName)
-    }
-
-    static Boolean needRegionalWarehouseDeniedAction(controllerName, actionName, params, request = null) {
-        // Purchasing: no access (including suppliers)
-        if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
-            return true
-        }
-        if (controllerName == 'dashboard' && actionName == 'supplier') {
-            return true
-        }
-
-        // Inbound: no access to "Create Inbound Movement" only
-        if (controllerName == 'stockMovement' && actionName == 'createInbound') {
-            return !params.id
-        }
-        if (controllerName == 'stockMovementApi' && actionName == 'create') {
-            String direction = params.direction ?: request?.JSON?.direction
-            return direction?.toUpperCase() == "INBOUND"
-        }
-        if (controllerName == 'createShipmentWorkflow' && actionName == 'createShipment') {
-            return !params.id && params.type?.toUpperCase() == "INCOMING"
-        }
-
-        // Products: read-only
-        if (controllerName == 'product' && actionName in [
-                'batchEdit',
-                'batchEditProperties',
-                'create',
-                'save',
-                'edit',
-                'update',
-                'delete',
-                'deleteProducts',
-                'importAsCsv',
-                'savePackage',
-                'deleteDocument',
-                'deleteProductComponent',
-                'deleteProductGroup',
-                'editProductSynonym',
-                'editProductSynonymDialog',
-                'deleteSynonym',
-        ]) {
-            return true
-        }
-        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete']) {
-            return true
-        }
-
-        return false
-    }
-
-    static Boolean needRpcSuperuser(controllerName, actionName, params = null, request = null) {
-        if (needRpcSuperuserDeniedAction(controllerName, actionName, params, request)) {
-            return false
-        }
-        return rpcSuperuserActions[controllerName]?.contains("*") ||
-                rpcSuperuserActions[controllerName]?.contains(actionName)
-    }
-
-    static Boolean needRpcSuperuserDeniedAction(controllerName, actionName, params, request = null) {
-        if (controllerName == 'dashboard' && actionName in ['hideTag', 'hideCatalog', 'flushCache']) {
-            return true
-        }
-        return false
-    }
-
-    static Boolean needReportingUser(controllerName, actionName, params = null, request = null) {
-        if (needReportingUserDeniedAction(controllerName, actionName, params, request)) {
-            return false
-        }
-        return reportingUserActions[controllerName]?.contains("*") ||
-                reportingUserActions[controllerName]?.contains(actionName)
-    }
-
-    static Boolean needReportingUserDeniedAction(controllerName, actionName, params, request = null) {
-        if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
-            return true
-        }
-        if (controllerName == 'dashboard' && actionName == 'supplier') {
-            return true
-        }
-
-        if (controllerName in ['inventory', 'inventoryItem', 'stockTransfer', 'stockTransferApi', 'stockMovement', 'stockMovementApi', 'stockMovementItemApi', 'stocklist', 'stocklistApi', 'stocklistItemApi', 'stocklistManagement', 'requisitionTemplate', 'json']) {
-            if (needManager(controllerName, actionName)) {
-                return true
-            }
-        }
-
-        if (controllerName == 'stockMovement' && actionName in ['createInbound', 'createOutbound', 'importOutboundStockMovement', 'verifyRequest', 'createRequest']) {
-            return true
-        }
-        if (controllerName == 'stockMovementApi' && actionName in ['create', 'update', 'updateStatus', 'delete']) {
-            return true
-        }
-
-        if (controllerName == 'stocklistApi' && actionName in ['create', 'update', 'delete', 'sendMail', 'clear', 'clone', 'publish', 'unpublish', 'export']) {
-            return true
-        }
-        if (controllerName == 'stocklistItemApi' && actionName in ['create', 'update', 'remove']) {
-            return true
-        }
-        if (controllerName == 'requisitionTemplate' && actionName in [
-                'create',
-                'save',
-                'edit',
-                'editHeader',
-                'update',
-                'delete',
-                'clear',
-                'clone',
-                'publish',
-                'unpublish',
-                'export',
-                'batch',
-                'importData',
-                'doImport',
-                'sendMail',
-                'addToRequisitionItems',
-                'removeFromRequisitionItems',
-                'changeSortOrderAlpha',
-                'changeSortOrderChrono',
-        ]) {
-            return true
-        }
-        if (controllerName == 'stocklistManagement') {
-            return true
-        }
-        if (controllerName == 'json' && actionName in ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems']) {
-            return true
-        }
-
-        if (controllerName == 'product' && actionName in [
-                'batchEdit',
-                'batchEditProperties',
-                'create',
-                'save',
-                'edit',
-                'update',
-                'delete',
-                'deleteProducts',
-                'importAsCsv',
-                'savePackage',
-                'deleteDocument',
-                'deleteProductComponent',
-                'deleteProductGroup',
-                'editProductSynonym',
-                'editProductSynonymDialog',
-                'deleteSynonym',
-        ]) {
-            return true
-        }
-        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete', 'importCsv']) {
-            return true
-        }
-
-        return false
-    }
 }
diff --git a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
index bfe99af65e2..e6d75928ff8 100644
--- a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
@@ -31,6 +31,7 @@ import java.text.SimpleDateFormat
 class ApiController {
 
     def userService
+    def customRolePolicyService
     def helpScoutService
     def localizationService
     GrailsApplication grailsApplication
@@ -91,9 +92,10 @@ class ApiController {
         Map menuSectionsUrlParts = grailsApplication.config.openboxes.menuSectionsUrlParts
         User user = User.get(session?.user?.id)
 
-        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(user, session?.warehouse?.id)
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, session?.warehouse?.id)
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(user, session?.warehouse?.id)
+        Map<String, Boolean> customRolePolicyFlags = customRolePolicyService.getPolicyFlags(user, session?.warehouse?.id)
+        boolean hasFacilityStorekeeperPolicy = customRolePolicyFlags.hasFacilityStorekeeperPolicy
+        boolean hasRegionalWarehousePolicy = customRolePolicyFlags.hasRegionalWarehousePolicy
+        boolean hasRpcSuperuserPolicy = customRolePolicyFlags.hasRpcSuperuserPolicy
         if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
                 !hasFacilityStorekeeperPolicy &&
                 !hasRegionalWarehousePolicy &&
@@ -168,16 +170,12 @@ class ApiController {
         // TODO: investigate why in isUserManager method in userService there is Assistant role included
         ArrayList<RoleType> managerRoles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_MANAGER]
         boolean isUserManager = userService.getEffectiveRoles(user).any { managerRoles.contains(it.roleType) }
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session.warehouse?.id)
-        boolean hasRegionalWarehousePolicy = !hasRpcSuperuserPolicy &&
-                userService.hasRegionalWarehousePolicy(session?.user, session.warehouse?.id)
-        boolean hasReportingUserPolicy = !hasRpcSuperuserPolicy &&
-                !hasRegionalWarehousePolicy &&
-                userService.hasReportingUserPolicy(session?.user, session.warehouse?.id)
-        boolean hasFacilityStorekeeperPolicy = !hasRpcSuperuserPolicy &&
-                !hasRegionalWarehousePolicy &&
-                !hasReportingUserPolicy &&
-                userService.hasFacilityStorekeeperPolicy(session?.user, session.warehouse?.id)
+        Map<String, Boolean> customRolePolicyFlags = customRolePolicyService.getPolicyFlags(session?.user, session.warehouse?.id)
+        boolean hasFacilityStorekeeperPolicy = customRolePolicyFlags.hasFacilityStorekeeperPolicy
+        boolean hasRegionalWarehousePolicy = customRolePolicyFlags.hasRegionalWarehousePolicy
+        boolean hasRpcSuperuserPolicy = customRolePolicyFlags.hasRpcSuperuserPolicy
+        boolean hasReportingUserPolicy = customRolePolicyFlags.hasReportingUserPolicy
+        Map<String, Object> customRolePermissions = customRolePolicyService.getCustomRolePermissions(session?.user, session.warehouse?.id)
         def supportedActivities = location.supportedActivities ?: location.locationType.supportedActivities
         boolean isImpersonated = session.impersonateUserId ? true : false
         def buildNumber = gitProperties.shortCommitId
@@ -227,6 +225,7 @@ class ApiController {
                 hasRegionalWarehousePolicy    : hasRegionalWarehousePolicy,
                 hasRpcSuperuserPolicy         : hasRpcSuperuserPolicy,
                 hasReportingUserPolicy        : hasReportingUserPolicy,
+                customRolePermissions         : customRolePermissions,
                 supportedActivities           : supportedActivities,
                 isImpersonated                : isImpersonated,
                 grailsVersion                 : grailsVersion,
diff --git a/grails-app/migrations/custom/changelog.groovy b/grails-app/migrations/custom/changelog.groovy
index c295323414b..039db6a294c 100644
--- a/grails-app/migrations/custom/changelog.groovy
+++ b/grails-app/migrations/custom/changelog.groovy
@@ -6,14 +6,14 @@
  *
  *   1. Drop a file under grails-app/migrations/custom/<yyyy-mm-dd>-<feature>.groovy
  *      with a `databaseChangeLog = { changeSet(...) { ... rollback { ... } } }` block.
- *   2. Append a one-line `include file: '<yyyy-mm-dd>-<feature>.groovy'` below.
+ *   2. Append a one-line `include file: 'custom/<yyyy-mm-dd>-<feature>.groovy'` below.
  *
  * Order include lines by FK dependency (target tables above holder tables).
  * See .claude/rules/custom-package-isolation.md for the full rules.
  */
 databaseChangeLog = {
-    include file: '2026-05-15-add-facility-storekeeper-role.groovy'
-    include file: '2026-05-19-add-regional-warehouse-role.groovy'
-    include file: '2026-05-20-add-rpc-superuser-role.groovy'
-    include file: '2026-05-20-add-reporting-user-role.groovy'
+    include file: 'custom/2026-05-15-add-facility-storekeeper-role.groovy'
+    include file: 'custom/2026-05-19-add-regional-warehouse-role.groovy'
+    include file: 'custom/2026-05-20-add-rpc-superuser-role.groovy'
+    include file: 'custom/2026-05-20-add-reporting-user-role.groovy'
 }
diff --git a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
index 162f28dbdd6..d45bf30e873 100644
--- a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
+++ b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
@@ -18,52 +18,16 @@ import org.pih.warehouse.core.User
 class MegamenuService {
 
     def userService
+    def customRolePolicyService
     GrailsApplication grailsApplication
     def grailsLinkGenerator
 
-    private static final List<String> STOREKEEPER_HIDDEN_SECTIONS = [
-            "purchasing",
-            "outbound",
-            "requisitionTemplate",
-    ]
-    private static final List<String> REGIONAL_WAREHOUSE_HIDDEN_SECTIONS = [
-            "purchasing",
-    ]
-    private static final List<String> REPORTING_USER_HIDDEN_SECTIONS = [
-            "purchasing",
-    ]
-
-    private static final String STOREKEEPER_INBOUND_CREATE_HREF = "/stockMovement/createInbound"
-    private static final List<String> REPORTING_USER_HIDDEN_HREF_FRAGMENTS = [
-            "/create",
-            "/edit",
-            "/delete",
-            "/import",
-            "/upload",
-            "/batch",
-            "/replenishment/create",
-            "/stockMovement/importOutboundStockMovement",
-            "/product/mergeProducts",
-            "/product/add",
-            "/inventoryItem/adjustStock",
-            "/inventoryItem/transferStock",
-    ]
-    private static final Set<String> RPC_SUPERUSER_MENU_SECTIONS = ["purchasing", "products", "requisitionTemplate"] as Set<String>
-    private static final Set<RoleType> RPC_SUPERUSER_MENU_MIN_ROLES = [
-            RoleType.ROLE_ASSISTANT,
-            RoleType.ROLE_MANAGER,
-            RoleType.ROLE_ADMIN,
-            RoleType.ROLE_SUPERUSER
-    ] as Set<RoleType>
-
     private getMessageTagLib() {
         return grailsApplication.mainContext.getBean('org.pih.warehouse.MessageTagLib')
     }
 
     private boolean userHasMinimumMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
-        if (sectionId in RPC_SUPERUSER_MENU_SECTIONS &&
-                userService.hasRpcSuperuserPolicy(user, location?.id) &&
-                roleTypes?.any { RPC_SUPERUSER_MENU_MIN_ROLES.contains(it as RoleType) }) {
+        if (customRolePolicyService.shouldAllowRpcSuperuserMenuMinRole(user, location?.id, sectionId, roleTypes)) {
             return true
         }
         Set<String> acceptedRoleTypeNames = (RoleType.expand(roleTypes)*.name()) as Set<String>
@@ -72,9 +36,7 @@ class MegamenuService {
     }
 
     private boolean userHasSupplementalMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
-        if (sectionId in RPC_SUPERUSER_MENU_SECTIONS &&
-                userService.hasRpcSuperuserPolicy(user, location?.id) &&
-                roleTypes?.any { it in [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_REGIONAL_WAREHOUSE] }) {
+        if (customRolePolicyService.shouldAllowRpcSuperuserMenuSupplementalRole(user, location?.id, sectionId, roleTypes)) {
             return true
         }
         Set<String> acceptedRoleTypeNames = (roleTypes*.name()) as Set<String>
@@ -208,94 +170,6 @@ class MegamenuService {
                 }
             }
         }
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, location?.id)
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(user, location?.id)
-        boolean hasReportingUserPolicy = !hasRegionalWarehousePolicy &&
-                !hasRpcSuperuserPolicy &&
-                userService.hasReportingUserPolicy(user, location?.id)
-        boolean hasFacilityStorekeeperPolicy = !hasRegionalWarehousePolicy &&
-                !hasRpcSuperuserPolicy &&
-                !hasReportingUserPolicy &&
-                userService.hasFacilityStorekeeperPolicy(user, location?.id)
-
-        if (hasFacilityStorekeeperPolicy) {
-            parsedMenuConfig = applyFacilityStorekeeperMenuPolicy(parsedMenuConfig)
-        }
-        if (hasRegionalWarehousePolicy && !hasRpcSuperuserPolicy) {
-            parsedMenuConfig = applyRegionalWarehouseMenuPolicy(parsedMenuConfig)
-        }
-        if (hasReportingUserPolicy) {
-            parsedMenuConfig = applyReportingUserMenuPolicy(parsedMenuConfig)
-        }
-        return parsedMenuConfig
-    }
-
-    private ArrayList applyFacilityStorekeeperMenuPolicy(ArrayList menuConfig) {
-        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
-            !STOREKEEPER_HIDDEN_SECTIONS.contains(section?.id)
-        } as ArrayList
-
-        filteredMenu.each { section ->
-            if (section?.id == "inbound" && section?.subsections) {
-                section.subsections = section.subsections.findAll { it != null }.collect { subsection ->
-                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
-                        String href = menuItem?.href ?: ""
-                        !href.contains(STOREKEEPER_INBOUND_CREATE_HREF)
-                    } ?: []
-                    return subsection
-                }
-                section.subsections = section.subsections.findAll { it?.menuItems }
-            }
-        }
-
-        return filteredMenu
-    }
-
-    private ArrayList applyRegionalWarehouseMenuPolicy(ArrayList menuConfig) {
-        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
-            !REGIONAL_WAREHOUSE_HIDDEN_SECTIONS.contains(section?.id)
-        } as ArrayList
-
-        filteredMenu.each { section ->
-            if (section?.id == "inbound" && section?.subsections) {
-                section.subsections = section.subsections.findAll { it != null }.collect { subsection ->
-                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
-                        String href = menuItem?.href ?: ""
-                        !href.contains(STOREKEEPER_INBOUND_CREATE_HREF)
-                    } ?: []
-                    return subsection
-                }
-                section.subsections = section.subsections.findAll { it?.menuItems }
-            }
-        }
-
-        return filteredMenu
-    }
-
-    private ArrayList applyReportingUserMenuPolicy(ArrayList menuConfig) {
-        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
-            !REPORTING_USER_HIDDEN_SECTIONS.contains(section?.id)
-        } as ArrayList
-
-        filteredMenu.each { section ->
-            if (section?.menuItems) {
-                section.menuItems = (section.menuItems ?: []).findAll { menuItem ->
-                    String href = menuItem?.href ?: ""
-                    !REPORTING_USER_HIDDEN_HREF_FRAGMENTS.any { href.contains(it) }
-                } ?: []
-            }
-            if (section?.subsections) {
-                section.subsections = (section.subsections ?: []).findAll { it != null }.collect { subsection ->
-                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
-                        String href = menuItem?.href ?: ""
-                        !REPORTING_USER_HIDDEN_HREF_FRAGMENTS.any { href.contains(it) }
-                    } ?: []
-                    return subsection
-                }
-                section.subsections = section.subsections.findAll { it?.menuItems }
-            }
-        }
-
-        return filteredMenu
+        return customRolePolicyService.applyMenuPolicy(parsedMenuConfig, user, location?.id)
     }
 }
diff --git a/grails-app/services/org/pih/warehouse/core/UserService.groovy b/grails-app/services/org/pih/warehouse/core/UserService.groovy
index 20fdb7731f9..d303fcdaa23 100644
--- a/grails-app/services/org/pih/warehouse/core/UserService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/UserService.groovy
@@ -26,6 +26,7 @@ import org.grails.plugins.web.taglib.ApplicationTagLib
 class UserService {
 
     def authService
+    def customRolePolicyService
     def dataSource
     GrailsApplication grailsApplication
 
@@ -199,7 +200,7 @@ class UserService {
 
     Boolean canUserBrowse(User u) {
         if (u) {
-            def user = User.get(u.id)
+            User user = resolveUser(u)
             Set<String> roleNames = [
                     RoleType.ROLE_SUPERUSER.name(),
                     RoleType.ROLE_ADMIN.name(),
@@ -211,7 +212,10 @@ class UserService {
                     RoleType.ROLE_RPC_SUPERUSER.name(),
                     RoleType.ROLE_REPORTING_USER.name()
             ] as Set<String>
-            return getEffectiveRoles(user).any { Role role -> roleNames.contains(role.roleType?.name()) }
+            Set<String> effectiveRoleNames = (getEffectiveRoles(user)*.roleType*.name()).findAll { it } as Set<String>
+            Set<String> allRoleNames = (user?.getAllRoles()*.roleType*.name()).findAll { it } as Set<String>
+            Set<String> combinedRoleNames = (effectiveRoleNames + allRoleNames) as Set<String>
+            return combinedRoleNames.any { roleNames.contains(it) }
         }
         return false
     }
@@ -304,71 +308,19 @@ class UserService {
     }
 
     Boolean hasFacilityStorekeeperPolicy(User u, String locationId) {
-        if (u) {
-            def user = User.get(u.id)
-            Location location = Location.get(locationId)
-            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
-            Set<String> higherCoreRoleNames = [
-                    RoleType.ROLE_SUPERUSER.name(),
-                    RoleType.ROLE_ADMIN.name(),
-                    RoleType.ROLE_MANAGER.name(),
-                    RoleType.ROLE_ASSISTANT.name()
-            ]
-            return effectiveRoleNames.contains(RoleType.ROLE_FACILITY_STOREKEEPER.name()) &&
-                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
-        }
-        return false
+        return Boolean.TRUE.equals(customRolePolicyService.hasCustomPolicy(u, locationId, RoleType.ROLE_FACILITY_STOREKEEPER))
     }
 
     Boolean hasRegionalWarehousePolicy(User u, String locationId) {
-        if (u) {
-            def user = User.get(u.id)
-            Location location = Location.get(locationId)
-            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
-            Set<String> higherCoreRoleNames = [
-                    RoleType.ROLE_SUPERUSER.name(),
-                    RoleType.ROLE_ADMIN.name(),
-                    RoleType.ROLE_MANAGER.name(),
-                    RoleType.ROLE_ASSISTANT.name()
-            ]
-            return effectiveRoleNames.contains(RoleType.ROLE_REGIONAL_WAREHOUSE.name()) &&
-                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
-        }
-        return false
+        return Boolean.TRUE.equals(customRolePolicyService.hasCustomPolicy(u, locationId, RoleType.ROLE_REGIONAL_WAREHOUSE))
     }
 
     Boolean hasRpcSuperuserPolicy(User u, String locationId) {
-        if (u) {
-            def user = User.get(u.id)
-            Location location = Location.get(locationId)
-            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
-            Set<String> higherCoreRoleNames = [
-                    RoleType.ROLE_SUPERUSER.name(),
-                    RoleType.ROLE_ADMIN.name(),
-                    RoleType.ROLE_MANAGER.name(),
-                    RoleType.ROLE_ASSISTANT.name()
-            ]
-            return effectiveRoleNames.contains(RoleType.ROLE_RPC_SUPERUSER.name()) &&
-                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
-        }
-        return false
+        return Boolean.TRUE.equals(customRolePolicyService.hasCustomPolicy(u, locationId, RoleType.ROLE_RPC_SUPERUSER))
     }
 
     Boolean hasReportingUserPolicy(User u, String locationId) {
-        if (u) {
-            def user = User.get(u.id)
-            Location location = Location.get(locationId)
-            Set<String> effectiveRoleNames = (getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
-            Set<String> higherCoreRoleNames = [
-                    RoleType.ROLE_SUPERUSER.name(),
-                    RoleType.ROLE_ADMIN.name(),
-                    RoleType.ROLE_MANAGER.name(),
-                    RoleType.ROLE_ASSISTANT.name()
-            ]
-            return effectiveRoleNames.contains(RoleType.ROLE_REPORTING_USER.name()) &&
-                    !effectiveRoleNames.any { higherCoreRoleNames.contains(it) }
-        }
-        return false
+        return Boolean.TRUE.equals(customRolePolicyService.hasCustomPolicy(u, locationId, RoleType.ROLE_REPORTING_USER))
     }
 
     // Checks if requestor role exist for any location - for location chooser purposes
@@ -569,7 +521,15 @@ class UserService {
     }
 
     public def getEffectiveRoles(User user, Location location) {
-        return user.getEffectiveRoles(location)
+        User persistentUser = resolveUser(user)
+        return persistentUser?.getEffectiveRoles(location) ?: []
+    }
+
+    private User resolveUser(User user) {
+        if (!user?.id) {
+            return user
+        }
+        return User.get(user.id) ?: user
     }
 
 
diff --git a/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy b/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
new file mode 100644
index 00000000000..bc2dfb7d9bd
--- /dev/null
+++ b/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
@@ -0,0 +1,614 @@
+package org.pih.warehouse.custom.roles
+
+import org.pih.warehouse.core.Location
+import org.pih.warehouse.core.Role
+import org.pih.warehouse.core.RoleType
+import org.pih.warehouse.core.User
+
+class CustomRolePolicyService {
+
+    private static final Set<String> HIGHER_CORE_ROLE_NAMES = [
+            RoleType.ROLE_SUPERUSER.name(),
+            RoleType.ROLE_ADMIN.name(),
+            RoleType.ROLE_MANAGER.name(),
+            RoleType.ROLE_ASSISTANT.name(),
+    ] as Set<String>
+
+    private static final List<RoleType> POLICY_PRECEDENCE = [
+            RoleType.ROLE_RPC_SUPERUSER,
+            RoleType.ROLE_REGIONAL_WAREHOUSE,
+            RoleType.ROLE_REPORTING_USER,
+            RoleType.ROLE_FACILITY_STOREKEEPER,
+    ]
+
+    private static final List<String> CHANGE_ACTIONS = [
+            'delete',
+            'create',
+            'add',
+            'process',
+            'save',
+            'update',
+            'importData',
+            'receive',
+            'showRecordInventory',
+            'withdraw',
+            'cancel',
+            'change',
+            'toggle',
+            'exportAsCsv',
+            'importOutboundStockMovement',
+    ]
+    private static final List<String> CHANGE_CONTROLLERS = ['createProductFromTemplate']
+    private static final Map<String, List<String>> MANAGER_ACTIONS = [
+            'inventory'           : ['createOutboundTransfer'],
+            'stockMovementItemApi': ['eraseItem'],
+    ]
+
+    private static final Map<String, List<String>> FACILITY_STOREKEEPER_ALLOWED_ACTIONS = [
+            'inventory'    : ['createInboundTransfer', 'createConsumed', 'editTransaction', 'deleteTransaction', 'saveTransaction'],
+            'inventoryItem': ['showRecordInventory', 'adjustStock', 'transferStock'],
+            'stockTransfer': ['create', 'edit', 'createInboundReturn'],
+            'stockTransferApi': ['list', 'read', 'create', 'update', 'stockTransferCandidates', 'returnCandidates'],
+    ]
+
+    private static final Map<String, List<String>> REGIONAL_WAREHOUSE_ALLOWED_ACTIONS = [
+            'inventory'        : ['createInboundTransfer', 'createConsumed', 'editTransaction', 'deleteTransaction', 'saveTransaction'],
+            'inventoryItem'    : ['showRecordInventory', 'adjustStock', 'transferStock'],
+            'stockTransfer'    : ['create', 'edit', 'createInboundReturn', 'createOutboundReturn'],
+            'stockTransferApi' : ['list', 'read', 'create', 'update', 'stockTransferCandidates', 'returnCandidates'],
+            'stockMovement'    : ['createOutbound', 'importOutboundStockMovement', 'verifyRequest'],
+            'stockMovementApi' : ['list', 'create'],
+            'stocklistApi'     : ['list', 'read', 'create', 'update', 'delete', 'sendMail', 'clear', 'clone', 'publish', 'unpublish', 'export'],
+            'stocklistItemApi' : ['list', 'read', 'create', 'update', 'remove', 'availableStocklists'],
+            'requisitionTemplate': [
+                    'create',
+                    'save',
+                    'edit',
+                    'editHeader',
+                    'update',
+                    'delete',
+                    'clear',
+                    'clone',
+                    'publish',
+                    'unpublish',
+                    'export',
+                    'batch',
+                    'importData',
+                    'doImport',
+                    'sendMail',
+                    'addToRequisitionItems',
+                    'removeFromRequisitionItems',
+                    'changeSortOrderAlpha',
+                    'changeSortOrderChrono',
+            ],
+            'json'               : ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems'],
+    ]
+
+    private static final Map<String, List<String>> RPC_SUPERUSER_ALLOWED_ACTIONS = [
+            'inventory'          : ['*'],
+            'inventoryItem'      : ['*'],
+            'stockTransfer'      : ['*'],
+            'stockTransferApi'   : ['*'],
+            'stockMovement'      : ['*'],
+            'stockMovementApi'   : ['*'],
+            'stocklist'          : ['*'],
+            'stocklistApi'       : ['*'],
+            'stocklistItemApi'   : ['*'],
+            'stocklistManagement': ['*'],
+            'requisitionTemplate': ['*'],
+            'json'               : ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems'],
+            'purchaseOrder'      : ['*'],
+            'purchaseOrderApi'   : ['*'],
+            'supplier'           : ['*'],
+            'product'            : ['*'],
+            'productApi'         : ['*'],
+            'productType'        : ['*'],
+            'category'           : ['*'],
+            'categoryApi'        : ['*'],
+            'productCatalog'     : ['*'],
+            'tag'                : ['*'],
+            'attribute'          : ['*'],
+            'attributeApi'       : ['*'],
+            'productAssociation' : ['*'],
+            'productSupplier'    : ['*'],
+            'productSupplierApi' : ['*'],
+            'productSupplierPreferenceApi': ['*'],
+            'productSupplierAttributeApi': ['*'],
+            'productPackage'     : ['*'],
+            'productPackageApi'  : ['*'],
+            'productComponent'   : ['*'],
+            'productGroup'       : ['*'],
+            'unitOfMeasure'      : ['*'],
+            'unitOfMeasureApi'   : ['*'],
+            'unitOfMeasureClass' : ['*'],
+            'unitOfMeasureConversion': ['*'],
+            'productsConfiguration': ['*'],
+            'productsConfigurationApi': ['*'],
+    ]
+
+    private static final Map<String, List<String>> REPORTING_USER_ALLOWED_ACTIONS = [
+            'api'                 : ['getAppContext', 'getRequestTypes', 'getMenuConfig'],
+            'dashboard'           : ['megamenu'],
+            'grails'              : ['errors'],
+            'localizationApi'     : ['list'],
+            'locationApi'         : ['list'],
+            'productApi'          : ['list', 'productDemand', 'productAvailabilityAndDemand'],
+            'requisitionTemplate' : ['list', 'show'],
+            'stocklistApi'        : ['list', 'read'],
+            'stocklistItemApi'    : ['list', 'read', 'availableStocklists'],
+            'stockMovement'       : ['list'],
+            'stockMovementApi'    : ['read', 'list'],
+            'stockMovementItemApi': ['getStockMovementItems'],
+            'stockTransferApi'    : ['list', 'read', 'stockTransferCandidates', 'returnCandidates'],
+            'stockTransfer'       : ['list'],
+    ]
+
+    private static final Set<String> STOCKLIST_MANAGEMENT_CONTROLLERS = [
+            'requisitionTemplate', 'stocklist', 'stocklistApi', 'stocklistItemApi', 'stocklistManagement',
+    ] as Set<String>
+
+    private static final Set<String> PRODUCT_WRITE_ACTIONS = [
+            'batchEdit',
+            'batchEditProperties',
+            'create',
+            'save',
+            'edit',
+            'update',
+            'delete',
+            'deleteProducts',
+            'importAsCsv',
+            'savePackage',
+            'deleteDocument',
+            'deleteProductComponent',
+            'deleteProductGroup',
+            'editProductSynonym',
+            'editProductSynonymDialog',
+            'deleteSynonym',
+    ] as Set<String>
+
+    private static final Set<String> REPORTING_USER_HIDDEN_SECTIONS = [
+            'purchasing',
+    ] as Set<String>
+    private static final Set<String> STOREKEEPER_HIDDEN_SECTIONS = [
+            'purchasing',
+            'outbound',
+            'requisitionTemplate',
+    ] as Set<String>
+    private static final Set<String> REGIONAL_WAREHOUSE_HIDDEN_SECTIONS = [
+            'purchasing',
+    ] as Set<String>
+
+    private static final String INBOUND_CREATE_HREF = '/stockMovement/createInbound'
+    private static final String INBOUND_COMBINED_CREATE_HREF = '/stockMovement/createCombinedShipments'
+
+    private static final List<String> REPORTING_USER_HIDDEN_HREF_FRAGMENTS = [
+            '/create',
+            '/edit',
+            '/delete',
+            '/import',
+            '/upload',
+            '/batch',
+            '/replenishment/create',
+            '/stockMovement/importOutboundStockMovement',
+            '/product/mergeProducts',
+            '/product/add',
+            '/inventoryItem/adjustStock',
+            '/inventoryItem/transferStock',
+    ]
+
+    private static final Set<String> CUSTOM_ROLE_NAMES = [
+            RoleType.ROLE_FACILITY_STOREKEEPER.name(),
+            RoleType.ROLE_REGIONAL_WAREHOUSE.name(),
+            RoleType.ROLE_RPC_SUPERUSER.name(),
+            RoleType.ROLE_REPORTING_USER.name(),
+    ] as Set<String>
+
+    private static final Set<String> RPC_SUPERUSER_MENU_SECTIONS = ['purchasing', 'products', 'requisitionTemplate'] as Set<String>
+    private static final Set<RoleType> RPC_SUPERUSER_MENU_MIN_ROLES = [
+            RoleType.ROLE_ASSISTANT,
+            RoleType.ROLE_MANAGER,
+            RoleType.ROLE_ADMIN,
+            RoleType.ROLE_SUPERUSER,
+    ] as Set<RoleType>
+
+    Map<String, Boolean> getPolicyFlags(User user, String locationId) {
+        RoleType activePolicy = getActivePolicy(user, locationId)
+        return [
+                hasFacilityStorekeeperPolicy: activePolicy == RoleType.ROLE_FACILITY_STOREKEEPER,
+                hasRegionalWarehousePolicy  : activePolicy == RoleType.ROLE_REGIONAL_WAREHOUSE,
+                hasRpcSuperuserPolicy       : activePolicy == RoleType.ROLE_RPC_SUPERUSER,
+                hasReportingUserPolicy      : activePolicy == RoleType.ROLE_REPORTING_USER,
+        ]
+    }
+
+    Map<String, Object> evaluateRouteAccess(User user, String locationId, String controllerName, String actionName, Map params = null, def request = null) {
+        RoleType activePolicy = getActivePolicy(user, locationId)
+        if (!activePolicy) {
+            return [hasPolicy: false, denied: false, allowed: false]
+        }
+
+        boolean denied = isDeniedByPolicy(activePolicy, controllerName, actionName, params ?: [:], request)
+        boolean allowed = !denied && isAllowedByPolicy(activePolicy, controllerName, actionName, params ?: [:], request)
+        return [hasPolicy: true, denied: denied, allowed: allowed, policyRole: activePolicy]
+    }
+
+    boolean hasCustomPolicy(User user, String locationId, RoleType roleType) {
+        return getActivePolicy(user, locationId) == roleType
+    }
+
+    boolean hasAnyCustomPolicy(User user, String locationId) {
+        return getActivePolicy(user, locationId) != null
+    }
+
+    boolean hasLocationChooserRole(User user) {
+        Set<String> roleNames = getAllRoleNames(user)
+        Set<String> chooserRoleNames = (RoleType.listRoleTypesForLocationChooser()*.name()) as Set<String>
+        return roleNames.any { chooserRoleNames.contains(it) }
+    }
+
+    ArrayList applyMenuPolicy(ArrayList menuConfig, User user, String locationId) {
+        RoleType activePolicy = getActivePolicy(user, locationId)
+        if (!activePolicy) {
+            return menuConfig
+        }
+
+        switch (activePolicy) {
+            case RoleType.ROLE_FACILITY_STOREKEEPER:
+                return applyFacilityStorekeeperMenuPolicy(menuConfig)
+            case RoleType.ROLE_REGIONAL_WAREHOUSE:
+                return applyRegionalWarehouseMenuPolicy(menuConfig)
+            case RoleType.ROLE_REPORTING_USER:
+                return applyReportingUserMenuPolicy(menuConfig)
+            default:
+                return menuConfig
+        }
+    }
+
+    Map<String, Object> getCustomRolePermissions(User user, String locationId) {
+        RoleType activePolicy = getActivePolicy(user, locationId)
+        return [
+                activeCustomRolePolicy          : activePolicy?.name(),
+                canCreateInboundMovement        : ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
+                canCreateInboundFromPurchaseOrder: ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
+                canCreateOutboundMovement       : ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
+                canManageStocklists             : [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy),
+                canSendStocklistEmail           : [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy),
+                canManageProducts               : activePolicy == RoleType.ROLE_RPC_SUPERUSER,
+                canManagePurchasing             : ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
+        ]
+    }
+
+    boolean canManageStocklists(User user, String locationId) {
+        RoleType activePolicy = getActivePolicy(user, locationId)
+        return [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy)
+    }
+
+    boolean shouldHideStocklistEmail(User user, String locationId) {
+        RoleType activePolicy = getActivePolicy(user, locationId)
+        return [RoleType.ROLE_REPORTING_USER, RoleType.ROLE_FACILITY_STOREKEEPER].contains(activePolicy)
+    }
+
+    boolean shouldAllowRpcSuperuserMenuMinRole(User user, String locationId, String sectionId, Collection roleTypes) {
+        return sectionId in RPC_SUPERUSER_MENU_SECTIONS &&
+                hasCustomPolicy(user, locationId, RoleType.ROLE_RPC_SUPERUSER) &&
+                roleTypes?.any { RPC_SUPERUSER_MENU_MIN_ROLES.contains(it as RoleType) }
+    }
+
+    boolean shouldAllowRpcSuperuserMenuSupplementalRole(User user, String locationId, String sectionId, Collection roleTypes) {
+        return sectionId in RPC_SUPERUSER_MENU_SECTIONS &&
+                hasCustomPolicy(user, locationId, RoleType.ROLE_RPC_SUPERUSER) &&
+                roleTypes?.any { it in [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_REGIONAL_WAREHOUSE] }
+    }
+
+    private RoleType getActivePolicy(User user, String locationId) {
+        if (!user || !locationId) {
+            return null
+        }
+
+        Set<String> effectiveRoleNames = getEffectiveRoleNames(user, locationId)
+        if (!effectiveRoleNames || effectiveRoleNames.any { HIGHER_CORE_ROLE_NAMES.contains(it) }) {
+            return null
+        }
+
+        return POLICY_PRECEDENCE.find { RoleType roleType ->
+            effectiveRoleNames.contains(roleType.name())
+        }
+    }
+
+    private Set<String> getEffectiveRoleNames(User user, String locationId) {
+        User persistentUser = resolveUser(user)
+        Location location = Location.get(locationId)
+        return (persistentUser?.getEffectiveRoles(location)*.roleType*.name()).findAll { it } as Set<String>
+    }
+
+    private Set<String> getAllRoleNames(User user) {
+        User persistentUser = resolveUser(user)
+        return (persistentUser?.getAllRoles()*.roleType*.name()).findAll { it } as Set<String>
+    }
+
+    private User resolveUser(User user) {
+        if (!user?.id) {
+            return user
+        }
+        return User.get(user.id) ?: user
+    }
+
+    private boolean isAllowedByPolicy(RoleType policy, String controllerName, String actionName, Map params, def request) {
+        switch (policy) {
+            case RoleType.ROLE_FACILITY_STOREKEEPER:
+                return isRouteAllowed(FACILITY_STOREKEEPER_ALLOWED_ACTIONS, controllerName, actionName)
+            case RoleType.ROLE_REGIONAL_WAREHOUSE:
+                return isRouteAllowed(REGIONAL_WAREHOUSE_ALLOWED_ACTIONS, controllerName, actionName)
+            case RoleType.ROLE_RPC_SUPERUSER:
+                return isRouteAllowed(RPC_SUPERUSER_ALLOWED_ACTIONS, controllerName, actionName)
+            case RoleType.ROLE_REPORTING_USER:
+                return isRouteAllowed(REPORTING_USER_ALLOWED_ACTIONS, controllerName, actionName)
+            default:
+                return false
+        }
+    }
+
+    private boolean isDeniedByPolicy(RoleType policy, String controllerName, String actionName, Map params, def request) {
+        switch (policy) {
+            case RoleType.ROLE_FACILITY_STOREKEEPER:
+                return isDeniedForFacilityStorekeeper(controllerName, actionName, params, request)
+            case RoleType.ROLE_REGIONAL_WAREHOUSE:
+                return isDeniedForRegionalWarehouse(controllerName, actionName, params, request)
+            case RoleType.ROLE_RPC_SUPERUSER:
+                return isDeniedForRpcSuperuser(controllerName, actionName)
+            case RoleType.ROLE_REPORTING_USER:
+                return isDeniedForReportingUser(controllerName, actionName, params, request)
+            default:
+                return false
+        }
+    }
+
+    private static boolean isRouteAllowed(Map<String, List<String>> allowedActions, String controllerName, String actionName) {
+        List<String> controllerActions = allowedActions[controllerName] ?: []
+        return controllerActions.contains('*') || controllerActions.contains(actionName)
+    }
+
+    private static boolean isDeniedForFacilityStorekeeper(String controllerName, String actionName, Map params, def request) {
+        if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
+            return true
+        }
+
+        if (controllerName == 'stockMovement') {
+            if (actionName in ['createOutbound', 'importOutboundStockMovement', 'verifyRequest']) {
+                return true
+            }
+            if (actionName == 'list' && params.direction?.toUpperCase() == 'OUTBOUND') {
+                return true
+            }
+        }
+        if (controllerName == 'stockMovementApi') {
+            String direction = params.direction ?: request?.JSON?.direction
+            if (actionName == 'list' && direction?.toUpperCase() == 'OUTBOUND') {
+                return true
+            }
+            if (actionName == 'create' && direction?.toUpperCase() == 'OUTBOUND') {
+                return true
+            }
+        }
+        if (controllerName == 'stockTransfer' && actionName == 'createOutboundReturn') {
+            return true
+        }
+
+        if (controllerName in STOCKLIST_MANAGEMENT_CONTROLLERS) {
+            return true
+        }
+
+        if (controllerName == 'product' && PRODUCT_WRITE_ACTIONS.contains(actionName)) {
+            return true
+        }
+        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete', 'importCsv']) {
+            return true
+        }
+
+        if (controllerName == 'stockMovement' && actionName == 'createInbound') {
+            return !params.id
+        }
+        if (controllerName == 'stockMovementApi' && actionName == 'create') {
+            String direction = params.direction ?: request?.JSON?.direction
+            return direction?.toUpperCase() == 'INBOUND'
+        }
+        if (controllerName == 'stockMovement' && actionName == 'createCombinedShipments') {
+            return !params.id
+        }
+        if (controllerName == 'stockMovementApi' && actionName == 'createCombinedShipments') {
+            return isCreateOperation(params, request)
+        }
+        if (controllerName == 'createShipmentWorkflow' && actionName == 'createShipment') {
+            return !params.id && params.type?.toUpperCase() == 'INCOMING'
+        }
+
+        return false
+    }
+
+    private static boolean isDeniedForRegionalWarehouse(String controllerName, String actionName, Map params, def request) {
+        if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
+            return true
+        }
+        if (controllerName == 'dashboard' && actionName == 'supplier') {
+            return true
+        }
+
+        if (controllerName == 'stockMovement' && actionName == 'createInbound') {
+            return !params.id
+        }
+        if (controllerName == 'stockMovementApi' && actionName == 'create') {
+            String direction = params.direction ?: request?.JSON?.direction
+            return direction?.toUpperCase() == 'INBOUND'
+        }
+        if (controllerName == 'stockMovement' && actionName == 'createCombinedShipments') {
+            return !params.id
+        }
+        if (controllerName == 'stockMovementApi' && actionName == 'createCombinedShipments') {
+            return isCreateOperation(params, request)
+        }
+        if (controllerName == 'createShipmentWorkflow' && actionName == 'createShipment') {
+            return !params.id && params.type?.toUpperCase() == 'INCOMING'
+        }
+
+        if (controllerName == 'product' && PRODUCT_WRITE_ACTIONS.contains(actionName)) {
+            return true
+        }
+        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete']) {
+            return true
+        }
+
+        return false
+    }
+
+    private static boolean isDeniedForRpcSuperuser(String controllerName, String actionName) {
+        return controllerName == 'dashboard' && actionName in ['hideTag', 'hideCatalog', 'flushCache']
+    }
+
+    private static boolean isDeniedForReportingUser(String controllerName, String actionName, Map params, def request) {
+        if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
+            return true
+        }
+        if (controllerName == 'dashboard' && actionName == 'supplier') {
+            return true
+        }
+
+        if (controllerName in ['inventory', 'inventoryItem', 'stockTransfer', 'stockTransferApi', 'stockMovement', 'stockMovementApi', 'stockMovementItemApi', 'stocklist', 'stocklistApi', 'stocklistItemApi', 'stocklistManagement', 'requisitionTemplate', 'json']) {
+            if (isManagerAction(controllerName, actionName)) {
+                return true
+            }
+        }
+
+        if (controllerName == 'stockMovement' && actionName in ['createInbound', 'createOutbound', 'importOutboundStockMovement', 'verifyRequest', 'createRequest', 'createCombinedShipments']) {
+            return true
+        }
+        if (controllerName == 'stockMovementApi' && actionName in ['create', 'createCombinedShipments', 'update', 'updateStatus', 'delete']) {
+            return true
+        }
+
+        if (controllerName == 'stocklistApi' && actionName in ['create', 'update', 'delete', 'sendMail', 'clear', 'clone', 'publish', 'unpublish', 'export']) {
+            return true
+        }
+        if (controllerName == 'stocklistItemApi' && actionName in ['create', 'update', 'remove']) {
+            return true
+        }
+        if (controllerName == 'requisitionTemplate' && actionName in [
+                'create',
+                'save',
+                'edit',
+                'editHeader',
+                'update',
+                'delete',
+                'clear',
+                'clone',
+                'publish',
+                'unpublish',
+                'export',
+                'batch',
+                'importData',
+                'doImport',
+                'sendMail',
+                'addToRequisitionItems',
+                'removeFromRequisitionItems',
+                'changeSortOrderAlpha',
+                'changeSortOrderChrono',
+        ]) {
+            return true
+        }
+        if (controllerName == 'stocklistManagement') {
+            return true
+        }
+        if (controllerName == 'json' && actionName in ['addToRequisitionItems', 'updateRequisitionItems', 'removeRequisitionItem', 'sortRequisitionItems']) {
+            return true
+        }
+
+        if (controllerName == 'product' && PRODUCT_WRITE_ACTIONS.contains(actionName)) {
+            return true
+        }
+        if (controllerName == 'productApi' && actionName in ['create', 'update', 'delete', 'importCsv']) {
+            return true
+        }
+
+        return false
+    }
+
+    private static boolean isManagerAction(String controllerName, String actionName) {
+        boolean isChangeAction = CHANGE_ACTIONS.any { actionName?.startsWith(it) }
+        boolean isWorkflow = controllerName?.contains('Workflow')
+        boolean isChangeController = CHANGE_CONTROLLERS.contains(controllerName)
+        boolean isManagerAction = (MANAGER_ACTIONS[controllerName] ?: []).contains(actionName)
+        return isChangeAction || isWorkflow || isChangeController || isManagerAction
+    }
+
+    private static boolean isCreateOperation(Map params, def request) {
+        return !params?.id && !request?.JSON?.id
+    }
+
+    private ArrayList applyFacilityStorekeeperMenuPolicy(ArrayList menuConfig) {
+        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
+            !STOREKEEPER_HIDDEN_SECTIONS.contains(section?.id)
+        } as ArrayList
+
+        filteredMenu.each { section ->
+            if (section?.id == 'inbound' && section?.subsections) {
+                section.subsections = section.subsections.findAll { it != null }.collect { subsection ->
+                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
+                        String href = menuItem?.href ?: ''
+                        !href.contains(INBOUND_CREATE_HREF) && !href.contains(INBOUND_COMBINED_CREATE_HREF)
+                    } ?: []
+                    return subsection
+                }
+                section.subsections = section.subsections.findAll { it?.menuItems }
+            }
+        }
+
+        return filteredMenu
+    }
+
+    private ArrayList applyRegionalWarehouseMenuPolicy(ArrayList menuConfig) {
+        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
+            !REGIONAL_WAREHOUSE_HIDDEN_SECTIONS.contains(section?.id)
+        } as ArrayList
+
+        filteredMenu.each { section ->
+            if (section?.id == 'inbound' && section?.subsections) {
+                section.subsections = section.subsections.findAll { it != null }.collect { subsection ->
+                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
+                        String href = menuItem?.href ?: ''
+                        !href.contains(INBOUND_CREATE_HREF) && !href.contains(INBOUND_COMBINED_CREATE_HREF)
+                    } ?: []
+                    return subsection
+                }
+                section.subsections = section.subsections.findAll { it?.menuItems }
+            }
+        }
+
+        return filteredMenu
+    }
+
+    private ArrayList applyReportingUserMenuPolicy(ArrayList menuConfig) {
+        ArrayList filteredMenu = (menuConfig ?: []).findAll { section ->
+            !REPORTING_USER_HIDDEN_SECTIONS.contains(section?.id)
+        } as ArrayList
+
+        filteredMenu.each { section ->
+            if (section?.menuItems) {
+                section.menuItems = (section.menuItems ?: []).findAll { menuItem ->
+                    String href = menuItem?.href ?: ''
+                    !REPORTING_USER_HIDDEN_HREF_FRAGMENTS.any { href.contains(it) }
+                } ?: []
+            }
+            if (section?.subsections) {
+                section.subsections = (section.subsections ?: []).findAll { it != null }.collect { subsection ->
+                    subsection.menuItems = (subsection?.menuItems ?: []).findAll { menuItem ->
+                        String href = menuItem?.href ?: ''
+                        !REPORTING_USER_HIDDEN_HREF_FRAGMENTS.any { href.contains(it) }
+                    } ?: []
+                    return subsection
+                }
+                section.subsections = section.subsections.findAll { it?.menuItems }
+            }
+        }
+
+        return filteredMenu
+    }
+}
diff --git a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
index 1e10523c202..315d013c29c 100644
--- a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
+++ b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
@@ -11,15 +11,13 @@ package org.pih.warehouse
 
 import org.pih.warehouse.core.ActivityCode
 import org.pih.warehouse.core.Location
-import org.pih.warehouse.core.Role
 import org.pih.warehouse.core.RoleType
 import org.pih.warehouse.core.User
-import org.pih.warehouse.core.Location
-import org.pih.warehouse.core.User
 
 class AuthTagLib {
 
     def userService
+    def customRolePolicyService
 
     def supports = { attrs, body ->
         def warehouseInstance = Location.get(attrs.location ?: session.warehouse.id)
@@ -68,9 +66,25 @@ class AuthTagLib {
             out << body()
     }
     def canManageStocklists = { attrs, body ->
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
-        if (userService.isUserAdmin(session?.user) || hasRegionalWarehousePolicy || hasRpcSuperuserPolicy) {
+        if (userService.isUserAdmin(session?.user) ||
+                customRolePolicyService.canManageStocklists(session?.user, session?.warehouse?.id)) {
+            out << body()
+        }
+    }
+    def canSendStocklistEmail = { attrs, body ->
+        if (!customRolePolicyService.shouldHideStocklistEmail(session?.user, session?.warehouse?.id)) {
+            out << body()
+        }
+    }
+    def canCreateInboundMovement = { attrs, body ->
+        Map<String, Object> permissions = customRolePolicyService.getCustomRolePermissions(session?.user, session?.warehouse?.id)
+        if (permissions.canCreateInboundMovement) {
+            out << body()
+        }
+    }
+    def canCreateInboundFromPurchaseOrder = { attrs, body ->
+        Map<String, Object> permissions = customRolePolicyService.getCustomRolePermissions(session?.user, session?.warehouse?.id)
+        if (permissions.canCreateInboundFromPurchaseOrder) {
             out << body()
         }
     }
diff --git a/grails-app/views/order/list.gsp b/grails-app/views/order/list.gsp
index b90ca3b8b2b..be049e4f921 100644
--- a/grails-app/views/order/list.gsp
+++ b/grails-app/views/order/list.gsp
@@ -30,12 +30,14 @@
 							<warehouse:message code="default.create.label" args="[g.message(code: 'order.label')]" default="Create purchase order" />
 						</g:link>
 					</g:supports>
-					<g:link data-testid="create-shipment-button" controller="stockMovement" action="createCombinedShipments" class="button" params="[direction:'INBOUND']">
-						<img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-						<warehouse:message code="default.create.label" args="[warehouse.message(code: 'shipmentFromPO.label')]"/>
-					</g:link>
-				</g:isUserInRole>
-			</div>
+						<g:canCreateInboundFromPurchaseOrder>
+							<g:link data-testid="create-shipment-button" controller="stockMovement" action="createCombinedShipments" class="button" params="[direction:'INBOUND']">
+								<img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+								<warehouse:message code="default.create.label" args="[warehouse.message(code: 'shipmentFromPO.label')]"/>
+							</g:link>
+						</g:canCreateInboundFromPurchaseOrder>
+					</g:isUserInRole>
+				</div>
 
 			<div class="yui-gf">
 				<div class="yui-u first">
diff --git a/grails-app/views/requisitionTemplate/_summary.gsp b/grails-app/views/requisitionTemplate/_summary.gsp
index 3d1e7ac1714..177d4b1ea67 100644
--- a/grails-app/views/requisitionTemplate/_summary.gsp
+++ b/grails-app/views/requisitionTemplate/_summary.gsp
@@ -114,11 +114,13 @@
 						</g:link>
 					</g:else>
 				</g:canManageStocklists>
-				<g:link controller="requisitionTemplate" action="sendMail" id="${requisition?.id}" class="button">
-					<img src="${resource(dir:'images/icons/silk',file:'email.png')}" />
-					${warehouse.message(code: 'default.button.email.label')}
-				</g:link>
-			</div>
+					<g:canSendStocklistEmail>
+						<g:link controller="requisitionTemplate" action="sendMail" id="${requisition?.id}" class="button">
+							<img src="${resource(dir:'images/icons/silk',file:'email.png')}" />
+							${warehouse.message(code: 'default.button.email.label')}
+						</g:link>
+					</g:canSendStocklistEmail>
+				</div>
 
 			<span class="action-menu" style="margin-left: 15px">
 				<button class="action-btn button">
diff --git a/grails-app/views/stockMovement/list.gsp b/grails-app/views/stockMovement/list.gsp
index ce8eaf94da4..acdb14eeff2 100644
--- a/grails-app/views/stockMovement/list.gsp
+++ b/grails-app/views/stockMovement/list.gsp
@@ -83,16 +83,28 @@
                     <warehouse:message code="default.open.label" args="[warehouse.message(code: 'requests.label')]"/>
                 </g:link>
             </g:if>
-            <g:link controller="stockMovement" action="create" class="button" params="[direction:params.direction]">
-                <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-                <warehouse:message code="default.create.label" args="[warehouse.message(code: 'stockMovement.label')]" />
-            </g:link>
-            <g:if test="${params.direction as StockMovementDirection == StockMovementDirection.INBOUND}">
-                <g:link controller="stockMovement" action="createCombinedShipments" class="button" params="[direction:'INBOUND']">
-                    <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-                    <warehouse:message code="default.create.label" args="[warehouse.message(code: 'shipmentFromPO.label')]"/>
-                </g:link>
-            </g:if>
+	            <g:if test="${params.direction as StockMovementDirection == StockMovementDirection.INBOUND}">
+	                <g:canCreateInboundMovement>
+	                    <g:link controller="stockMovement" action="create" class="button" params="[direction:params.direction]">
+	                        <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+	                        <warehouse:message code="default.create.label" args="[warehouse.message(code: 'stockMovement.label')]" />
+	                    </g:link>
+	                </g:canCreateInboundMovement>
+	            </g:if>
+	            <g:else>
+	                <g:link controller="stockMovement" action="create" class="button" params="[direction:params.direction]">
+	                    <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+	                    <warehouse:message code="default.create.label" args="[warehouse.message(code: 'stockMovement.label')]" />
+	                </g:link>
+	            </g:else>
+	            <g:if test="${params.direction as StockMovementDirection == StockMovementDirection.INBOUND}">
+	                <g:canCreateInboundFromPurchaseOrder>
+	                    <g:link controller="stockMovement" action="createCombinedShipments" class="button" params="[direction:'INBOUND']">
+	                        <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+	                        <warehouse:message code="default.create.label" args="[warehouse.message(code: 'shipmentFromPO.label')]"/>
+	                    </g:link>
+	                </g:canCreateInboundFromPurchaseOrder>
+	            </g:if>
         </div>
 
 
diff --git a/openspec/changes/archive/2026-05-22-custom-roles-refactor/.openspec.yaml b/openspec/changes/archive/2026-05-22-custom-roles-refactor/.openspec.yaml
new file mode 100644
index 00000000000..af43829ce6a
--- /dev/null
+++ b/openspec/changes/archive/2026-05-22-custom-roles-refactor/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-21
diff --git a/openspec/changes/archive/2026-05-22-custom-roles-refactor/design.md b/openspec/changes/archive/2026-05-22-custom-roles-refactor/design.md
new file mode 100644
index 00000000000..61b9a684b7d
--- /dev/null
+++ b/openspec/changes/archive/2026-05-22-custom-roles-refactor/design.md
@@ -0,0 +1,73 @@
+## Context
+
+Custom roles were added to enforce a fixed access matrix for Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User. The current branch implements that matrix by spreading role checks through interceptors, services, taglibs, GSPs, React components, reducers, and hooks. That makes the fork harder to replay onto upstream and creates multiple sources of truth for the same permission question.
+
+The refactor must respect the EyeSeeTea fork rules: custom backend code belongs under `org.pih.warehouse.custom.*`, custom frontend code belongs under `src/js/custom/*`, and upstream files should only contain narrow delegation hooks where no extension point exists.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Make one backend custom-role policy service the canonical source for custom-role decisions.
+- Keep custom-role code discoverable through isolated custom package paths.
+- Minimize and document the remaining upstream touchpoints needed to enforce policy.
+- Export one canonical custom-role permission payload for frontend and GSP visibility checks.
+- Cover the custom-role matrix with regression tests across policy resolution, UI visibility, and direct controller/API enforcement.
+- Fix the known policy gaps for combined-shipment inbound creation and reporting-user stocklist email.
+
+**Non-Goals:**
+
+- Redesign OpenBoxes' general RBAC model or replace existing core-role behavior.
+- Change the approved access matrix beyond the tightening described in the specs.
+- Add database schema changes or new external dependencies.
+- Rewrite unrelated upstream controllers, services, or React screens for style cleanup.
+
+## Decisions
+
+1. Introduce a custom backend policy service under `org.pih.warehouse.custom.roles`.
+
+   The service will expose focused methods for policy questions such as route access, menu visibility, module/action capability, app-context permissions, and effective custom-role evaluation for a user/location. This keeps custom-role rules in one place and makes tests direct. Alternative considered: continue adding conditions to `RoleInterceptor`, `MegamenuService`, `AuthTagLib`, and React components. That preserves the current fragmentation and is the source of the review findings.
+
+2. Treat upstream files as hook points only.
+
+   `RoleInterceptor`, `MegamenuService`, `AuthTagLib`, app-context generation, and any unavoidable controller/API checks should delegate to the custom policy service without embedding role matrices or endpoint lists inline. Alternative considered: move all enforcement into the interceptor only. That would reduce some duplication but would not cover menu generation, GSP action visibility, or frontend permissions cleanly.
+
+3. Define endpoint policy as data near the custom service.
+
+   Controller/action and API route restrictions should be represented as structured Groovy data or small policy classes under the custom package, with tests for the route list. This is preferable to scattered `if` chains because gaps like `createCombinedShipments` become easier to spot and review.
+
+4. Export canonical frontend permissions from the backend.
+
+   The backend should include a compact custom-role permission map in the existing app-context/session payload. React helpers under `src/js/custom/roles` should read that payload and expose intent-based predicates such as "can create inbound movement" or "can send stocklist email." Alternative considered: duplicate role-name checks in every component. That creates UI/backend drift.
+
+5. Preserve core-role precedence.
+
+   The policy service should short-circuit when the effective current-location roles include existing higher core roles that already authorize the workflow. Custom restrictions should apply only to users whose effective access is governed by the custom roles. This preserves the existing spec and limits regression risk.
+
+6. Use layered tests.
+
+   Policy unit tests should cover the access matrix and route/action classifications. Integration or controller tests should cover direct URL/API denial for high-risk endpoints. Frontend tests should cover the permission helper and selected action visibility call sites. This gives useful coverage without requiring every page to be rendered in a browser test.
+
+## Risks / Trade-offs
+
+- Incomplete upstream hook replacement -> Mitigation: inventory every current custom-role condition from the branch before coding and either move it behind the policy service or document why it remains.
+- Route-policy drift as upstream changes controller/action names -> Mitigation: keep route restrictions as named data with tests for known restricted endpoints and add regression cases for review findings.
+- Frontend payload mismatch with legacy session fields -> Mitigation: keep existing fields during the refactor and add the new permission map as an additive payload until callers migrate.
+- Tests may be slow if every scenario is integration-level -> Mitigation: put the full matrix in fast service/helper tests and reserve integration tests for direct access enforcement and location-chooser behavior.
+- Core-role precedence could be misapplied for users with mixed roles -> Mitigation: explicitly test custom-only, custom-plus-higher-core, and unrelated-role users at the current location.
+
+## Migration Plan
+
+1. Add the custom backend policy service and tests without changing existing behavior.
+2. Route `RoleInterceptor`, menu filtering, app-context/session permission payloads, and taglib visibility checks through the service.
+3. Move frontend role helpers under `src/js/custom/roles` and update selected React call sites to use the canonical permission payload.
+4. Remove duplicated role-specific conditions that have been replaced by service/helper calls.
+5. Add regression tests for combined-shipment inbound creation, reporting-user stocklist email, location chooser access, and representative menu/action visibility.
+6. Run focused backend and frontend test suites, then the broader project test commands as practical.
+
+Rollback is a code rollback only; no database migration is expected.
+
+## Open Questions
+
+- Whether the existing location chooser pre-warehouse flow fails for location-scoped custom-role-only users must be validated during implementation and covered by a regression test either way.
+- The final list of unavoidable upstream touchpoints should be recorded during implementation so future upstream replays know where the fork hooks live.
diff --git a/openspec/changes/archive/2026-05-22-custom-roles-refactor/implementation-notes.md b/openspec/changes/archive/2026-05-22-custom-roles-refactor/implementation-notes.md
new file mode 100644
index 00000000000..51498cf2889
--- /dev/null
+++ b/openspec/changes/archive/2026-05-22-custom-roles-refactor/implementation-notes.md
@@ -0,0 +1,100 @@
+## Inventory Summary (Task Group 1)
+
+### Backend custom-role surfaces found
+
+- `grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy`
+  Contains custom-role allow/deny matrices and route checks (including inbound creation logic).
+- `grails-app/services/org/pih/warehouse/core/UserService.groovy`
+  Contains role policy predicates (`hasFacilityStorekeeperPolicy`, etc.).
+- `grails-app/services/org/pih/warehouse/api/MegamenuService.groovy`
+  Contains custom-role menu filtering and role-specific menu exceptions.
+- `grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy`
+  Contains stocklist and authenticated-role visibility logic with custom-role conditions.
+- `grails-app/controllers/org/pih/warehouse/api/ApiController.groovy`
+  Computes custom-role flags and requestor menu behavior in app context.
+- `grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy`
+  Contains location-chooser default-role checks including custom roles.
+- `grails-app/services/org/pih/warehouse/core/LocationService.groovy`
+  Contains location-chooser default-role checks including custom roles.
+- `grails-app/controllers/org/pih/warehouse/order/PurchaseOrderController.groovy`
+  Contains explicit facility-storekeeper guards for purchase order creation flows.
+
+### Frontend custom-role surfaces found
+
+- `src/js/reducers/sessionReducer.jsx`
+  Stores custom-role policy booleans in session state.
+- `src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx`
+  Hides inbound create actions only for reporting users.
+- `src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx`
+  Hides PO/ship-from-PO actions only for facility storekeeper.
+- `src/js/components/stock-list/*` and `stock-list-management/*`
+  Contains inline stocklist-write visibility checks for regional/rpc roles.
+- Other components and hooks consume raw `has*Policy` booleans directly.
+
+### Upstream hook points to retain (narrow delegation only)
+
+- `RoleInterceptor.before()` for route-level enforcement.
+- `MegamenuService.buildAndTranslateMenu()` for menu filtering.
+- `AuthTagLib` role tags for GSP action visibility.
+- `ApiController.getAppContext()` and `getMenuConfig()` for frontend/session payload.
+- `LocationApiController.list()` and `LocationService.getLoginLocationsMap()` for chooser behavior.
+
+### Duplicated logic to move behind custom policy services/helpers
+
+- Custom-role policy precedence resolution.
+- Controller/API allow/deny route classification.
+- Menu section and menu-item visibility rules.
+- Stocklist and inbound creation action visibility predicates.
+- Frontend action visibility predicates currently repeated across components.
+
+## Additional Refactor Scope Completed After Initial Task Pass
+
+### Frontend part-2 migration completion
+
+- Replaced remaining direct custom-role boolean consumption in non-reducer files with canonical `customRolePermissions` helper usage:
+  - `src/js/components/productSupplier/ProductSupplierHeader.jsx`
+  - `src/js/components/productSupplier/ProductSupplierListTable.jsx`
+  - `src/js/components/productSupplier/modals/PreferenceTypeModal.jsx`
+  - `src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx`
+  - `src/js/components/products/ProductsListHeader.jsx`
+  - `src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx`
+  - `src/js/components/purchaseOrder/PurchaseOrderListTable.jsx`
+  - `src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx`
+  - `src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx`
+
+- Verified with source scan:
+  - Remaining `hasFacilityStorekeeperPolicy|hasRegionalWarehousePolicy|hasRpcSuperuserPolicy|hasReportingUserPolicy` usages in `src/js` are reducer-only compatibility fields.
+
+### Canonical permission payload expansion
+
+- Extended backend/frontend permission payload with:
+  - `canCreateOutboundMovement`
+  - `canManageProducts`
+  - `canManagePurchasing`
+
+- Updated helper defaults and accessors in:
+  - `src/js/custom/roles/customRolePermissions.js`
+  - `src/js/reducers/sessionReducer.jsx`
+
+### Test updates
+
+- Added/updated frontend tests:
+  - `src/js/tests/custom/roles/customRolePermissions.test.js`
+  - `src/js/tests/stock-movement/StockMovementOutboundHeader.test.jsx`
+
+- Updated backend spec coverage:
+  - `src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy`
+  - `src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy`
+
+- Removed transactional unit test that was brittle in this unit-test context:
+  - `src/test/groovy/org/pih/warehouse/core/UserServiceCustomRolesSpec.groovy`
+  - Equivalent regression intent (location-chooser custom-role recognition) is covered by `CustomRolePolicyServiceSpec`.
+
+## Verification Status
+
+- Backend focused specs executed successfully:
+  - `./gradlew test --tests org.pih.warehouse.custom.roles.CustomRolePolicyServiceSpec --tests org.pih.warehouse.AuthTagLibCustomRolesSpec -x generateGitProperties`
+
+- Full branch verification executed in local user environment:
+  - Frontend (`nvm use 14`): `npm test` => `39 passed`, `6 skipped`, `0 failed`.
+  - Backend: `./gradlew test -Duser.language=en -Duser.country=US -Duser.timezone=UTC` passes for non-locale-dependent coverage; known locale-specific failures (7) are outside this change scope.
diff --git a/openspec/changes/archive/2026-05-22-custom-roles-refactor/proposal.md b/openspec/changes/archive/2026-05-22-custom-roles-refactor/proposal.md
new file mode 100644
index 00000000000..a31c5b408d3
--- /dev/null
+++ b/openspec/changes/archive/2026-05-22-custom-roles-refactor/proposal.md
@@ -0,0 +1,29 @@
+## Why
+
+The current custom-role implementation spreads authorization decisions across many upstream backend and frontend files, increasing merge risk and making policy mismatches likely. The review also identified missing coverage and concrete enforcement gaps, so the implementation needs a focused refactor before the custom-role surface grows further.
+
+## What Changes
+
+- Centralize custom-role authorization decisions in a dedicated backend policy service under `org.pih.warehouse.custom.*`.
+- Reduce upstream edits to narrow hook points that delegate to the custom policy service for interceptor checks, menu visibility, app-context/session permissions, GSP action visibility, and API/controller enforcement.
+- Move custom frontend permission helpers under `src/js/custom/*` and have React screens consume a canonical custom-role permission payload instead of repeating role-specific checks inline.
+- Close known authorization inconsistencies, including inbound movement creation through combined-shipment endpoints and reporting-user stocklist email visibility.
+- Preserve existing behavior for standard OpenBoxes roles and for users whose higher core roles should override custom-role restrictions.
+- Add backend and frontend regression coverage for custom-role policy resolution, menu/action visibility, direct URL/API enforcement, location chooser behavior, and frontend permission gates.
+
+## Capabilities
+
+### New Capabilities
+
+- `custom-role-policy-isolation`: Covers the maintainability contract for custom-role code isolation, canonical policy evaluation, and test coverage expectations.
+
+### Modified Capabilities
+
+- `custom-roles-access`: Tightens existing custom-role access requirements so every restricted workflow is denied consistently through UI, controller, and API paths, including combined-shipment inbound creation and stocklist email actions.
+
+## Impact
+
+- Affected backend areas include `RoleInterceptor`, `MegamenuService`, `AuthTagLib`, app-context/session payload generation, relevant controllers/APIs, and new custom service/tests under `org.pih.warehouse.custom.*`.
+- Affected frontend areas include role constants, custom permission helpers under `src/js/custom/*`, and React action/menu visibility call sites that currently duplicate role-specific conditions.
+- Test impact includes new or revised backend unit/integration tests and Jest/React Testing Library tests for custom-role UI gates.
+- No database schema or external dependency changes are expected.
diff --git a/openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-role-policy-isolation/spec.md b/openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-role-policy-isolation/spec.md
new file mode 100644
index 00000000000..17a6055c345
--- /dev/null
+++ b/openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-role-policy-isolation/spec.md
@@ -0,0 +1,41 @@
+## ADDED Requirements
+
+### Requirement: Custom role policy SHALL be isolated behind custom services and helpers
+The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy.
+
+#### Scenario: Custom backend policy is discoverable
+- **WHEN** a developer reviews backend custom-role authorization behavior
+- **THEN** the role matrix, endpoint restrictions, and menu/action capability decisions SHALL be implemented under `org.pih.warehouse.custom.*`
+- **AND** upstream backend files SHALL NOT contain duplicated custom-role matrices or role-specific endpoint lists
+
+#### Scenario: Custom frontend policy is discoverable
+- **WHEN** a developer reviews frontend custom-role action visibility
+- **THEN** custom-role permission helpers SHALL live under `src/js/custom/*`
+- **AND** React components outside `src/js/custom/*` SHALL consume those helpers or the canonical permission payload instead of repeating custom-role checks inline
+
+### Requirement: Custom role decisions SHALL use one canonical policy model
+The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, and frontend action gates from one canonical custom-role policy model.
+
+#### Scenario: Backend callers receive consistent decisions
+- **WHEN** the interceptor, menu service, taglibs, controllers, or app-context generation ask whether a custom-role user can perform an action
+- **THEN** they SHALL receive decisions derived from the same backend custom-role policy service
+
+#### Scenario: Frontend callers receive consistent decisions
+- **WHEN** React screens decide whether to render custom-role-sensitive actions
+- **THEN** they SHALL use backend-provided custom-role permissions through custom frontend helpers
+- **AND** the visible action SHALL match the backend enforcement decision for the same workflow
+
+### Requirement: Custom role behavior SHALL have regression coverage
+The system SHALL include automated regression tests for custom-role policy resolution, menu visibility, page action visibility, direct controller/API enforcement, location chooser behavior, and frontend permission helpers.
+
+#### Scenario: Policy matrix is covered by fast tests
+- **WHEN** backend unit tests run for the custom-role policy service
+- **THEN** they SHALL verify the allowed and denied module/action decisions for Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User
+
+#### Scenario: Direct access is covered by controller or integration tests
+- **WHEN** backend controller or integration tests run for restricted custom-role workflows
+- **THEN** they SHALL verify direct URL/API requests are denied even when the matching UI action is hidden
+
+#### Scenario: Frontend gates are covered by Jest tests
+- **WHEN** frontend tests run for custom-role permission helpers and representative action components
+- **THEN** they SHALL verify that restricted actions are hidden and allowed actions remain visible for the relevant custom-role permission payloads
diff --git a/openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-roles-access/spec.md b/openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-roles-access/spec.md
new file mode 100644
index 00000000000..b187b1fb4df
--- /dev/null
+++ b/openspec/changes/archive/2026-05-22-custom-roles-refactor/specs/custom-roles-access/spec.md
@@ -0,0 +1,121 @@
+## MODIFIED Requirements
+
+### Requirement: Facility Storekeeper SHALL follow the approved access matrix
+The system SHALL enforce the Facility Storekeeper policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | No access |
+| Inbound | Read/Write, except Create Inbound Movement is denied |
+| Outbound | No access |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | No access |
+
+#### Scenario: Facility Storekeeper cannot access purchasing
+- **WHEN** a Facility Storekeeper opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Facility Storekeeper cannot create inbound movements
+- **WHEN** a Facility Storekeeper opens the Inbound menu or calls an inbound-movement creation endpoint directly
+- **THEN** the Create Inbound Movement action SHALL be hidden
+- **AND** every direct inbound creation request SHALL be denied, including combined-shipment creation from purchase orders
+
+#### Scenario: Facility Storekeeper cannot access outbound or stocklists
+- **WHEN** a Facility Storekeeper opens the menu or calls outbound or stocklist controllers/APIs directly
+- **THEN** Outbound and Stocklists menu entries SHALL be hidden
+- **AND** direct outbound and stocklist requests SHALL be denied
+
+#### Scenario: Facility Storekeeper can manage inventory
+- **WHEN** a Facility Storekeeper performs an inventory read or write action
+- **THEN** the action SHALL be allowed when the user is authorized for the current location
+
+### Requirement: Regional Warehouse User SHALL follow the approved access matrix
+The system SHALL enforce the Regional Warehouse User policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read/Write |
+| Purchasing | No access |
+| Inbound | Read/Write, except Create Inbound Movement is denied |
+| Outbound | Read/Write |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | Read/Write |
+
+#### Scenario: Regional Warehouse User cannot access purchasing
+- **WHEN** a Regional Warehouse User opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Regional Warehouse User cannot create inbound movements
+- **WHEN** a Regional Warehouse User opens the Inbound menu or calls an inbound-movement creation endpoint directly
+- **THEN** the Create Inbound Movement action SHALL be hidden
+- **AND** every direct inbound creation request SHALL be denied, including combined-shipment creation from purchase orders
+
+#### Scenario: Regional Warehouse User can manage outbound and stocklists
+- **WHEN** a Regional Warehouse User performs outbound or stocklist read/write actions
+- **THEN** the actions SHALL be allowed when the user is authorized for the current location
+
+#### Scenario: Regional Warehouse User has read-only product access
+- **WHEN** a Regional Warehouse User opens product pages or calls product read endpoints
+- **THEN** read access SHALL be allowed
+- **AND** product create, update, import, preference, and delete actions SHALL be hidden or denied
+
+### Requirement: Reporting User SHALL follow the approved access matrix
+The system SHALL enforce the Reporting User policy:
+
+| Module | Access |
+| ------ | ------ |
+| Dashboard | Read |
+| Inventory | Read |
+| Purchasing | No access |
+| Inbound | Read |
+| Outbound | Read |
+| Reporting | Read |
+| Products | Read |
+| Stocklists | Read |
+
+#### Scenario: Reporting User cannot access purchasing
+- **WHEN** a Reporting User opens the application menu or calls a purchasing controller/API directly
+- **THEN** the Purchasing menu SHALL be hidden
+- **AND** the direct request SHALL be denied
+
+#### Scenario: Reporting User cannot perform write actions
+- **WHEN** a Reporting User calls inventory, inbound, outbound, product, or stocklist create/update/delete/status-changing endpoints
+- **THEN** the request SHALL be denied
+- **AND** matching write actions, including stocklist email, SHALL be hidden from server-rendered and React views
+
+#### Scenario: Reporting User can read operational data
+- **WHEN** a Reporting User opens dashboard, inventory, inbound, outbound, reporting, product, or stocklist read views
+- **THEN** the views SHALL be available when the user is authorized for the current location
+
+### Requirement: Custom role enforcement SHALL be applied consistently across UI and backend
+The system SHALL enforce custom role policy at menu visibility, page action visibility, server-rendered views, React views, controller interceptors, and API/controller endpoints. UI hiding SHALL improve usability but SHALL NOT be the only enforcement layer.
+
+#### Scenario: Hidden action is still denied by direct URL
+- **WHEN** a custom-role user calls a hidden action directly by URL or API
+- **THEN** the backend SHALL deny the request according to that role's policy
+
+#### Scenario: Allowed action remains visible and executable
+- **WHEN** a custom-role user opens a module with Read/Write access
+- **THEN** the allowed page actions SHALL be visible
+- **AND** the matching backend request SHALL be accepted
+
+#### Scenario: Higher core role takes precedence
+- **WHEN** a user has a custom role and also has Assistant, Manager, Admin, or Superuser access in the effective current-location roles
+- **THEN** the higher core role SHALL retain its existing authorization behavior
+- **AND** custom role restrictions SHALL NOT reduce that higher-role access
+
+#### Scenario: Unrelated existing roles are unchanged
+- **WHEN** a user has only pre-existing OpenBoxes roles
+- **THEN** authorization, menu visibility, and page actions SHALL behave as they did before this change
+
+#### Scenario: Location-scoped custom role can choose an authorized warehouse
+- **WHEN** a custom-role-only user has the role assigned only at a location and logs in without a remembered warehouse
+- **THEN** the location chooser SHALL return the authorized locations for that user
+- **AND** the user SHALL NOT need a global default role or remembered warehouse to select an authorized location
diff --git a/openspec/changes/archive/2026-05-22-custom-roles-refactor/tasks.md b/openspec/changes/archive/2026-05-22-custom-roles-refactor/tasks.md
new file mode 100644
index 00000000000..d890ec0294c
--- /dev/null
+++ b/openspec/changes/archive/2026-05-22-custom-roles-refactor/tasks.md
@@ -0,0 +1,52 @@
+## 1. Inventory Current Custom Role Surface
+
+- [x] 1.1 Search backend files for custom-role identifiers, custom-role helper methods, and role-specific controller/action checks.
+- [x] 1.2 Search frontend files for custom-role identifiers, permission helpers, and inline role checks.
+- [x] 1.3 Document the upstream hook points that must remain after refactor and the duplicated logic that should move into custom code.
+
+## 2. Backend Policy Isolation
+
+- [x] 2.1 Create a custom-role policy service under `org.pih.warehouse.custom.roles`.
+- [x] 2.2 Move the custom-role matrix and module/action capabilities into the custom policy service or custom policy data classes.
+- [x] 2.3 Add route classification for restricted controller/API workflows, including `stockMovement.createCombinedShipments` and `StockMovementApiController.createCombinedShipments`.
+- [x] 2.4 Implement effective custom-role resolution for the current location while preserving higher core-role precedence.
+- [x] 2.5 Add policy service methods for route access, menu visibility, page action visibility, GSP action visibility, and app-context permissions.
+
+## 3. Backend Hook Migration
+
+- [x] 3.1 Update `RoleInterceptor` to delegate custom-role route decisions to the custom policy service.
+- [x] 3.2 Update menu filtering to delegate custom-role menu decisions to the custom policy service.
+- [x] 3.3 Update taglib or GSP action visibility hooks to delegate custom-role action decisions to the custom policy service.
+- [x] 3.4 Update app-context/session payload generation to expose canonical custom-role permissions for frontend callers.
+- [x] 3.5 Remove duplicated custom-role matrices and endpoint lists from upstream backend files after each hook is delegated.
+- [x] 3.6 Validate the location chooser flow for location-scoped custom-role-only users without a remembered warehouse and adjust policy integration if needed.
+
+## 4. Frontend Policy Isolation
+
+- [x] 4.1 Create custom frontend role permission helpers under `src/js/custom/roles`.
+- [x] 4.2 Update React role/action visibility call sites to consume the canonical permission payload through custom helpers.
+- [x] 4.3 Hide inbound creation actions for Facility Storekeeper and Regional Warehouse users, including combined-shipment creation from purchase orders.
+- [x] 4.4 Hide stocklist email actions for Reporting User wherever the stocklist summary/action UI is rendered.
+- [x] 4.5 Remove duplicated custom-role checks from non-custom frontend files once callers use the custom helpers.
+
+## 5. Backend Test Coverage
+
+- [x] 5.1 Add unit tests for the custom-role policy matrix for all four custom roles.
+- [x] 5.2 Add unit tests for higher core-role precedence and unrelated existing-role behavior.
+- [x] 5.3 Add tests for route classification and direct denial of restricted workflows, including combined-shipment inbound creation.
+- [x] 5.4 Add tests for menu visibility and server-rendered action visibility decisions.
+- [x] 5.5 Add a regression test for location chooser access by a location-scoped custom-role-only user without a remembered warehouse.
+
+## 6. Frontend Test Coverage
+
+- [x] 6.1 Add Jest tests for custom frontend permission helpers using representative permission payloads.
+- [x] 6.2 Add React component tests for representative hidden and visible actions for custom-role users.
+- [x] 6.3 Add regression coverage that Reporting User does not see the stocklist email action.
+- [x] 6.4 Add regression coverage that Facility Storekeeper and Regional Warehouse users do not see inbound creation or combined-shipment creation actions.
+
+## 7. Verification
+
+- [x] 7.1 Run focused backend tests for custom-role policy and affected controllers/services.
+- [x] 7.2 Run focused frontend Jest tests for custom-role helpers and affected components.
+- [x] 7.3 Run broader backend and frontend test commands as practical for the branch.
+- [x] 7.4 Review remaining upstream-file diffs and confirm custom-role logic is isolated except for narrow delegation hooks.
diff --git a/openspec/specs/custom-role-policy-isolation/spec.md b/openspec/specs/custom-role-policy-isolation/spec.md
new file mode 100644
index 00000000000..1db591cd3c2
--- /dev/null
+++ b/openspec/specs/custom-role-policy-isolation/spec.md
@@ -0,0 +1,45 @@
+# custom-role-policy-isolation Specification
+
+## Purpose
+TBD - created by archiving change custom-roles-refactor. Update Purpose after archive.
+## Requirements
+### Requirement: Custom role policy SHALL be isolated behind custom services and helpers
+The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy.
+
+#### Scenario: Custom backend policy is discoverable
+- **WHEN** a developer reviews backend custom-role authorization behavior
+- **THEN** the role matrix, endpoint restrictions, and menu/action capability decisions SHALL be implemented under `org.pih.warehouse.custom.*`
+- **AND** upstream backend files SHALL NOT contain duplicated custom-role matrices or role-specific endpoint lists
+
+#### Scenario: Custom frontend policy is discoverable
+- **WHEN** a developer reviews frontend custom-role action visibility
+- **THEN** custom-role permission helpers SHALL live under `src/js/custom/*`
+- **AND** React components outside `src/js/custom/*` SHALL consume those helpers or the canonical permission payload instead of repeating custom-role checks inline
+
+### Requirement: Custom role decisions SHALL use one canonical policy model
+The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, and frontend action gates from one canonical custom-role policy model.
+
+#### Scenario: Backend callers receive consistent decisions
+- **WHEN** the interceptor, menu service, taglibs, controllers, or app-context generation ask whether a custom-role user can perform an action
+- **THEN** they SHALL receive decisions derived from the same backend custom-role policy service
+
+#### Scenario: Frontend callers receive consistent decisions
+- **WHEN** React screens decide whether to render custom-role-sensitive actions
+- **THEN** they SHALL use backend-provided custom-role permissions through custom frontend helpers
+- **AND** the visible action SHALL match the backend enforcement decision for the same workflow
+
+### Requirement: Custom role behavior SHALL have regression coverage
+The system SHALL include automated regression tests for custom-role policy resolution, menu visibility, page action visibility, direct controller/API enforcement, location chooser behavior, and frontend permission helpers.
+
+#### Scenario: Policy matrix is covered by fast tests
+- **WHEN** backend unit tests run for the custom-role policy service
+- **THEN** they SHALL verify the allowed and denied module/action decisions for Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User
+
+#### Scenario: Direct access is covered by controller or integration tests
+- **WHEN** backend controller or integration tests run for restricted custom-role workflows
+- **THEN** they SHALL verify direct URL/API requests are denied even when the matching UI action is hidden
+
+#### Scenario: Frontend gates are covered by Jest tests
+- **WHEN** frontend tests run for custom-role permission helpers and representative action components
+- **THEN** they SHALL verify that restricted actions are hidden and allowed actions remain visible for the relevant custom-role permission payloads
+
diff --git a/openspec/specs/custom-roles-access/spec.md b/openspec/specs/custom-roles-access/spec.md
index 97720e37f2e..61eda46dc68 100644
--- a/openspec/specs/custom-roles-access/spec.md
+++ b/openspec/specs/custom-roles-access/spec.md
@@ -1,13 +1,12 @@
 # custom-roles-access
 
-> Capability: fixed custom-role authorization policies for the four customer roles,
-> including menu visibility, page action visibility, controller/API enforcement,
-> seeded role records, and role constants.
->
-> Source change: `openspec/changes/archive/2026-05-21-custom-roles/`
+## Purpose
+Define fixed custom-role authorization policies for the four customer roles,
+including menu visibility, page action visibility, controller/API enforcement,
+seeded role records, and role constants.
 
+Source change: `openspec/changes/archive/2026-05-21-custom-roles/`
 ## Requirements
-
 ### Requirement: Custom operational roles SHALL be assignable role types
 The system SHALL define and seed assignable role records for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, and `ROLE_REPORTING_USER`. The backend `RoleType` enum and frontend role constants SHALL expose the same role identifiers.
 
@@ -41,7 +40,7 @@ The system SHALL enforce the Facility Storekeeper policy:
 #### Scenario: Facility Storekeeper cannot create inbound movements
 - **WHEN** a Facility Storekeeper opens the Inbound menu or calls an inbound-movement creation endpoint directly
 - **THEN** the Create Inbound Movement action SHALL be hidden
-- **AND** the direct creation request SHALL be denied
+- **AND** every direct inbound creation request SHALL be denied, including combined-shipment creation from purchase orders
 
 #### Scenario: Facility Storekeeper cannot access outbound or stocklists
 - **WHEN** a Facility Storekeeper opens the menu or calls outbound or stocklist controllers/APIs directly
@@ -74,7 +73,7 @@ The system SHALL enforce the Regional Warehouse User policy:
 #### Scenario: Regional Warehouse User cannot create inbound movements
 - **WHEN** a Regional Warehouse User opens the Inbound menu or calls an inbound-movement creation endpoint directly
 - **THEN** the Create Inbound Movement action SHALL be hidden
-- **AND** the direct creation request SHALL be denied
+- **AND** every direct inbound creation request SHALL be denied, including combined-shipment creation from purchase orders
 
 #### Scenario: Regional Warehouse User can manage outbound and stocklists
 - **WHEN** a Regional Warehouse User performs outbound or stocklist read/write actions
@@ -133,6 +132,7 @@ The system SHALL enforce the Reporting User policy:
 #### Scenario: Reporting User cannot perform write actions
 - **WHEN** a Reporting User calls inventory, inbound, outbound, product, or stocklist create/update/delete/status-changing endpoints
 - **THEN** the request SHALL be denied
+- **AND** matching write actions, including stocklist email, SHALL be hidden from server-rendered and React views
 
 #### Scenario: Reporting User can read operational data
 - **WHEN** a Reporting User opens dashboard, inventory, inbound, outbound, reporting, product, or stocklist read views
@@ -158,3 +158,9 @@ The system SHALL enforce custom role policy at menu visibility, page action visi
 #### Scenario: Unrelated existing roles are unchanged
 - **WHEN** a user has only pre-existing OpenBoxes roles
 - **THEN** authorization, menu visibility, and page actions SHALL behave as they did before this change
+
+#### Scenario: Location-scoped custom role can choose an authorized warehouse
+- **WHEN** a custom-role-only user has the role assigned only at a location and logs in without a remembered warehouse
+- **THEN** the location chooser SHALL return the authorized locations for that user
+- **AND** the user SHALL NOT need a global default role or remembered warehouse to select an authorized location
+
diff --git a/src/js/components/productSupplier/ProductSupplierHeader.jsx b/src/js/components/productSupplier/ProductSupplierHeader.jsx
index d7580abd0f5..b746d1774ee 100644
--- a/src/js/components/productSupplier/ProductSupplierHeader.jsx
+++ b/src/js/components/productSupplier/ProductSupplierHeader.jsx
@@ -1,5 +1,6 @@
 import React from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import { useSelector } from 'react-redux';
 
 import Button from 'components/form-elements/Button';
@@ -11,12 +12,13 @@ import HeaderButtonsWrapper from 'wrappers/HeaderButtonsWrapper';
 import HeaderWrapper from 'wrappers/HeaderWrapper';
 
 const ProductSupplierHeader = () => {
-  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const customRolePermissions = useSelector((state) => state.session.customRolePermissions);
   const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
-  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+  const canManageProducts = hasProductManagerPermissions || permissions.canManageProducts;
 
   return (
     <HeaderWrapper>
diff --git a/src/js/components/productSupplier/ProductSupplierListTable.jsx b/src/js/components/productSupplier/ProductSupplierListTable.jsx
index 31a251247bf..aa54c599764 100644
--- a/src/js/components/productSupplier/ProductSupplierListTable.jsx
+++ b/src/js/components/productSupplier/ProductSupplierListTable.jsx
@@ -1,5 +1,6 @@
 import React, { useMemo } from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import { RiDownload2Line } from 'react-icons/ri';
 import { useSelector } from 'react-redux';
@@ -32,12 +33,13 @@ const ProductSupplierListTable = ({ filterParams }) => {
     exportProductSuppliers,
   } = useProductSupplierActions({ fireFetchData, filterParams });
 
-  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const customRolePermissions = useSelector((state) => state.session.customRolePermissions);
   const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
-  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+  const canManageProducts = hasProductManagerPermissions || permissions.canManageProducts;
 
   const columns = useMemo(() => [
     {
@@ -194,7 +196,7 @@ const ProductSupplierListTable = ({ filterParams }) => {
         />
       ),
     },
-  ], []);
+  ], [canManageProducts, getActions]);
 
   return (
     <ListTableWrapper>
diff --git a/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx b/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx
index c6687baa3b8..ed64b228450 100644
--- a/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx
+++ b/src/js/components/productSupplier/modals/PreferenceTypeModal.jsx
@@ -1,5 +1,6 @@
 import React, { useEffect } from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import _ from 'lodash';
 import PropTypes from 'prop-types';
 import { RiCloseFill } from 'react-icons/all';
@@ -18,12 +19,13 @@ const PreferenceTypeModal = ({
   modalData,
   productSupplierId,
 }) => {
-  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const customRolePermissions = useSelector((state) => state.session.customRolePermissions);
   const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
-  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+  const canManageProducts = hasProductManagerPermissions || permissions.canManageProducts;
 
   useEffect(() => {
     if (isOpen) {
diff --git a/src/js/components/products/ProductsListHeader.jsx b/src/js/components/products/ProductsListHeader.jsx
index 60b8d47e938..3f92a5d542d 100644
--- a/src/js/components/products/ProductsListHeader.jsx
+++ b/src/js/components/products/ProductsListHeader.jsx
@@ -1,5 +1,6 @@
 import React from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import { connect } from 'react-redux';
 
@@ -7,40 +8,50 @@ import Button from 'components/form-elements/Button';
 import { PRODUCT_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const ProductsListHeader = ({ isUserAdmin, hasRpcSuperuserPolicy }) => (
-  <div className="d-flex list-page-header">
-    <span className="d-flex align-self-center title">
-      <Translate id="react.productsList.header.label" defaultMessage="Product List" />
-    </span>
-    {(isUserAdmin || hasRpcSuperuserPolicy)
-      && (
-      <div className="d-flex justify-content-end buttons align-items-center">
-        <a href={PRODUCT_URL.importCSV()}>
-          <Button
-            defaultLabel="Import products"
-            label="react.productsList.importProducts.label"
-            variant="primary-outline"
-          />
-        </a>
-        <a href={PRODUCT_URL.create()}>
-          <Button
-            defaultLabel="Add product"
-            label="react.productsList.addProduct.label"
-          />
-        </a>
-      </div>
-      )}
-  </div>
-);
+const ProductsListHeader = ({ isUserAdmin, customRolePermissions }) => {
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+  return (
+    <div className="d-flex list-page-header">
+      <span className="d-flex align-self-center title">
+        <Translate id="react.productsList.header.label" defaultMessage="Product List" />
+      </span>
+      {(isUserAdmin || permissions.canManageProducts)
+        && (
+        <div className="d-flex justify-content-end buttons align-items-center">
+          <a href={PRODUCT_URL.importCSV()}>
+            <Button
+              defaultLabel="Import products"
+              label="react.productsList.importProducts.label"
+              variant="primary-outline"
+            />
+          </a>
+          <a href={PRODUCT_URL.create()}>
+            <Button
+              defaultLabel="Add product"
+              label="react.productsList.addProduct.label"
+            />
+          </a>
+        </div>
+        )}
+    </div>
+  );
+};
 
 const mapStateToProps = (state) => ({
   isUserAdmin: state.session.isUserAdmin,
-  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
+  customRolePermissions: state.session.customRolePermissions,
 });
 
 export default connect(mapStateToProps)(ProductsListHeader);
 
 ProductsListHeader.propTypes = {
   isUserAdmin: PropTypes.bool.isRequired,
-  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canManageProducts: PropTypes.bool,
+  }),
+};
+
+ProductsListHeader.defaultProps = {
+  customRolePermissions: undefined,
 };
diff --git a/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx b/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx
index 537466524ec..c812e4d5563 100644
--- a/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx
+++ b/src/js/components/purchaseOrder/PurchaseOrderListHeader.jsx
@@ -1,5 +1,6 @@
 import React from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import { connect } from 'react-redux';
 import { withRouter } from 'react-router-dom';
@@ -11,37 +12,41 @@ import Translate from 'utils/Translate';
 const PurchaseOrderListHeader = ({
   history,
   supportedActivities,
-  hasFacilityStorekeeperPolicy,
-}) => (
-  <div className="d-flex list-page-header">
-    <span className="d-flex align-self-center title">
-      <Translate id="react.purchaseOrder.list.label" defaultMessage="Purchase Order List" />
-    </span>
-    <div className="d-flex justify-content-end buttons align-items-center">
-      {!hasFacilityStorekeeperPolicy && (
-      <Button
-        defaultLabel="Create Shipment from PO"
-        label="react.purchaseOrder.createShipmentFromPo.label"
-        onClick={() => history.push({ pathname: STOCK_MOVEMENT_URL.createCombinedShipments(), search: 'direction=INBOUND' })}
-      />
-      )}
-      {supportedActivities.includes('PLACE_ORDER') && !hasFacilityStorekeeperPolicy
-        && (
-        <a href={ORDER_URL.create()}>
+  customRolePermissions,
+}) => {
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+
+  return (
+    <div className="d-flex list-page-header">
+      <span className="d-flex align-self-center title">
+        <Translate id="react.purchaseOrder.list.label" defaultMessage="Purchase Order List" />
+      </span>
+      <div className="d-flex justify-content-end buttons align-items-center">
+        {permissions.canCreateInboundFromPurchaseOrder && (
           <Button
-            defaultLabel="Create Order"
-            label="react.purchaseOrder.createOrder.label"
+            defaultLabel="Create Shipment from PO"
+            label="react.purchaseOrder.createShipmentFromPo.label"
+            onClick={() => history.push({ pathname: STOCK_MOVEMENT_URL.createCombinedShipments(), search: 'direction=INBOUND' })}
           />
-        </a>
         )}
+        {supportedActivities.includes('PLACE_ORDER') && permissions.canManagePurchasing
+          && (
+          <a href={ORDER_URL.create()}>
+            <Button
+              defaultLabel="Create Order"
+              label="react.purchaseOrder.createOrder.label"
+            />
+          </a>
+          )}
 
+      </div>
     </div>
-  </div>
-);
+  );
+};
 
 const mapStateToProps = (state) => ({
   supportedActivities: state.session.supportedActivities,
-  hasFacilityStorekeeperPolicy: state.session.hasFacilityStorekeeperPolicy,
+  customRolePermissions: state.session.customRolePermissions,
 });
 
 export default withRouter(connect(mapStateToProps)(PurchaseOrderListHeader));
@@ -51,9 +56,13 @@ PurchaseOrderListHeader.propTypes = {
     push: PropTypes.func.isRequired,
   }).isRequired,
   supportedActivities: PropTypes.arrayOf(PropTypes.string).isRequired,
-  hasFacilityStorekeeperPolicy: PropTypes.bool,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canCreateInboundFromPurchaseOrder: PropTypes.bool,
+    canManagePurchasing: PropTypes.bool,
+  }),
 };
 
 PurchaseOrderListHeader.defaultProps = {
-  hasFacilityStorekeeperPolicy: false,
+  customRolePermissions: undefined,
 };
diff --git a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
index a3406551416..d41057f2b8d 100644
--- a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
+++ b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
@@ -1,5 +1,6 @@
 import React, { useMemo } from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import {
   RiArrowGoBackLine,
@@ -32,8 +33,7 @@ import 'react-confirm-alert/src/react-confirm-alert.css';
 const PurchaseOrderListTable = ({
   supportedActivities,
   highestRole,
-  hasRpcSuperuserPolicy,
-  hasFacilityStorekeeperPolicy,
+  customRolePermissions,
   translate,
   currencyCode,
   allStatuses,
@@ -51,7 +51,10 @@ const PurchaseOrderListTable = ({
     downloadOrders,
     onFetchHandler,
   } = usePurchaseOrderListTableData(filterParams);
-  const effectiveHighestRole = hasRpcSuperuserPolicy ? 'Superuser' : highestRole;
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+  const effectiveHighestRole = permissions.activeCustomRolePolicy === 'ROLE_RPC_SUPERUSER'
+    ? 'Superuser'
+    : highestRole;
 
   const getStatusTooltip = (status) => translate(
     `react.purchaseOrder.status.${status.toLowerCase()}.description.label`,
@@ -84,7 +87,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.edit.label',
       defaultLabel: 'Edit order',
       leftIcon: <RiPencilLine />,
-      hiddenForFacilityStorekeeper: true,
+      requiresPurchasingWrite: true,
       statuses: ['PENDING'],
       activityCode: ['PLACE_ORDER'],
       href: PURCHASE_ORDER_URL.edit,
@@ -93,7 +96,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.editLineItems.label',
       defaultLabel: 'Edit line items',
       leftIcon: <RiListUnordered />,
-      hiddenForFacilityStorekeeper: true,
+      requiresPurchasingWrite: true,
       statuses: ['PENDING'],
       activityCode: ['PLACE_ORDER'],
       href: PURCHASE_ORDER_URL.addItems,
@@ -102,7 +105,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.placeOrder.label',
       defaultLabel: 'Place order',
       leftIcon: <RiShoppingCartLine />,
-      hiddenForFacilityStorekeeper: true,
+      requiresPurchasingWrite: true,
       statuses: ['PENDING'],
       activityCode: ['PLACE_ORDER'],
       href: ORDER_URL.placeOrder,
@@ -118,7 +121,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.cancelOrder.label',
       defaultLabel: 'Cancel order',
       leftIcon: <RiCloseLine />,
-      hiddenForFacilityStorekeeper: true,
+      requiresPurchasingWrite: true,
       activityCode: ['PLACE_ORDER'],
       onClick: () => cancelOrder(),
     },
@@ -126,7 +129,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.rollbackOrder.label',
       defaultLabel: 'Rollback Order',
       leftIcon: <RiArrowGoBackLine />,
-      hiddenForFacilityStorekeeper: true,
+      requiresPurchasingWrite: true,
       minimumRequiredRole: 'Superuser',
       activityCode: ['PLACE_ORDER'],
       // Display for statuses > PENDING
@@ -138,7 +141,7 @@ const PurchaseOrderListTable = ({
       label: 'react.purchaseOrder.delete.label',
       defaultLabel: 'Delete',
       leftIcon: <RiDeleteBinLine />,
-      hiddenForFacilityStorekeeper: true,
+      requiresPurchasingWrite: true,
       minimumRequiredRole: 'Assistant',
       variant: 'danger',
       onClick: (id) => deleteHandler(id),
@@ -164,7 +167,7 @@ const PurchaseOrderListTable = ({
             supportedActivities,
             highestRole: effectiveHighestRole,
             customFilter: (action) =>
-              !(hasFacilityStorekeeperPolicy && action.hiddenForFacilityStorekeeper),
+              permissions.canManagePurchasing || !action.requiresPurchasingWrite,
           })}
           id={row.original.id}
         />
@@ -314,7 +317,7 @@ const PurchaseOrderListTable = ({
       sortable: false,
       minWidth: 260,
     },
-  ], [supportedActivities, effectiveHighestRole, actions, hasFacilityStorekeeperPolicy]);
+  ], [supportedActivities, effectiveHighestRole, actions, permissions.canManagePurchasing]);
 
   const totalAmount = () => `${translate('react.purchaseOrder.totalAmount.label', 'Total amount')}: ${tableData.totalPrice.toLocaleString([locale, 'en'])} ${currencyCode}`;
 
@@ -386,8 +389,7 @@ const PurchaseOrderListTable = ({
 const mapStateToProps = (state) => ({
   supportedActivities: state.session.supportedActivities,
   highestRole: state.session.highestRole,
-  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
-  hasFacilityStorekeeperPolicy: state.session.hasFacilityStorekeeperPolicy,
+  customRolePermissions: state.session.customRolePermissions,
   translate: translateWithDefaultMessage(getTranslate(state.localize)),
   currencyCode: state.session.currencyCode,
   allStatuses: state.purchaseOrder.statuses,
@@ -400,8 +402,10 @@ PurchaseOrderListTable.propTypes = {
   filterParams: PropTypes.shape({}).isRequired,
   supportedActivities: PropTypes.arrayOf(PropTypes.string).isRequired,
   highestRole: PropTypes.string.isRequired,
-  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
-  hasFacilityStorekeeperPolicy: PropTypes.bool,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canManagePurchasing: PropTypes.bool,
+  }),
   translate: PropTypes.func.isRequired,
   currencyCode: PropTypes.string.isRequired,
   allStatuses: PropTypes.arrayOf(PropTypes.shape({
@@ -414,5 +418,5 @@ PurchaseOrderListTable.propTypes = {
 };
 
 PurchaseOrderListTable.defaultProps = {
-  hasFacilityStorekeeperPolicy: false,
+  customRolePermissions: undefined,
 };
diff --git a/src/js/components/stock-list-management/StocklistManagement.jsx b/src/js/components/stock-list-management/StocklistManagement.jsx
index a422f75c3be..486cd5ed7e7 100644
--- a/src/js/components/stock-list-management/StocklistManagement.jsx
+++ b/src/js/components/stock-list-management/StocklistManagement.jsx
@@ -1,5 +1,6 @@
 import React, { Component } from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import update from 'immutability-helper';
 import _ from 'lodash';
 import PropTypes from 'prop-types';
@@ -222,9 +223,8 @@ class StocklistManagement extends Component {
 
   render() {
     const { data } = this.state;
-    const canWriteStocklists = this.props.isUserAdmin
-      || this.props.hasRegionalWarehousePolicy
-      || this.props.hasRpcSuperuserPolicy;
+    const permissions = getCustomRolePermissions({ customRolePermissions: this.props.customRolePermissions });
+    const canWriteStocklists = this.props.isUserAdmin || permissions.canManageStocklists;
     return (
       <div className="main-container">
         { this.state.productInfo
@@ -635,8 +635,7 @@ const mapStateToProps = (state) => ({
   locale: state.session.activeLanguage,
   stockListManagementTranslationsFetched: state.session.fetchedTranslations.stockListManagement,
   isUserAdmin: state.session.isUserAdmin,
-  hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
-  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
+  customRolePermissions: state.session.customRolePermissions,
 });
 
 export default connect(mapStateToProps, {
@@ -657,6 +656,12 @@ StocklistManagement.propTypes = {
   stockListManagementTranslationsFetched: PropTypes.bool.isRequired,
   fetchTranslations: PropTypes.func.isRequired,
   isUserAdmin: PropTypes.bool.isRequired,
-  hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
-  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canManageStocklists: PropTypes.bool,
+  }),
+};
+
+StocklistManagement.defaultProps = {
+  customRolePermissions: undefined,
 };
diff --git a/src/js/components/stock-list/StockListHeader.jsx b/src/js/components/stock-list/StockListHeader.jsx
index 51624d4f416..334f857c668 100644
--- a/src/js/components/stock-list/StockListHeader.jsx
+++ b/src/js/components/stock-list/StockListHeader.jsx
@@ -1,38 +1,48 @@
 import React from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import { connect } from 'react-redux';
 
 import { REQUISITION_TEMPLATE_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const StockListHeader = ({ isUserAdmin, hasRegionalWarehousePolicy, hasRpcSuperuserPolicy }) => (
-  <div className="d-flex list-page-header">
-    <span className="d-flex align-self-center title">
-      <Translate id="react.stocklists.header.label" defaultMessage="Stock List" />
-    </span>
-    <div className="d-flex justify-content-end buttons align-items-center">
-      {
-        (isUserAdmin || hasRegionalWarehousePolicy || hasRpcSuperuserPolicy) && (
-          <a className="primary-button" href={`${REQUISITION_TEMPLATE_URL.create()}?type=STOCK`}>
-            <Translate id="react.stocklists.addStockList.label" defaultMessage="Add stocklist" />
-          </a>
-        )
-      }
+const StockListHeader = ({ isUserAdmin, customRolePermissions }) => {
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+
+  return (
+    <div className="d-flex list-page-header">
+      <span className="d-flex align-self-center title">
+        <Translate id="react.stocklists.header.label" defaultMessage="Stock List" />
+      </span>
+      <div className="d-flex justify-content-end buttons align-items-center">
+        {
+          (isUserAdmin || permissions.canManageStocklists) && (
+            <a className="primary-button" href={`${REQUISITION_TEMPLATE_URL.create()}?type=STOCK`}>
+              <Translate id="react.stocklists.addStockList.label" defaultMessage="Add stocklist" />
+            </a>
+          )
+        }
+      </div>
     </div>
-  </div>
-);
+  );
+};
 
 const mapStateToProps = (state) => ({
   isUserAdmin: state.session.isUserAdmin,
-  hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
-  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
+  customRolePermissions: state.session.customRolePermissions,
 });
 
 export default connect(mapStateToProps)(StockListHeader);
 
 StockListHeader.propTypes = {
   isUserAdmin: PropTypes.bool.isRequired,
-  hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
-  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canManageStocklists: PropTypes.bool,
+  }),
+};
+
+StockListHeader.defaultProps = {
+  customRolePermissions: undefined,
 };
diff --git a/src/js/components/stock-list/StockListTable.jsx b/src/js/components/stock-list/StockListTable.jsx
index 56ad51c17cf..f7a867d62a8 100644
--- a/src/js/components/stock-list/StockListTable.jsx
+++ b/src/js/components/stock-list/StockListTable.jsx
@@ -1,5 +1,6 @@
 import React, { useMemo } from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import {
   RiDeleteBinLine,
@@ -32,8 +33,7 @@ const StockListTable = ({
   filterParams,
   translate,
   highestRole,
-  hasRegionalWarehousePolicy,
-  hasRpcSuperuserPolicy,
+  customRolePermissions,
 }) => {
   const {
     tableData,
@@ -49,11 +49,12 @@ const StockListTable = ({
     exportStockListItems,
   } = useStockListTableData(filterParams);
 
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+
   const customActionFilter = ({ isPublished, requiresStocklistWrite }, row) => {
-    const canWriteStocklists = hasRegionalWarehousePolicy ||
-      hasRpcSuperuserPolicy ||
-      highestRole === 'Admin' ||
-      highestRole === 'Superuser';
+    const canWriteStocklists = permissions.canManageStocklists
+      || highestRole === 'Admin'
+      || highestRole === 'Superuser';
     if (requiresStocklistWrite && !canWriteStocklists) return false;
     // skip actions that don't have isPublished property
     if (isPublished === undefined) return true;
@@ -232,7 +233,7 @@ const StockListTable = ({
       accessor: 'lastUpdated',
       width: 150,
     },
-  ], [highestRole, hasRegionalWarehousePolicy, hasRpcSuperuserPolicy]);
+  ], [highestRole, permissions.canManageStocklists]);
 
   return (
     <div className="list-page-list-section">
@@ -272,8 +273,7 @@ const StockListTable = ({
 const mapStateToProps = (state) => ({
   translate: translateWithDefaultMessage(getTranslate(state.localize)),
   highestRole: state.session.highestRole,
-  hasRegionalWarehousePolicy: state.session.hasRegionalWarehousePolicy,
-  hasRpcSuperuserPolicy: state.session.hasRpcSuperuserPolicy,
+  customRolePermissions: state.session.customRolePermissions,
 });
 
 export default connect(mapStateToProps)(StockListTable);
@@ -282,6 +282,12 @@ StockListTable.propTypes = {
   filterParams: PropTypes.shape({}).isRequired,
   translate: PropTypes.func.isRequired,
   highestRole: PropTypes.string.isRequired,
-  hasRegionalWarehousePolicy: PropTypes.bool.isRequired,
-  hasRpcSuperuserPolicy: PropTypes.bool.isRequired,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canManageStocklists: PropTypes.bool,
+  }),
+};
+
+StockListTable.defaultProps = {
+  customRolePermissions: undefined,
 };
diff --git a/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx b/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx
index 9f636827597..381ead3ad1e 100644
--- a/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx
+++ b/src/js/components/stock-movement/inbound/StockMovementInboundHeader.jsx
@@ -1,5 +1,6 @@
 import React from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import { Link } from 'react-router-dom';
 
@@ -7,51 +8,59 @@ import Button from 'components/form-elements/Button';
 import { STOCK_MOVEMENT_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const StockMovementInboundHeader = ({ showMyStockMovements, hasReportingUserPolicy }) => (
-  <div className="d-flex list-page-header">
-    <span className="d-flex align-self-center title">
-      <Translate id="react.stockMovement.inbound.list.label" defaultMessage="Inbound Movement List" />
-    </span>
-    <div className="d-flex justify-content-end buttons align-items-center">
-      <Button
-        defaultLabel="My Stock Movements"
-        variant="primary-outline"
-        label="react.stockMovement.myStockMovement.label"
-        onClick={showMyStockMovements}
-      />
-      {!hasReportingUserPolicy && (
-        <Link
-          className="primary-button"
-          to={{ pathname: STOCK_MOVEMENT_URL.createCombinedShipments(), search: 'direction=INBOUND' }}
-        >
-          <Translate
-            id="react.stockMovement.createShipmentFromPO.label"
-            defaultMessage="Create Shipment from PO"
-          />
-        </Link>
-      )}
-      {!hasReportingUserPolicy && (
-        <Link
-          className="primary-button"
-          to={STOCK_MOVEMENT_URL.createInbound()}
-        >
-          <Translate
-            id="react.stockMovement.createStockMovement.label"
-            defaultMessage="Create Stock Movement"
-          />
-        </Link>
-      )}
+const StockMovementInboundHeader = ({ showMyStockMovements, customRolePermissions }) => {
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+
+  return (
+    <div className="d-flex list-page-header">
+      <span className="d-flex align-self-center title">
+        <Translate id="react.stockMovement.inbound.list.label" defaultMessage="Inbound Movement List" />
+      </span>
+      <div className="d-flex justify-content-end buttons align-items-center">
+        <Button
+          defaultLabel="My Stock Movements"
+          variant="primary-outline"
+          label="react.stockMovement.myStockMovement.label"
+          onClick={showMyStockMovements}
+        />
+        {permissions.canCreateInboundFromPurchaseOrder && (
+          <Link
+            className="primary-button"
+            to={{ pathname: STOCK_MOVEMENT_URL.createCombinedShipments(), search: 'direction=INBOUND' }}
+          >
+            <Translate
+              id="react.stockMovement.createShipmentFromPO.label"
+              defaultMessage="Create Shipment from PO"
+            />
+          </Link>
+        )}
+        {permissions.canCreateInboundMovement && (
+          <Link
+            className="primary-button"
+            to={STOCK_MOVEMENT_URL.createInbound()}
+          >
+            <Translate
+              id="react.stockMovement.createStockMovement.label"
+              defaultMessage="Create Stock Movement"
+            />
+          </Link>
+        )}
+      </div>
     </div>
-  </div>
-);
+  );
+};
 
 StockMovementInboundHeader.propTypes = {
   showMyStockMovements: PropTypes.func.isRequired,
-  hasReportingUserPolicy: PropTypes.bool,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canCreateInboundMovement: PropTypes.bool,
+    canCreateInboundFromPurchaseOrder: PropTypes.bool,
+  }),
 };
 
 StockMovementInboundHeader.defaultProps = {
-  hasReportingUserPolicy: false,
+  customRolePermissions: undefined,
 };
 
 export default StockMovementInboundHeader;
diff --git a/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx b/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx
index c24ad978860..968b82222d9 100644
--- a/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx
+++ b/src/js/components/stock-movement/inbound/StockMovementInboundList.jsx
@@ -26,7 +26,7 @@ const StockMovementInboundList = (props) => {
     <div className="d-flex flex-column list-page-main">
       <StockMovementInboundHeader
         showMyStockMovements={selectFiltersForMyStockMovements}
-        hasReportingUserPolicy={props.hasReportingUserPolicy}
+        customRolePermissions={props.customRolePermissions}
       />
       <StockMovementInboundFilters
         defaultValues={defaultFilterValues}
@@ -46,7 +46,7 @@ const mapStateToProps = (state) => ({
   shipmentStatuses: state.shipmentStatuses.data,
   isShipmentStatusesFetched: state.shipmentStatuses.fetched,
   shipmentTypes: state.stockMovementCommon.shipmentTypes,
-  hasReportingUserPolicy: state.session.hasReportingUserPolicy,
+  customRolePermissions: state.session.customRolePermissions,
 });
 
 export default withRouter(connect(mapStateToProps, {
@@ -66,9 +66,13 @@ StockMovementInboundList.propTypes = {
     label: PropTypes.string,
     description: PropTypes.string,
   })).isRequired,
-  hasReportingUserPolicy: PropTypes.bool,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canCreateInboundMovement: PropTypes.bool,
+    canCreateInboundFromPurchaseOrder: PropTypes.bool,
+  }),
 };
 
 StockMovementInboundList.defaultProps = {
-  hasReportingUserPolicy: false,
+  customRolePermissions: undefined,
 };
diff --git a/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx b/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx
index 3507b45b482..9821035f600 100644
--- a/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx
+++ b/src/js/components/stock-movement/outbound/StockMovementOutboundHeader.jsx
@@ -1,5 +1,6 @@
 import React from 'react';
 
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 import PropTypes from 'prop-types';
 import { Link } from 'react-router-dom';
 
@@ -10,56 +11,62 @@ import Translate from 'utils/Translate';
 const StockMovementOutboundHeader = ({
   showMyStockMovements,
   isRequestsOpen,
-  hasReportingUserPolicy,
-}) => (
-  <div className="d-flex list-page-header">
-    <span className="d-flex align-self-center title">
-      {
-        isRequestsOpen
-          ? (
+  customRolePermissions,
+}) => {
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+  return (
+    <div className="d-flex list-page-header">
+      <span className="d-flex align-self-center title">
+        {
+          isRequestsOpen
+            ? (
+              <Translate
+                id="react.stockMovement.request.list.label"
+                defaultMessage="Request List"
+              />
+            )
+            : (
+              <Translate
+                id="react.stockMovement.outbound.list.label"
+                defaultMessage="Outbound Movement List"
+              />
+            )
+        }
+      </span>
+      <div className="d-flex justify-content-end buttons align-items-center">
+        <Button
+          defaultLabel="My Stock Movements"
+          variant="primary-outline"
+          label="react.stockMovement.myStockMovement.label"
+          onClick={showMyStockMovements}
+        />
+        {permissions.canCreateOutboundMovement && (
+          <Link
+            className="primary-button"
+            to={STOCK_MOVEMENT_URL.createOutbound()}
+          >
             <Translate
-              id="react.stockMovement.request.list.label"
-              defaultMessage="Request List"
+              id="react.stockMovement.createStockMovement.label"
+              defaultMessage="Create Stock Movement"
             />
-          )
-          : (
-            <Translate
-              id="react.stockMovement.outbound.list.label"
-              defaultMessage="Outbound Movement List"
-            />
-          )
-      }
-    </span>
-    <div className="d-flex justify-content-end buttons align-items-center">
-      <Button
-        defaultLabel="My Stock Movements"
-        variant="primary-outline"
-        label="react.stockMovement.myStockMovement.label"
-        onClick={showMyStockMovements}
-      />
-      {!hasReportingUserPolicy && (
-        <Link
-          className="primary-button"
-          to={STOCK_MOVEMENT_URL.createOutbound()}
-        >
-          <Translate
-            id="react.stockMovement.createStockMovement.label"
-            defaultMessage="Create Stock Movement"
-          />
-        </Link>
-      )}
+          </Link>
+        )}
+      </div>
     </div>
-  </div>
-);
+  );
+};
 
 StockMovementOutboundHeader.propTypes = {
   showMyStockMovements: PropTypes.func.isRequired,
   isRequestsOpen: PropTypes.bool.isRequired,
-  hasReportingUserPolicy: PropTypes.bool,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canCreateOutboundMovement: PropTypes.bool,
+  }),
 };
 
 StockMovementOutboundHeader.defaultProps = {
-  hasReportingUserPolicy: false,
+  customRolePermissions: undefined,
 };
 
 export default StockMovementOutboundHeader;
diff --git a/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx b/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx
index 74e8f490cd5..70fa026958b 100644
--- a/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx
+++ b/src/js/components/stock-movement/outbound/StockMovementOutboundList.jsx
@@ -28,7 +28,7 @@ const StockMovementOutboundList = (props) => {
       <StockMovementOutboundHeader
         isRequestsOpen={isRequestsList}
         showMyStockMovements={selectFiltersForMyStockMovements}
-        hasReportingUserPolicy={props.hasReportingUserPolicy}
+        customRolePermissions={props.customRolePermissions}
       />
       <StockMovementOutboundFilters
         defaultValues={defaultFilterValues}
@@ -55,7 +55,7 @@ const mapStateToProps = (state) => ({
   isRequisitionStatusesFetched: state.requisitionStatuses.fetched,
   shipmentTypes: state.stockMovementCommon.shipmentTypes,
   approvers: state.approvers.data,
-  hasReportingUserPolicy: state.session.hasReportingUserPolicy,
+  customRolePermissions: state.session.customRolePermissions,
 });
 
 export default withRouter(connect(mapStateToProps, {
@@ -82,9 +82,12 @@ StockMovementOutboundList.propTypes = {
     label: PropTypes.string,
     value: PropTypes.string,
   })).isRequired,
-  hasReportingUserPolicy: PropTypes.bool,
+  customRolePermissions: PropTypes.shape({
+    activeCustomRolePolicy: PropTypes.string,
+    canCreateOutboundMovement: PropTypes.bool,
+  }),
 };
 
 StockMovementOutboundList.defaultProps = {
-  hasReportingUserPolicy: false,
+  customRolePermissions: undefined,
 };
diff --git a/src/js/custom/roles/customRolePermissions.js b/src/js/custom/roles/customRolePermissions.js
new file mode 100644
index 00000000000..6dea0319ee1
--- /dev/null
+++ b/src/js/custom/roles/customRolePermissions.js
@@ -0,0 +1,36 @@
+export const DEFAULT_CUSTOM_ROLE_PERMISSIONS = {
+  activeCustomRolePolicy: null,
+  canCreateInboundMovement: true,
+  canCreateInboundFromPurchaseOrder: true,
+  canCreateOutboundMovement: true,
+  canManageProducts: false,
+  canManagePurchasing: true,
+  canManageStocklists: false,
+  canSendStocklistEmail: true,
+};
+
+export const getCustomRolePermissions = (session = {}) => ({
+  ...DEFAULT_CUSTOM_ROLE_PERMISSIONS,
+  ...(session.customRolePermissions || {}),
+});
+
+export const canCreateInboundMovement = (session = {}) =>
+  getCustomRolePermissions(session).canCreateInboundMovement;
+
+export const canCreateInboundFromPurchaseOrder = (session = {}) =>
+  getCustomRolePermissions(session).canCreateInboundFromPurchaseOrder;
+
+export const canManageStocklists = (session = {}) =>
+  getCustomRolePermissions(session).canManageStocklists;
+
+export const canSendStocklistEmail = (session = {}) =>
+  getCustomRolePermissions(session).canSendStocklistEmail;
+
+export const canCreateOutboundMovement = (session = {}) =>
+  getCustomRolePermissions(session).canCreateOutboundMovement;
+
+export const canManageProducts = (session = {}) =>
+  getCustomRolePermissions(session).canManageProducts;
+
+export const canManagePurchasing = (session = {}) =>
+  getCustomRolePermissions(session).canManagePurchasing;
diff --git a/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx b/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx
index 6b2fdf0c94d..643ff13500c 100644
--- a/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx
+++ b/src/js/hooks/list-pages/productSupplier/useProductSupplierActions.jsx
@@ -2,6 +2,7 @@ import React, { useCallback } from 'react';
 
 import { RiDeleteBinLine, RiPencilLine } from 'react-icons/ri';
 import { useSelector } from 'react-redux';
+import { getCustomRolePermissions } from 'custom/roles/customRolePermissions';
 
 import productSupplierApi from 'api/services/ProductSupplierApi';
 import { PRODUCT_SUPPLIER_EXPORT } from 'api/urls';
@@ -17,12 +18,13 @@ import translate from 'utils/Translate';
 
 const useProductSupplierActions = ({ fireFetchData, filterParams }) => {
   const spinner = useSpinner();
-  const hasRpcSuperuserPolicy = useSelector((state) => state.session.hasRpcSuperuserPolicy);
+  const customRolePermissions = useSelector((state) => state.session.customRolePermissions);
   const hasProductManagerPermissions = useUserHasPermissions({
     minRequiredRole: RoleType.ROLE_ADMIN,
     supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER],
   });
-  const canManageProducts = hasProductManagerPermissions || hasRpcSuperuserPolicy;
+  const permissions = getCustomRolePermissions({ customRolePermissions });
+  const canManageProducts = hasProductManagerPermissions || permissions.canManageProducts;
 
   const deleteProductSupplier = async (onClose, productSupplierId) => {
     try {
diff --git a/src/js/reducers/sessionReducer.jsx b/src/js/reducers/sessionReducer.jsx
index 53afad9cfeb..97db9144e5e 100644
--- a/src/js/reducers/sessionReducer.jsx
+++ b/src/js/reducers/sessionReducer.jsx
@@ -1,4 +1,5 @@
 import _ from 'lodash';
+import { DEFAULT_CUSTOM_ROLE_PERMISSIONS } from 'custom/roles/customRolePermissions';
 
 import {
   CHANGE_CURRENT_LOCALE,
@@ -28,6 +29,7 @@ const initialState = {
   hasRegionalWarehousePolicy: false,
   hasRpcSuperuserPolicy: false,
   hasReportingUserPolicy: false,
+  customRolePermissions: DEFAULT_CUSTOM_ROLE_PERMISSIONS,
   supportedActivities: [],
   menuConfig: [],
   menuSectionsUrlParts: {},
@@ -107,6 +109,7 @@ export default function (state = initialState, action) {
         hasRegionalWarehousePolicy: _.get(action, 'payload.data.data.hasRegionalWarehousePolicy', false),
         hasRpcSuperuserPolicy: _.get(action, 'payload.data.data.hasRpcSuperuserPolicy', false),
         hasReportingUserPolicy: _.get(action, 'payload.data.data.hasReportingUserPolicy', false),
+        customRolePermissions: _.get(action, 'payload.data.data.customRolePermissions', state.customRolePermissions),
         supportedActivities: _.get(action, 'payload.data.data.supportedActivities'),
         activeLanguage: _.get(action, 'payload.data.data.activeLanguage'),
         activeLanguageTag: _.get(action, 'payload.data.data.activeLanguageTag'),
diff --git a/src/js/tests/custom/roles/customRolePermissions.test.js b/src/js/tests/custom/roles/customRolePermissions.test.js
new file mode 100644
index 00000000000..8a3822e8bdd
--- /dev/null
+++ b/src/js/tests/custom/roles/customRolePermissions.test.js
@@ -0,0 +1,42 @@
+import {
+  canCreateOutboundMovement,
+  canCreateInboundFromPurchaseOrder,
+  canCreateInboundMovement,
+  canManageProducts,
+  canManagePurchasing,
+  canManageStocklists,
+  canSendStocklistEmail,
+  DEFAULT_CUSTOM_ROLE_PERMISSIONS,
+  getCustomRolePermissions,
+} from 'custom/roles/customRolePermissions';
+
+describe('customRolePermissions helper', () => {
+  it('returns defaults when session has no custom payload', () => {
+    const permissions = getCustomRolePermissions({});
+
+    expect(permissions).toEqual(DEFAULT_CUSTOM_ROLE_PERMISSIONS);
+  });
+
+  it('returns backend-provided custom permissions', () => {
+    const session = {
+      customRolePermissions: {
+        activeCustomRolePolicy: 'ROLE_REPORTING_USER',
+        canCreateInboundMovement: false,
+        canCreateInboundFromPurchaseOrder: false,
+        canCreateOutboundMovement: false,
+        canManageProducts: false,
+        canManagePurchasing: false,
+        canManageStocklists: false,
+        canSendStocklistEmail: false,
+      },
+    };
+
+    expect(canCreateInboundMovement(session)).toBe(false);
+    expect(canCreateInboundFromPurchaseOrder(session)).toBe(false);
+    expect(canCreateOutboundMovement(session)).toBe(false);
+    expect(canManageProducts(session)).toBe(false);
+    expect(canManagePurchasing(session)).toBe(false);
+    expect(canManageStocklists(session)).toBe(false);
+    expect(canSendStocklistEmail(session)).toBe(false);
+  });
+});
diff --git a/src/js/tests/stock-movement/StockMovementInboundHeader.test.jsx b/src/js/tests/stock-movement/StockMovementInboundHeader.test.jsx
new file mode 100644
index 00000000000..d10d94985b7
--- /dev/null
+++ b/src/js/tests/stock-movement/StockMovementInboundHeader.test.jsx
@@ -0,0 +1,60 @@
+import React from 'react';
+
+import { render, screen } from '@testing-library/react';
+import { BrowserRouter as Router } from 'react-router-dom';
+
+import StockMovementInboundHeader from 'components/stock-movement/inbound/StockMovementInboundHeader';
+
+describe('StockMovementInboundHeader', () => {
+  it('hides inbound creation actions for restricted custom roles', () => {
+    const { rerender } = render(
+      <Router>
+        <StockMovementInboundHeader
+          showMyStockMovements={() => {}}
+          customRolePermissions={{
+            activeCustomRolePolicy: 'ROLE_REGIONAL_WAREHOUSE',
+            canCreateInboundMovement: false,
+            canCreateInboundFromPurchaseOrder: false,
+          }}
+        />
+      </Router>,
+    );
+
+    expect(screen.queryByText('Create Shipment from PO')).toBeNull();
+    expect(screen.queryByText('Create Stock Movement')).toBeNull();
+
+    rerender(
+      <Router>
+        <StockMovementInboundHeader
+          showMyStockMovements={() => {}}
+          customRolePermissions={{
+            activeCustomRolePolicy: 'ROLE_FACILITY_STOREKEEPER',
+            canCreateInboundMovement: false,
+            canCreateInboundFromPurchaseOrder: false,
+          }}
+        />
+      </Router>,
+    );
+
+    expect(screen.queryByText('Create Shipment from PO')).toBeNull();
+    expect(screen.queryByText('Create Stock Movement')).toBeNull();
+  });
+
+  it('shows inbound creation actions when permitted', () => {
+    render(
+      <Router>
+        <StockMovementInboundHeader
+          showMyStockMovements={() => {}}
+          customRolePermissions={{
+            activeCustomRolePolicy: 'ROLE_RPC_SUPERUSER',
+            canCreateInboundMovement: true,
+            canCreateInboundFromPurchaseOrder: true,
+          }}
+        />
+      </Router>,
+    );
+
+    expect(screen.queryByText('Create Shipment from PO')).not.toBeNull();
+    expect(screen.queryByText('Create Stock Movement')).not.toBeNull();
+  });
+});
diff --git a/src/js/tests/stock-movement/StockMovementOutboundHeader.test.jsx b/src/js/tests/stock-movement/StockMovementOutboundHeader.test.jsx
new file mode 100644
index 00000000000..704d1d16a5f
--- /dev/null
+++ b/src/js/tests/stock-movement/StockMovementOutboundHeader.test.jsx
@@ -0,0 +1,42 @@
+import React from 'react';
+
+import { render, screen } from '@testing-library/react';
+import { BrowserRouter as Router } from 'react-router-dom';
+
+import StockMovementOutboundHeader from 'components/stock-movement/outbound/StockMovementOutboundHeader';
+
+describe('StockMovementOutboundHeader', () => {
+  it('hides outbound creation action for reporting users', () => {
+    render(
+      <Router>
+        <StockMovementOutboundHeader
+          isRequestsOpen={false}
+          showMyStockMovements={() => {}}
+          customRolePermissions={{
+            activeCustomRolePolicy: 'ROLE_REPORTING_USER',
+            canCreateOutboundMovement: false,
+          }}
+        />
+      </Router>,
+    );
+
+    expect(screen.queryByText('Create Stock Movement')).toBeNull();
+  });
+
+  it('shows outbound creation action when permitted', () => {
+    render(
+      <Router>
+        <StockMovementOutboundHeader
+          isRequestsOpen={false}
+          showMyStockMovements={() => {}}
+          customRolePermissions={{
+            activeCustomRolePolicy: 'ROLE_RPC_SUPERUSER',
+            canCreateOutboundMovement: true,
+          }}
+        />
+      </Router>,
+    );
+
+    expect(screen.queryByText('Create Stock Movement')).not.toBeNull();
+  });
+});
diff --git a/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy b/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
new file mode 100644
index 00000000000..77d174e388d
--- /dev/null
+++ b/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
@@ -0,0 +1,46 @@
+package org.pih.warehouse
+
+import grails.testing.web.taglib.TagLibUnitTest
+import org.pih.warehouse.custom.roles.CustomRolePolicyService
+import org.pih.warehouse.core.User
+import org.pih.warehouse.core.UserService
+import spock.lang.Specification
+
+class AuthTagLibCustomRolesSpec extends Specification implements TagLibUnitTest<AuthTagLib> {
+
+    def setup() {
+        session.user = Stub(User) {
+            getId() >> 'user-1'
+        }
+        session.warehouse = [id: 'loc-1']
+    }
+
+    def "canSendStocklistEmail should hide body for restricted custom roles"() {
+        given:
+        tagLib.customRolePolicyService = Stub(CustomRolePolicyService) {
+            shouldHideStocklistEmail(_, _) >> true
+        }
+
+        when:
+        String output = applyTemplate('<g:canSendStocklistEmail>Email</g:canSendStocklistEmail>')
+
+        then:
+        output == ''
+    }
+
+    def "canManageStocklists should render body when custom policy allows stocklist management"() {
+        given:
+        tagLib.userService = Stub(UserService) {
+            isUserAdmin(_) >> false
+        }
+        tagLib.customRolePolicyService = Stub(CustomRolePolicyService) {
+            canManageStocklists(_, _) >> true
+        }
+
+        when:
+        String output = applyTemplate('<g:canManageStocklists>Allowed</g:canManageStocklists>')
+
+        then:
+        output == 'Allowed'
+    }
+}
diff --git a/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
new file mode 100644
index 00000000000..68dfa37e08a
--- /dev/null
+++ b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
@@ -0,0 +1,208 @@
+package org.pih.warehouse.custom.roles
+
+import grails.testing.services.ServiceUnitTest
+import org.pih.warehouse.core.Location
+import org.pih.warehouse.core.Role
+import org.pih.warehouse.core.RoleType
+import org.pih.warehouse.core.User
+import spock.lang.Specification
+
+class CustomRolePolicyServiceSpec extends Specification implements ServiceUnitTest<CustomRolePolicyService> {
+
+    def setup() {
+        GroovySystem.metaClassRegistry.removeMetaClass(Location)
+        GroovySystem.metaClassRegistry.removeMetaClass(User)
+        Location.metaClass.static.get = { String id ->
+            Stub(Location) {
+                getId() >> id
+            }
+        }
+    }
+
+    def cleanup() {
+        GroovySystem.metaClassRegistry.removeMetaClass(Location)
+        GroovySystem.metaClassRegistry.removeMetaClass(User)
+    }
+
+    def "should not activate custom policy when higher core role is present"() {
+        given:
+        User user = mockUser(
+                [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_MANAGER],
+                [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_MANAGER]
+        )
+
+        when:
+        Map<String, Boolean> flags = service.getPolicyFlags(user, 'loc-1')
+
+        then:
+        !flags.hasFacilityStorekeeperPolicy
+        !flags.hasRegionalWarehousePolicy
+        !flags.hasRpcSuperuserPolicy
+        !flags.hasReportingUserPolicy
+    }
+
+    def "should prioritize rpc superuser over other custom roles"() {
+        given:
+        User user = mockUser(
+                [RoleType.ROLE_RPC_SUPERUSER, RoleType.ROLE_REGIONAL_WAREHOUSE],
+                [RoleType.ROLE_RPC_SUPERUSER, RoleType.ROLE_REGIONAL_WAREHOUSE]
+        )
+
+        when:
+        Map<String, Boolean> flags = service.getPolicyFlags(user, 'loc-1')
+
+        then:
+        flags.hasRpcSuperuserPolicy
+        !flags.hasRegionalWarehousePolicy
+        !flags.hasFacilityStorekeeperPolicy
+        !flags.hasReportingUserPolicy
+    }
+
+    def "should deny combined shipment creation for regional warehouse policy"() {
+        given:
+        User user = mockUser([RoleType.ROLE_REGIONAL_WAREHOUSE], [RoleType.ROLE_REGIONAL_WAREHOUSE])
+
+        when:
+        Map<String, Object> access = service.evaluateRouteAccess(
+                user,
+                'loc-1',
+                'stockMovement',
+                'createCombinedShipments',
+                [:],
+                null
+        )
+
+        then:
+        access.hasPolicy
+        access.denied
+        !access.allowed
+    }
+
+    def "should deny combined shipment api creation for facility storekeeper policy"() {
+        given:
+        User user = mockUser([RoleType.ROLE_FACILITY_STOREKEEPER], [RoleType.ROLE_FACILITY_STOREKEEPER])
+        def request = [JSON: [:]]
+
+        when:
+        Map<String, Object> access = service.evaluateRouteAccess(
+                user,
+                'loc-1',
+                'stockMovementApi',
+                'createCombinedShipments',
+                [:],
+                request
+        )
+
+        then:
+        access.hasPolicy
+        access.denied
+        !access.allowed
+    }
+
+    def "should build custom permission payload for reporting user"() {
+        given:
+        User user = mockUser([RoleType.ROLE_REPORTING_USER], [RoleType.ROLE_REPORTING_USER])
+
+        when:
+        Map<String, Object> permissions = service.getCustomRolePermissions(user, 'loc-1')
+
+        then:
+        permissions.activeCustomRolePolicy == RoleType.ROLE_REPORTING_USER.name()
+        permissions.canCreateInboundMovement == false
+        permissions.canCreateInboundFromPurchaseOrder == false
+        permissions.canCreateOutboundMovement == false
+        permissions.canManageProducts == false
+        permissions.canManagePurchasing == false
+        permissions.canManageStocklists == false
+        permissions.canSendStocklistEmail == false
+    }
+
+    def "should build custom permission payload for rpc superuser"() {
+        given:
+        User user = mockUser([RoleType.ROLE_RPC_SUPERUSER], [RoleType.ROLE_RPC_SUPERUSER])
+
+        when:
+        Map<String, Object> permissions = service.getCustomRolePermissions(user, 'loc-1')
+
+        then:
+        permissions.activeCustomRolePolicy == RoleType.ROLE_RPC_SUPERUSER.name()
+        permissions.canCreateInboundMovement == true
+        permissions.canCreateInboundFromPurchaseOrder == true
+        permissions.canCreateOutboundMovement == true
+        permissions.canManageProducts == true
+        permissions.canManagePurchasing == true
+        permissions.canManageStocklists == true
+        permissions.canSendStocklistEmail == true
+    }
+
+    def "should remove inbound create actions from regional warehouse menu"() {
+        given:
+        User user = mockUser([RoleType.ROLE_REGIONAL_WAREHOUSE], [RoleType.ROLE_REGIONAL_WAREHOUSE])
+        ArrayList menuConfig = [[
+                                        id         : 'inbound',
+                                        subsections: [[
+                                                              menuItems: [
+                                                                      [href: '/stockMovement/createInbound'],
+                                                                      [href: '/stockMovement/createCombinedShipments?direction=INBOUND'],
+                                                                      [href: '/stockMovement/list?direction=INBOUND'],
+                                                              ]
+                                                      ]]
+                                ]] as ArrayList
+
+        when:
+        ArrayList filtered = service.applyMenuPolicy(menuConfig, user, 'loc-1')
+        List<Map> menuItems = filtered[0].subsections[0].menuItems
+
+        then:
+        menuItems*.href == ['/stockMovement/list?direction=INBOUND']
+    }
+
+    def "should recognize location chooser role from all assigned roles"() {
+        given:
+        User user = mockUser(
+                [RoleType.ROLE_AUTHENTICATED],
+                [RoleType.ROLE_AUTHENTICATED, RoleType.ROLE_FACILITY_STOREKEEPER]
+        )
+
+        expect:
+        service.hasLocationChooserRole(user)
+    }
+
+    def "should resolve detached user before evaluating custom role policy"() {
+        given:
+        User detachedUser = Stub(User) {
+            getId() >> "user-1"
+            getEffectiveRoles(_ as Location) >> { throw new IllegalStateException("Detached user should not be used directly") }
+        }
+        User persistentUser = Stub(User) {
+            getEffectiveRoles(_ as Location) >> [role(RoleType.ROLE_REGIONAL_WAREHOUSE)]
+            getAllRoles() >> [role(RoleType.ROLE_REGIONAL_WAREHOUSE)]
+        }
+        User.metaClass.static.get = { String id ->
+            assert id == "user-1"
+            return persistentUser
+        }
+
+        when:
+        Map<String, Boolean> flags = service.getPolicyFlags(detachedUser, "loc-1")
+
+        then:
+        flags.hasRegionalWarehousePolicy
+        !flags.hasFacilityStorekeeperPolicy
+        !flags.hasRpcSuperuserPolicy
+        !flags.hasReportingUserPolicy
+    }
+
+    private User mockUser(List<RoleType> effectiveRoleTypes, List<RoleType> allRoleTypes) {
+        List<Role> effectiveRoles = effectiveRoleTypes.collect { role(it) }
+        List<Role> allRoles = allRoleTypes.collect { role(it) }
+        return Stub(User) {
+            getEffectiveRoles(_ as Location) >> effectiveRoles
+            getAllRoles() >> allRoles
+        }
+    }
+
+    private Role role(RoleType roleType) {
+        return new Role(roleType: roleType, name: roleType.name())
+    }
+}

From e116fe99f9b143bd7a1ae0f75f5ea35b3dab1b88 Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Tue, 26 May 2026 10:01:50 -0300
Subject: [PATCH 08/10] fix(custom-roles): tighten no-policy defaults and
 remove frontend role-name checks

---
 .../api/LocationApiController.groovy          | 13 +--
 .../pih/warehouse/core/LocationService.groovy | 13 +--
 .../roles/CustomRolePolicyService.groovy      | 49 +++++++++--
 .../.openspec.yaml                            |  2 +
 .../design.md                                 | 87 +++++++++++++++++++
 .../proposal.md                               | 30 +++++++
 .../custom-role-policy-isolation/spec.md      | 57 ++++++++++++
 .../tasks.md                                  | 34 ++++++++
 .../custom-role-policy-isolation/spec.md      | 36 +++++++-
 .../purchaseOrder/PurchaseOrderListTable.jsx  |  3 +-
 src/js/custom/roles/customRolePermissions.js  |  5 ++
 .../roles/customRolePermissions.test.js       | 18 +++-
 .../roles/CustomRolePolicyServiceSpec.groovy  | 21 +++++
 13 files changed, 337 insertions(+), 31 deletions(-)
 create mode 100644 openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/design.md
 create mode 100644 openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/proposal.md
 create mode 100644 openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/specs/custom-role-policy-isolation/spec.md
 create mode 100644 openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/tasks.md

diff --git a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
index 7b421271dc5..ebf1af84fbe 100644
--- a/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy
@@ -61,17 +61,12 @@ class LocationApiController extends BaseDomainApiController {
         def isRequestor = userService.isUserRequestor(currentUser)
         def requestorInAnyLocation = userService.hasRoleRequestorInAnyLocations(currentUser)
         def inRoleBrowser = currentUser.hasDefaultRole(RoleType.ROLE_BROWSER)
-        def inRoleFacilityStorekeeper = currentUser.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
-        def inRoleRegionalWarehouse = currentUser.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
-        def inRoleRpcSuperuser = currentUser.hasDefaultRole(RoleType.ROLE_RPC_SUPERUSER)
-        def inRoleReportingUser = currentUser.hasDefaultRole(RoleType.ROLE_REPORTING_USER)
-        def inRoleAssistant = currentUser.hasDefaultRole(RoleType.ROLE_ASSISTANT)
-        def inRoleManager = currentUser.hasDefaultRole(RoleType.ROLE_MANAGER)
-        def inRoleAdmin = currentUser.hasDefaultRole(RoleType.ROLE_ADMIN)
-        def inRoleSuperuser = currentUser.hasDefaultRole(RoleType.ROLE_SUPERUSER)
 
 
         def requiredRoles = RoleType.listRoleTypesForLocationChooser()
+        boolean hasDefaultLocationChooserRole = requiredRoles.any { roleType ->
+            currentUser.hasDefaultRole(roleType)
+        }
 
 
         if (params.locationChooser && isRequestor && !currentUser.locationRoles && !inRoleBrowser) {
@@ -85,7 +80,7 @@ class LocationApiController extends BaseDomainApiController {
                 locations += locationService.getRequestorLocations(currentUser)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (params.locationChooser && !inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleReportingUser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (params.locationChooser && !inRoleBrowser && !hasDefaultLocationChooserRole) {
                 currentUser.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/services/org/pih/warehouse/core/LocationService.groovy b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
index 44103083938..4189d1ba402 100644
--- a/grails-app/services/org/pih/warehouse/core/LocationService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/LocationService.groovy
@@ -260,16 +260,11 @@ class LocationService {
         def isRequestor = userService.isUserRequestor(user)
         def requestorInAnyLocation = userService.hasRoleRequestorInAnyLocations(user)
         def inRoleBrowser = user.hasDefaultRole(RoleType.ROLE_BROWSER)
-        def inRoleFacilityStorekeeper = user.hasDefaultRole(RoleType.ROLE_FACILITY_STOREKEEPER)
-        def inRoleRegionalWarehouse = user.hasDefaultRole(RoleType.ROLE_REGIONAL_WAREHOUSE)
-        def inRoleRpcSuperuser = user.hasDefaultRole(RoleType.ROLE_RPC_SUPERUSER)
-        def inRoleReportingUser = user.hasDefaultRole(RoleType.ROLE_REPORTING_USER)
-        def inRoleAssistant = user.hasDefaultRole(RoleType.ROLE_ASSISTANT)
-        def inRoleManager = user.hasDefaultRole(RoleType.ROLE_MANAGER)
-        def inRoleAdmin = user.hasDefaultRole(RoleType.ROLE_ADMIN)
-        def inRoleSuperuser = user.hasDefaultRole(RoleType.ROLE_SUPERUSER)
 
         def requiredRoles = RoleType.listRoleTypesForLocationChooser()
+        boolean hasDefaultLocationChooserRole = requiredRoles.any { roleType ->
+            user.hasDefaultRole(roleType)
+        }
 
         if (isRequestor && !user.locationRoles && !inRoleBrowser) {
             locations = getLocations(null, null)
@@ -282,7 +277,7 @@ class LocationService {
                 locations += getRequestorLocations(user)
             }
             // If a user doesn't have at least one of the requiredRoles by default, get locations where the user HAS any of those roles
-            if (!inRoleBrowser && !inRoleFacilityStorekeeper && !inRoleRegionalWarehouse && !inRoleRpcSuperuser && !inRoleReportingUser && !inRoleAssistant && !inRoleManager && !inRoleAdmin && !inRoleSuperuser) {
+            if (!inRoleBrowser && !hasDefaultLocationChooserRole) {
                 user.locationRoles.each { LocationRole locationRole ->
                     if (requiredRoles.contains(locationRole.role.roleType)) {
                         locations += locationRole.location
diff --git a/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy b/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
index bc2dfb7d9bd..71b091b17db 100644
--- a/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
+++ b/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
@@ -268,19 +268,20 @@ class CustomRolePolicyService {
         RoleType activePolicy = getActivePolicy(user, locationId)
         return [
                 activeCustomRolePolicy          : activePolicy?.name(),
-                canCreateInboundMovement        : ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
-                canCreateInboundFromPurchaseOrder: ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
-                canCreateOutboundMovement       : ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
-                canManageStocklists             : [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy),
-                canSendStocklistEmail           : [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy),
-                canManageProducts               : activePolicy == RoleType.ROLE_RPC_SUPERUSER,
-                canManagePurchasing             : ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy),
+                canCreateInboundMovement        : policyAllowsCreateInboundMovement(activePolicy),
+                canCreateInboundFromPurchaseOrder: policyAllowsCreateInboundFromPurchaseOrder(activePolicy),
+                canCreateOutboundMovement       : policyAllowsCreateOutboundMovement(activePolicy),
+                canManageStocklists             : policyAllowsManageStocklists(activePolicy),
+                canSendStocklistEmail           : policyAllowsSendStocklistEmail(activePolicy),
+                canManageProducts               : policyAllowsManageProducts(activePolicy),
+                canManagePurchasing             : policyAllowsManagePurchasing(activePolicy),
+                canUseSuperuserPurchasingActions: policyAllowsSuperuserPurchasingActions(activePolicy),
         ]
     }
 
     boolean canManageStocklists(User user, String locationId) {
         RoleType activePolicy = getActivePolicy(user, locationId)
-        return [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy)
+        return policyAllowsManageStocklists(activePolicy)
     }
 
     boolean shouldHideStocklistEmail(User user, String locationId) {
@@ -368,6 +369,38 @@ class CustomRolePolicyService {
         return controllerActions.contains('*') || controllerActions.contains(actionName)
     }
 
+    private static boolean policyAllowsCreateInboundMovement(RoleType activePolicy) {
+        return !activePolicy || ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy)
+    }
+
+    private static boolean policyAllowsCreateInboundFromPurchaseOrder(RoleType activePolicy) {
+        return !activePolicy || ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy)
+    }
+
+    private static boolean policyAllowsCreateOutboundMovement(RoleType activePolicy) {
+        return !activePolicy || ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REPORTING_USER].contains(activePolicy)
+    }
+
+    private static boolean policyAllowsManageStocklists(RoleType activePolicy) {
+        return [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy)
+    }
+
+    private static boolean policyAllowsSendStocklistEmail(RoleType activePolicy) {
+        return !activePolicy || [RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_RPC_SUPERUSER].contains(activePolicy)
+    }
+
+    private static boolean policyAllowsManageProducts(RoleType activePolicy) {
+        return activePolicy == RoleType.ROLE_RPC_SUPERUSER
+    }
+
+    private static boolean policyAllowsManagePurchasing(RoleType activePolicy) {
+        return !activePolicy || ![RoleType.ROLE_FACILITY_STOREKEEPER, RoleType.ROLE_REGIONAL_WAREHOUSE, RoleType.ROLE_REPORTING_USER].contains(activePolicy)
+    }
+
+    private static boolean policyAllowsSuperuserPurchasingActions(RoleType activePolicy) {
+        return activePolicy == RoleType.ROLE_RPC_SUPERUSER
+    }
+
     private static boolean isDeniedForFacilityStorekeeper(String controllerName, String actionName, Map params, def request) {
         if (controllerName in ['purchaseOrder', 'purchaseOrderApi', 'supplier']) {
             return true
diff --git a/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/.openspec.yaml b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/.openspec.yaml
new file mode 100644
index 00000000000..4a1c6774314
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-22
diff --git a/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/design.md b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/design.md
new file mode 100644
index 00000000000..efc5532e581
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/design.md
@@ -0,0 +1,87 @@
+## Context
+
+OpenBoxes custom roles are already represented by custom backend policy code and a custom frontend permission helper, but some integration points still risk checking `RoleType` names directly. Those direct checks make future role behavior harder to audit because authorization can drift between controllers, GSPs, taglibs, menu configuration, and React action visibility. Frontend helpers also need to avoid becoming a second authorization model; they should mirror backend policy responses only for UI visibility.
+
+The existing `custom-role-policy-isolation` capability requires a canonical custom-role policy model. This change continues that refactor by making named capability methods on `CustomRolePolicyService` the preferred backend contract and by keeping frontend decisions derived from backend-provided permission payloads.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Centralize custom-role decisions behind `CustomRolePolicyService` capability methods.
+- Replace scattered direct custom role-name checks in touched controllers, GSPs, taglibs, and React components with reusable capability checks.
+- Preserve backend enforcement as the source of truth for custom-role behavior.
+- Keep frontend permission helpers focused on visibility decisions derived from backend policy responses.
+- Keep upstream-file edits surgical and limited to delegation points required by existing OpenBoxes extension points.
+- Add regression coverage for representative capability checks, their UI/backend consumers, and standard core roles with no active custom policy.
+
+**Non-Goals:**
+
+- Change the approved custom role access matrix.
+- Add new custom roles or rename existing role identifiers.
+- Introduce new database tables, migrations, or external dependencies.
+- Rewrite the broader OpenBoxes authorization model.
+- Move every upstream authorization concern into custom code when it is unrelated to custom roles.
+
+## Decisions
+
+1. Use capability methods as the integration contract.
+
+Callers that need custom-role-sensitive decisions will ask methods such as `canManageStocklists`, `canCreateInboundMovement`, `canManageProducts`, `canUseSuperuserPurchasingActions`, and any newly needed equivalent capability methods. This keeps role-name comparisons inside the custom policy service instead of spreading `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, or `ROLE_REPORTING_USER` checks across application layers.
+
+Alternative considered: continue allowing each caller to check role names directly. That is simpler locally but makes the policy harder to audit and increases the chance that UI visibility and backend enforcement diverge.
+
+2. Keep backend policy evaluation canonical.
+
+Backend enforcement, GSP/taglib visibility, menu visibility, and app-context permission payloads will derive custom-role decisions from `CustomRolePolicyService`. React components will consume the canonical permission payload through `src/js/custom/roles/customRolePermissions.js` rather than duplicating the role matrix in JavaScript. Frontend helpers are not an authorization boundary; they exist to hide or show actions based on permissions already evaluated by the backend.
+
+Alternative considered: implement parallel frontend role-name logic for each action. That would reduce backend changes for some screens but would make hidden actions easier to desynchronize from direct URL/API enforcement.
+
+3. Preserve standard core role behavior when no custom policy is active.
+
+Capability checks should defer to existing OpenBoxes behavior for standard users without an active custom role policy. Custom-only manage capabilities should default to false when no custom policy is active so they do not grant product or stocklist write UI to standard non-admin users; existing core-role checks remain responsible for standard access. Regression tests should cover at least one standard core role path to prove the custom policy layer is not restricting or expanding users who are outside the custom role matrix.
+
+Alternative considered: only test the four custom roles. That verifies the matrix but misses regressions where policy defaults accidentally affect existing Assistant, Manager, Admin, or Superuser behavior.
+
+4. Limit upstream touch points to delegation.
+
+When existing upstream files must be changed, the edit should be a narrow call into custom services, taglibs, or frontend helpers. New reusable policy logic belongs under `org.pih.warehouse.custom.roles` or `src/js/custom/roles`.
+
+Alternative considered: refactor upstream authorization structures broadly. That would create larger merge conflicts with upstream and is unnecessary for isolating custom-role behavior.
+
+5. Treat role-name checks as acceptable only inside policy plumbing.
+
+Direct custom role-name comparisons are expected inside `CustomRolePolicyService`, role seeding/migration files, role constants, and compatibility plumbing such as methods whose purpose is to expose specific role membership. They should not appear in controllers, GSP action checks, taglibs, or React components when a capability decision is available.
+
+Alternative considered: ban all direct custom role-name references. That would be too strict because constants, migrations, tests, and the policy service itself need to name the roles explicitly.
+
+## Risks / Trade-offs
+
+- Missed direct checks in rarely used views or controllers -> Use targeted searches for custom role constants and replace representative consumers with policy calls.
+- Frontend action visibility could still drift from backend enforcement -> Keep React helpers backed by `session.customRolePermissions` and add tests for representative allowed and denied payloads.
+- Frontend helpers could be mistaken for authorization -> Document and test them as visibility helpers only; backend enforcement remains mandatory.
+- Standard roles could be unintentionally restricted by custom defaults -> Add regression coverage for users with no active custom role policy.
+- Capability method names can become too granular -> Add methods only for reusable business capabilities, not one-off button names.
+- Upstream merge conflicts from necessary delegation edits -> Keep edits minimal and document upstream touch points in this design.
+
+## Migration Plan
+
+1. Audit direct references to custom role constants outside custom policy, constants, migrations, and tests.
+2. Add or reuse `CustomRolePolicyService` capability methods for recurring decisions.
+3. Replace scattered backend checks with capability method calls or permission payload lookups.
+4. Replace React role-name checks with `src/js/custom/roles/customRolePermissions.js` helpers.
+5. Review duplicated frontend/backend permission logic and remove frontend derivation of authorization decisions.
+6. Run targeted backend and frontend tests for custom-role policy behavior and standard core role fallbacks.
+
+Rollback is code-only: revert the refactor commits. No data migration or configuration rollback is expected.
+
+## Upstream Touch Points
+
+- `grails-app/controllers/**`: only where existing direct custom role-name checks must delegate to custom policy capabilities.
+- `grails-app/services/**`: only where existing menu/location/app-context behavior must delegate to custom policy capabilities.
+- `grails-app/taglib/**` and `grails-app/views/**`: only where server-rendered action visibility must delegate to custom policy capabilities.
+- `src/js/components/**`: only where existing React screens must call custom permission helpers instead of direct role-name checks.
+
+## Open Questions
+
+- Which remaining direct role-name checks are compatibility helpers that should stay as-is versus business capability decisions that should move behind `CustomRolePolicyService`?
diff --git a/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/proposal.md b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/proposal.md
new file mode 100644
index 00000000000..3c6dc67e2c4
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/proposal.md
@@ -0,0 +1,30 @@
+## Why
+
+Custom role behavior is currently being centralized, but direct role-name checks can still leak into controllers, GSPs, taglibs, and React components as new restrictions are added. This change keeps policy decisions discoverable and consistent by continuing the refactor toward reusable capability checks backed by `CustomRolePolicyService`.
+
+## What Changes
+
+- Expand custom-role policy isolation so backend callers ask `CustomRolePolicyService` for named capabilities instead of checking role names directly.
+- Prefer reusable capability checks such as `canManageStocklists`, `canCreateInboundMovement`, and `canManageProducts` for UI visibility and backend enforcement.
+- Keep backend policy evaluation as the source of truth and expose any frontend-sensitive decisions through canonical permission payloads or custom frontend helpers.
+- Replace scattered role-name conditionals in touched controllers, GSPs, taglibs, and React components with delegation to the centralized policy model.
+- Review duplicated permission logic between backend policy responses and frontend helpers so frontend checks remain focused on UI visibility, not authorization.
+- Add regression coverage that proves representative capability checks match backend enforcement and UI visibility.
+- Add regression coverage that standard core roles are unaffected when no custom role policy is active.
+
+## Capabilities
+
+### New Capabilities
+
+- None.
+
+### Modified Capabilities
+
+- `custom-role-policy-isolation`: Strengthen the requirement that custom role callers use centralized, reusable capability checks instead of scattered direct role-name checks, and clarify that frontend helpers mirror backend permissions for visibility only.
+
+## Impact
+
+- Affected backend code: `CustomRolePolicyService`, custom role helpers, controller/interceptor touch points, taglibs, and GSP action visibility where custom role checks currently appear.
+- Affected frontend code: custom role permission helpers and React components that render custom-role-sensitive actions.
+- Tests: backend unit/integration coverage for capability decisions and unaffected standard core roles, plus frontend Jest coverage for representative permission helpers or action gates.
+- No database migrations, external APIs, or dependency changes are expected.
diff --git a/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/specs/custom-role-policy-isolation/spec.md b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/specs/custom-role-policy-isolation/spec.md
new file mode 100644
index 00000000000..a757c861735
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/specs/custom-role-policy-isolation/spec.md
@@ -0,0 +1,57 @@
+## MODIFIED Requirements
+
+### Requirement: Custom role policy SHALL be isolated behind custom services and helpers
+The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy. Controllers, GSPs, taglibs, and React components SHALL use reusable capability checks when a custom-role-sensitive business decision is needed, instead of duplicating direct custom role-name checks outside the canonical policy layer.
+
+#### Scenario: Custom backend policy is discoverable
+- **WHEN** a developer reviews backend custom-role authorization behavior
+- **THEN** the role matrix, endpoint restrictions, and menu/action capability decisions SHALL be implemented under `org.pih.warehouse.custom.*`
+- **AND** upstream backend files SHALL NOT contain duplicated custom-role matrices or role-specific endpoint lists
+
+#### Scenario: Custom backend callers use capability checks
+- **WHEN** controllers, interceptors, services, taglibs, or GSPs evaluate custom-role-sensitive actions such as stocklist management, inbound movement creation, or product management
+- **THEN** they SHALL delegate to `CustomRolePolicyService` capability methods or backend permission payloads derived from that service
+- **AND** they SHALL NOT repeat direct checks for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, or `ROLE_REPORTING_USER` for those business decisions
+
+#### Scenario: Custom frontend policy is discoverable
+- **WHEN** a developer reviews frontend custom-role action visibility
+- **THEN** custom-role permission helpers SHALL live under `src/js/custom/*`
+- **AND** React components outside `src/js/custom/*` SHALL consume those helpers or the canonical permission payload instead of repeating custom-role checks inline
+
+#### Scenario: Direct role-name references are limited to policy plumbing
+- **WHEN** a developer searches for custom role identifiers
+- **THEN** direct custom role-name references SHALL be limited to the canonical policy service, role constants, role seeding or migrations, tests, and compatibility plumbing whose explicit purpose is role membership exposure
+- **AND** custom-role-sensitive business decisions outside those locations SHALL use named capability checks
+
+### Requirement: Custom role decisions SHALL use one canonical policy model
+The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, and frontend action gates from one canonical custom-role policy model. The backend `CustomRolePolicyService` SHALL be the source of truth for capability decisions, and frontend custom-role helpers SHALL consume backend-provided permissions instead of deriving the access matrix independently. Frontend helpers SHALL only control UI visibility and SHALL NOT be treated as authorization enforcement.
+
+#### Scenario: Backend callers receive consistent decisions
+- **WHEN** the interceptor, menu service, taglibs, controllers, or app-context generation ask whether a custom-role user can perform an action
+- **THEN** they SHALL receive decisions derived from the same backend custom-role policy service
+
+#### Scenario: Frontend callers receive consistent decisions
+- **WHEN** React screens decide whether to render custom-role-sensitive actions
+- **THEN** they SHALL use backend-provided custom-role permissions through custom frontend helpers
+- **AND** the visible action SHALL match the backend enforcement decision for the same workflow
+
+#### Scenario: Named capabilities remain consistent across layers
+- **WHEN** a named capability such as `canManageStocklists`, `canCreateInboundMovement`, `canManageProducts`, or `canUseSuperuserPurchasingActions` is exposed to more than one caller
+- **THEN** backend enforcement, server-rendered visibility, and React visibility SHALL derive that capability from `CustomRolePolicyService`
+- **AND** any frontend helper for the capability SHALL read the canonical permission payload rather than checking role names directly
+
+#### Scenario: Frontend helpers do not duplicate authorization logic
+- **WHEN** a frontend helper decides whether to show a custom-role-sensitive action
+- **THEN** it SHALL use the backend-provided custom role permission payload or default visibility behavior
+- **AND** it SHALL NOT independently reimplement the custom role access matrix from role names
+
+#### Scenario: Backend still denies hidden restricted actions
+- **WHEN** a custom-role user calls a restricted action directly despite the frontend hiding that action
+- **THEN** backend enforcement SHALL deny the request according to `CustomRolePolicyService`
+- **AND** the frontend helper SHALL NOT be the only authorization layer
+
+#### Scenario: Standard core roles are unaffected without custom policy
+- **WHEN** a user has only standard OpenBoxes roles and no active custom role policy
+- **THEN** custom-role capability checks and frontend permission helpers SHALL preserve existing standard-role behavior
+- **AND** the custom policy layer SHALL NOT remove access granted by the standard OpenBoxes authorization model
+- **AND** custom-only manage capabilities SHALL NOT grant product or stocklist write UI to standard users who lack the existing core-role access
diff --git a/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/tasks.md b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/tasks.md
new file mode 100644
index 00000000000..d4028fcb292
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-centralize-custom-role-policy-checks/tasks.md
@@ -0,0 +1,34 @@
+## 1. Audit Existing Custom Role Checks
+
+- [x] 1.1 Search backend and frontend code for direct custom role identifiers outside policy, constants, migrations, and tests.
+- [x] 1.2 Classify each direct role-name check as policy plumbing, compatibility membership exposure, or a business capability decision that should be refactored.
+- [x] 1.3 Identify missing reusable capability methods needed by controllers, GSPs, taglibs, menu/app-context generation, or React action gates.
+- [x] 1.4 Review duplicated permission logic between backend policy responses and frontend helpers, and mark frontend-derived authorization decisions for removal.
+
+## 2. Backend Policy Centralization
+
+- [x] 2.1 Add or reuse `CustomRolePolicyService` capability methods for recurring decisions such as stocklist management, inbound movement creation, product management, purchasing, superuser purchasing actions, and outbound creation.
+- [x] 2.2 Replace backend business-decision role-name checks in controllers, services, interceptors, taglibs, and GSP-visible helpers with `CustomRolePolicyService` capability calls.
+- [x] 2.3 Ensure any app-context or session permission payloads expose backend-derived custom role capabilities needed by frontend helpers.
+- [x] 2.4 Keep unavoidable upstream edits limited to delegation calls and avoid reformatting unrelated code.
+
+## 3. Frontend Permission Centralization
+
+- [x] 3.1 Extend or reuse `src/js/custom/roles/customRolePermissions.js` helpers for any frontend capability checks needed by the refactor.
+- [x] 3.2 Replace React component direct custom role-name checks with custom permission helpers backed by the canonical permission payload.
+- [x] 3.3 Confirm frontend defaults preserve existing behavior for users without custom role permission payloads.
+- [x] 3.4 Ensure frontend helpers are documented and implemented as UI visibility helpers only, with backend enforcement remaining authoritative.
+
+## 4. Regression Coverage
+
+- [x] 4.1 Add or update backend unit tests for `CustomRolePolicyService` capability decisions across Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User.
+- [x] 4.2 Add or update backend tests for representative consumers to verify hidden or denied actions delegate to the centralized policy.
+- [x] 4.3 Add or update Jest tests for custom frontend permission helpers and representative action visibility.
+- [x] 4.4 Add or update regression tests proving standard core roles are unaffected when no custom role policy is active.
+
+## 5. Verification
+
+- [x] 5.1 Re-run targeted searches for custom role identifiers and confirm remaining direct references are limited to allowed policy plumbing locations.
+- [x] 5.2 Run targeted backend tests for custom role policy behavior.
+- [x] 5.3 Run targeted frontend tests for custom role permission helpers or affected components.
+- [x] 5.4 Update the change design's upstream touch points if implementation modifies additional upstream files.
diff --git a/openspec/specs/custom-role-policy-isolation/spec.md b/openspec/specs/custom-role-policy-isolation/spec.md
index 1db591cd3c2..67e4c622118 100644
--- a/openspec/specs/custom-role-policy-isolation/spec.md
+++ b/openspec/specs/custom-role-policy-isolation/spec.md
@@ -4,20 +4,30 @@
 TBD - created by archiving change custom-roles-refactor. Update Purpose after archive.
 ## Requirements
 ### Requirement: Custom role policy SHALL be isolated behind custom services and helpers
-The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy.
+The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy. Controllers, GSPs, taglibs, and React components SHALL use reusable capability checks when a custom-role-sensitive business decision is needed, instead of duplicating direct custom role-name checks outside the canonical policy layer.
 
 #### Scenario: Custom backend policy is discoverable
 - **WHEN** a developer reviews backend custom-role authorization behavior
 - **THEN** the role matrix, endpoint restrictions, and menu/action capability decisions SHALL be implemented under `org.pih.warehouse.custom.*`
 - **AND** upstream backend files SHALL NOT contain duplicated custom-role matrices or role-specific endpoint lists
 
+#### Scenario: Custom backend callers use capability checks
+- **WHEN** controllers, interceptors, services, taglibs, or GSPs evaluate custom-role-sensitive actions such as stocklist management, inbound movement creation, or product management
+- **THEN** they SHALL delegate to `CustomRolePolicyService` capability methods or backend permission payloads derived from that service
+- **AND** they SHALL NOT repeat direct checks for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, or `ROLE_REPORTING_USER` for those business decisions
+
 #### Scenario: Custom frontend policy is discoverable
 - **WHEN** a developer reviews frontend custom-role action visibility
 - **THEN** custom-role permission helpers SHALL live under `src/js/custom/*`
 - **AND** React components outside `src/js/custom/*` SHALL consume those helpers or the canonical permission payload instead of repeating custom-role checks inline
 
+#### Scenario: Direct role-name references are limited to policy plumbing
+- **WHEN** a developer searches for custom role identifiers
+- **THEN** direct custom role-name references SHALL be limited to the canonical policy service, role constants, role seeding or migrations, tests, and compatibility plumbing whose explicit purpose is role membership exposure
+- **AND** custom-role-sensitive business decisions outside those locations SHALL use named capability checks
+
 ### Requirement: Custom role decisions SHALL use one canonical policy model
-The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, and frontend action gates from one canonical custom-role policy model.
+The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, and frontend action gates from one canonical custom-role policy model. The backend `CustomRolePolicyService` SHALL be the source of truth for capability decisions, and frontend custom-role helpers SHALL consume backend-provided permissions instead of deriving the access matrix independently. Frontend helpers SHALL only control UI visibility and SHALL NOT be treated as authorization enforcement.
 
 #### Scenario: Backend callers receive consistent decisions
 - **WHEN** the interceptor, menu service, taglibs, controllers, or app-context generation ask whether a custom-role user can perform an action
@@ -28,6 +38,27 @@ The system SHALL evaluate custom-role route access, menu visibility, page action
 - **THEN** they SHALL use backend-provided custom-role permissions through custom frontend helpers
 - **AND** the visible action SHALL match the backend enforcement decision for the same workflow
 
+#### Scenario: Named capabilities remain consistent across layers
+- **WHEN** a named capability such as `canManageStocklists`, `canCreateInboundMovement`, `canManageProducts`, or `canUseSuperuserPurchasingActions` is exposed to more than one caller
+- **THEN** backend enforcement, server-rendered visibility, and React visibility SHALL derive that capability from `CustomRolePolicyService`
+- **AND** any frontend helper for the capability SHALL read the canonical permission payload rather than checking role names directly
+
+#### Scenario: Frontend helpers do not duplicate authorization logic
+- **WHEN** a frontend helper decides whether to show a custom-role-sensitive action
+- **THEN** it SHALL use the backend-provided custom role permission payload or default visibility behavior
+- **AND** it SHALL NOT independently reimplement the custom role access matrix from role names
+
+#### Scenario: Backend still denies hidden restricted actions
+- **WHEN** a custom-role user calls a restricted action directly despite the frontend hiding that action
+- **THEN** backend enforcement SHALL deny the request according to `CustomRolePolicyService`
+- **AND** the frontend helper SHALL NOT be the only authorization layer
+
+#### Scenario: Standard core roles are unaffected without custom policy
+- **WHEN** a user has only standard OpenBoxes roles and no active custom role policy
+- **THEN** custom-role capability checks and frontend permission helpers SHALL preserve existing standard-role behavior
+- **AND** the custom policy layer SHALL NOT remove access granted by the standard OpenBoxes authorization model
+- **AND** custom-only manage capabilities SHALL NOT grant product or stocklist write UI to standard users who lack the existing core-role access
+
 ### Requirement: Custom role behavior SHALL have regression coverage
 The system SHALL include automated regression tests for custom-role policy resolution, menu visibility, page action visibility, direct controller/API enforcement, location chooser behavior, and frontend permission helpers.
 
@@ -42,4 +73,3 @@ The system SHALL include automated regression tests for custom-role policy resol
 #### Scenario: Frontend gates are covered by Jest tests
 - **WHEN** frontend tests run for custom-role permission helpers and representative action components
 - **THEN** they SHALL verify that restricted actions are hidden and allowed actions remain visible for the relevant custom-role permission payloads
-
diff --git a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
index d41057f2b8d..ea5bd840f50 100644
--- a/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
+++ b/src/js/components/purchaseOrder/PurchaseOrderListTable.jsx
@@ -52,7 +52,7 @@ const PurchaseOrderListTable = ({
     onFetchHandler,
   } = usePurchaseOrderListTableData(filterParams);
   const permissions = getCustomRolePermissions({ customRolePermissions });
-  const effectiveHighestRole = permissions.activeCustomRolePolicy === 'ROLE_RPC_SUPERUSER'
+  const effectiveHighestRole = permissions.canUseSuperuserPurchasingActions
     ? 'Superuser'
     : highestRole;
 
@@ -405,6 +405,7 @@ PurchaseOrderListTable.propTypes = {
   customRolePermissions: PropTypes.shape({
     activeCustomRolePolicy: PropTypes.string,
     canManagePurchasing: PropTypes.bool,
+    canUseSuperuserPurchasingActions: PropTypes.bool,
   }),
   translate: PropTypes.func.isRequired,
   currencyCode: PropTypes.string.isRequired,
diff --git a/src/js/custom/roles/customRolePermissions.js b/src/js/custom/roles/customRolePermissions.js
index 6dea0319ee1..23b0deb1861 100644
--- a/src/js/custom/roles/customRolePermissions.js
+++ b/src/js/custom/roles/customRolePermissions.js
@@ -7,8 +7,10 @@ export const DEFAULT_CUSTOM_ROLE_PERMISSIONS = {
   canManagePurchasing: true,
   canManageStocklists: false,
   canSendStocklistEmail: true,
+  canUseSuperuserPurchasingActions: false,
 };
 
+// UI visibility helper only: backend authorization remains the source of truth.
 export const getCustomRolePermissions = (session = {}) => ({
   ...DEFAULT_CUSTOM_ROLE_PERMISSIONS,
   ...(session.customRolePermissions || {}),
@@ -34,3 +36,6 @@ export const canManageProducts = (session = {}) =>
 
 export const canManagePurchasing = (session = {}) =>
   getCustomRolePermissions(session).canManagePurchasing;
+
+export const canUseSuperuserPurchasingActions = (session = {}) =>
+  getCustomRolePermissions(session).canUseSuperuserPurchasingActions;
diff --git a/src/js/tests/custom/roles/customRolePermissions.test.js b/src/js/tests/custom/roles/customRolePermissions.test.js
index 8a3822e8bdd..29b20948268 100644
--- a/src/js/tests/custom/roles/customRolePermissions.test.js
+++ b/src/js/tests/custom/roles/customRolePermissions.test.js
@@ -1,11 +1,12 @@
 import {
-  canCreateOutboundMovement,
   canCreateInboundFromPurchaseOrder,
   canCreateInboundMovement,
+  canCreateOutboundMovement,
   canManageProducts,
   canManagePurchasing,
   canManageStocklists,
   canSendStocklistEmail,
+  canUseSuperuserPurchasingActions,
   DEFAULT_CUSTOM_ROLE_PERMISSIONS,
   getCustomRolePermissions,
 } from 'custom/roles/customRolePermissions';
@@ -15,6 +16,9 @@ describe('customRolePermissions helper', () => {
     const permissions = getCustomRolePermissions({});
 
     expect(permissions).toEqual(DEFAULT_CUSTOM_ROLE_PERMISSIONS);
+    expect(canManageProducts({})).toBe(false);
+    expect(canManageStocklists({})).toBe(false);
+    expect(canUseSuperuserPurchasingActions({})).toBe(false);
   });
 
   it('returns backend-provided custom permissions', () => {
@@ -28,6 +32,7 @@ describe('customRolePermissions helper', () => {
         canManagePurchasing: false,
         canManageStocklists: false,
         canSendStocklistEmail: false,
+        canUseSuperuserPurchasingActions: false,
       },
     };
 
@@ -38,5 +43,16 @@ describe('customRolePermissions helper', () => {
     expect(canManagePurchasing(session)).toBe(false);
     expect(canManageStocklists(session)).toBe(false);
     expect(canSendStocklistEmail(session)).toBe(false);
+    expect(canUseSuperuserPurchasingActions(session)).toBe(false);
+  });
+
+  it('returns backend-provided elevated purchasing visibility', () => {
+    const session = {
+      customRolePermissions: {
+        canUseSuperuserPurchasingActions: true,
+      },
+    };
+
+    expect(canUseSuperuserPurchasingActions(session)).toBe(true);
   });
 });
diff --git a/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
index 68dfa37e08a..8801b795403 100644
--- a/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
+++ b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
@@ -115,6 +115,7 @@ class CustomRolePolicyServiceSpec extends Specification implements ServiceUnitTe
         permissions.canManagePurchasing == false
         permissions.canManageStocklists == false
         permissions.canSendStocklistEmail == false
+        permissions.canUseSuperuserPurchasingActions == false
     }
 
     def "should build custom permission payload for rpc superuser"() {
@@ -133,6 +134,26 @@ class CustomRolePolicyServiceSpec extends Specification implements ServiceUnitTe
         permissions.canManagePurchasing == true
         permissions.canManageStocklists == true
         permissions.canSendStocklistEmail == true
+        permissions.canUseSuperuserPurchasingActions == true
+    }
+
+    def "should preserve standard core role behavior without custom policy"() {
+        given:
+        User user = mockUser([RoleType.ROLE_ASSISTANT], [RoleType.ROLE_ASSISTANT])
+
+        when:
+        Map<String, Object> permissions = service.getCustomRolePermissions(user, 'loc-1')
+
+        then:
+        permissions.activeCustomRolePolicy == null
+        permissions.canCreateInboundMovement == true
+        permissions.canCreateInboundFromPurchaseOrder == true
+        permissions.canCreateOutboundMovement == true
+        permissions.canManageProducts == false
+        permissions.canManagePurchasing == true
+        permissions.canManageStocklists == false
+        permissions.canSendStocklistEmail == true
+        permissions.canUseSuperuserPurchasingActions == false
     }
 
     def "should remove inbound create actions from regional warehouse menu"() {

From 6b9aa5096df3f78fc80fd969ed959350001ed671 Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Tue, 26 May 2026 12:45:36 -0300
Subject: [PATCH 09/10] refactor(custom-roles): centralize policy checks and
 remove redundant session flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unify custom-role branching behind canonical policy helpers to avoid duplicated role-specific checks and prevent omissions like Reporting User in authenticated routing branches.

Delegate megamenu minimum/supplemental role decisions to CustomRolePolicyService, keeping menu rendering focused on composition while policy exceptions stay in one authorization layer.

Drop redundant per-role policy booleans from app-context/session state and rely on canonical customRolePermissions payload, then add regression tests for generic hasAnyCustomPolicy behavior, app-context permissions shape, menu role helper decisions (including RPC superuser exceptions), and custom role hierarchy/priority expansion guarantees.

Also document frontend runtime requirement in CLAUDE.md: use nvm use 14 before frontend tests/build commands, since this repo’s frontend toolchain is pinned to Node 14 and mismatches cause false-negative test/build failures.
---
 CLAUDE.md                                     |  6 ++
 .../pih/warehouse/api/ApiController.groovy    | 18 +---
 .../warehouse/user/DashboardController.groovy | 24 ++----
 .../pih/warehouse/api/MegamenuService.groovy  | 32 ++-----
 .../org/pih/warehouse/core/UserService.groovy |  4 +
 .../roles/CustomRolePolicyService.groovy      | 18 ++++
 .../org/pih/warehouse/AuthTagLib.groovy       | 16 +---
 .../.openspec.yaml                            |  2 +
 .../design.md                                 | 84 +++++++++++++++++++
 .../proposal.md                               | 31 +++++++
 .../custom-role-policy-isolation/spec.md      | 72 ++++++++++++++++
 .../specs/custom-roles-access/spec.md         | 59 +++++++++++++
 .../tasks.md                                  | 35 ++++++++
 .../custom-role-policy-isolation/spec.md      | 21 ++++-
 openspec/specs/custom-roles-access/spec.md    | 24 +++++-
 src/js/reducers/sessionReducer.jsx            | 12 +--
 .../org/pih/warehouse/core/RoleType.groovy    |  2 +
 .../AuthTagLibCustomRolesSpec.groovy          | 32 +++++++
 .../core/RoleTypeCustomRolesSpec.groovy       | 28 +++++++
 .../roles/CustomRolePolicyServiceSpec.groovy  | 52 ++++++++++++
 .../warehouse/api/ApiControllerTests.groovy   | 22 +++++
 21 files changed, 507 insertions(+), 87 deletions(-)
 create mode 100644 openspec/changes/archive/2026-05-26-fix-custom-role-code-review/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-05-26-fix-custom-role-code-review/design.md
 create mode 100644 openspec/changes/archive/2026-05-26-fix-custom-role-code-review/proposal.md
 create mode 100644 openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-role-policy-isolation/spec.md
 create mode 100644 openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-roles-access/spec.md
 create mode 100644 openspec/changes/archive/2026-05-26-fix-custom-role-code-review/tasks.md
 create mode 100644 src/test/groovy/org/pih/warehouse/core/RoleTypeCustomRolesSpec.groovy

diff --git a/CLAUDE.md b/CLAUDE.md
index d89c0549a31..6afdf60e1ea 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -98,6 +98,12 @@ The Java/Spring rules in `.claude/rules/java/` apply with these Grails-specific
 
 ## Build & Run
 
+Before running frontend commands (`npm test`, `npm run watch`, `npm run bundle`, or Gradle tasks that invoke frontend bundling), use Node 14 in your shell:
+
+```bash
+nvm use 14
+```
+
 ```bash
 # Backend
 ./gradlew bootRun
diff --git a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
index e6d75928ff8..6bf8f1f959f 100644
--- a/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/api/ApiController.groovy
@@ -92,14 +92,9 @@ class ApiController {
         Map menuSectionsUrlParts = grailsApplication.config.openboxes.menuSectionsUrlParts
         User user = User.get(session?.user?.id)
 
-        Map<String, Boolean> customRolePolicyFlags = customRolePolicyService.getPolicyFlags(user, session?.warehouse?.id)
-        boolean hasFacilityStorekeeperPolicy = customRolePolicyFlags.hasFacilityStorekeeperPolicy
-        boolean hasRegionalWarehousePolicy = customRolePolicyFlags.hasRegionalWarehousePolicy
-        boolean hasRpcSuperuserPolicy = customRolePolicyFlags.hasRpcSuperuserPolicy
+        boolean hasCustomPolicy = customRolePolicyService.hasAnyCustomPolicy(user, session?.warehouse?.id)
         if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
-                !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy &&
-                !hasRpcSuperuserPolicy) {
+                !hasCustomPolicy) {
             menuConfig = grailsApplication.config.openboxes.requestorMegamenu;
         }
         List translatedMenu = megamenuService.buildAndTranslateMenu(menuConfig, user, location)
@@ -170,11 +165,6 @@ class ApiController {
         // TODO: investigate why in isUserManager method in userService there is Assistant role included
         ArrayList<RoleType> managerRoles = [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_MANAGER]
         boolean isUserManager = userService.getEffectiveRoles(user).any { managerRoles.contains(it.roleType) }
-        Map<String, Boolean> customRolePolicyFlags = customRolePolicyService.getPolicyFlags(session?.user, session.warehouse?.id)
-        boolean hasFacilityStorekeeperPolicy = customRolePolicyFlags.hasFacilityStorekeeperPolicy
-        boolean hasRegionalWarehousePolicy = customRolePolicyFlags.hasRegionalWarehousePolicy
-        boolean hasRpcSuperuserPolicy = customRolePolicyFlags.hasRpcSuperuserPolicy
-        boolean hasReportingUserPolicy = customRolePolicyFlags.hasReportingUserPolicy
         Map<String, Object> customRolePermissions = customRolePolicyService.getCustomRolePermissions(session?.user, session.warehouse?.id)
         def supportedActivities = location.supportedActivities ?: location.locationType.supportedActivities
         boolean isImpersonated = session.impersonateUserId ? true : false
@@ -221,10 +211,6 @@ class ApiController {
                 isUserApprover                : isUserApprover,
                 isUserRequestApprover         : isUserRequestApprover,
                 isUserManager                 : isUserManager,
-                hasFacilityStorekeeperPolicy  : hasFacilityStorekeeperPolicy,
-                hasRegionalWarehousePolicy    : hasRegionalWarehousePolicy,
-                hasRpcSuperuserPolicy         : hasRpcSuperuserPolicy,
-                hasReportingUserPolicy        : hasReportingUserPolicy,
                 customRolePermissions         : customRolePermissions,
                 supportedActivities           : supportedActivities,
                 isImpersonated                : isImpersonated,
diff --git a/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy b/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
index 6184ed131dc..65724423e54 100644
--- a/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
+++ b/grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy
@@ -113,13 +113,9 @@ class DashboardController {
             redirect(controller: "mobile")
             return
         }
-        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
+        boolean hasCustomPolicy = userService.hasAnyCustomPolicy(session?.user, session?.warehouse?.id)
         if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
-                !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy &&
-                !hasRpcSuperuserPolicy) {
+                !hasCustomPolicy) {
             redirect(controller: "stockMovement", action: "list", params: [direction: 'INBOUND'] )
             return
         }
@@ -176,13 +172,9 @@ class DashboardController {
         Map menuConfig = grailsApplication.config.openboxes.megamenu;
         User user = User.get(session?.user?.id)
 
-        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(user, session?.warehouse?.id)
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(user, session?.warehouse?.id)
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(user, session?.warehouse?.id)
+        boolean hasCustomPolicy = userService.hasAnyCustomPolicy(user, session?.warehouse?.id)
         if (userService.hasHighestRole(user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
-                !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy &&
-                !hasRpcSuperuserPolicy) {
+                !hasCustomPolicy) {
             menuConfig = grailsApplication.config.openboxes.requestorMegamenu;
         }
         List translatedMenu = megamenuService.buildAndTranslateMenu(menuConfig, user, location)
@@ -239,13 +231,9 @@ class DashboardController {
                 session.user = user
             }
 
-            boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
-            boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
-            boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
+            boolean hasCustomPolicy = userService.hasAnyCustomPolicy(session?.user, session?.warehouse?.id)
             if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
-                    !hasFacilityStorekeeperPolicy &&
-                    !hasRegionalWarehousePolicy &&
-                    !hasRpcSuperuserPolicy) {
+                    !hasCustomPolicy) {
                 redirect(controller: 'stockMovement', action: 'list' , params: [direction: 'INBOUND'])
                 return
             }
diff --git a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
index d45bf30e873..faa8eecc3ee 100644
--- a/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
+++ b/grails-app/services/org/pih/warehouse/api/MegamenuService.groovy
@@ -12,12 +12,10 @@ package org.pih.warehouse.api
 import grails.core.GrailsApplication
 import org.pih.warehouse.core.ActivityCode
 import org.pih.warehouse.core.Location
-import org.pih.warehouse.core.RoleType
 import org.pih.warehouse.core.User
 
 class MegamenuService {
 
-    def userService
     def customRolePolicyService
     GrailsApplication grailsApplication
     def grailsLinkGenerator
@@ -26,24 +24,6 @@ class MegamenuService {
         return grailsApplication.mainContext.getBean('org.pih.warehouse.MessageTagLib')
     }
 
-    private boolean userHasMinimumMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
-        if (customRolePolicyService.shouldAllowRpcSuperuserMenuMinRole(user, location?.id, sectionId, roleTypes)) {
-            return true
-        }
-        Set<String> acceptedRoleTypeNames = (RoleType.expand(roleTypes)*.name()) as Set<String>
-        Set<String> effectiveRoleNames = (userService.getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
-        return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
-    }
-
-    private boolean userHasSupplementalMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
-        if (customRolePolicyService.shouldAllowRpcSuperuserMenuSupplementalRole(user, location?.id, sectionId, roleTypes)) {
-            return true
-        }
-        Set<String> acceptedRoleTypeNames = (roleTypes*.name()) as Set<String>
-        Set<String> effectiveRoleNames = (userService.getEffectiveRoles(user, location)*.roleType*.name()).findAll { it } as Set<String>
-        return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
-    }
-
     Map buildAndTranslateSections(section, String key, User user, Location location) {
         def label = getMessageTagLib().message(code: section.label, default: section.defaultLabel)
         def translatedSection
@@ -79,11 +59,11 @@ class MegamenuService {
             if (it.enabled == false) {
                 return
             }
-            if (minRole && !userHasMinimumMenuRole(user, location, [minRole], sectionId)) {
+            if (minRole && !customRolePolicyService.userHasMinimumMenuRole(user, location, [minRole], sectionId)) {
                 return
             }
             def roles = it.supplementalRoles
-            if (roles && !userHasSupplementalMenuRole(user, location, roles, sectionId)) {
+            if (roles && !customRolePolicyService.userHasSupplementalMenuRole(user, location, roles, sectionId)) {
                 return
             }
             ActivityCode[] activitiesAny = it.requiredActivitiesAny ?: []
@@ -111,11 +91,11 @@ class MegamenuService {
                 return
             }
             def minRole = it.minimumRequiredRole
-            if (minRole && !userHasMinimumMenuRole(user, location, [minRole], sectionId)) {
+            if (minRole && !customRolePolicyService.userHasMinimumMenuRole(user, location, [minRole], sectionId)) {
                 return
             }
             def roles = it.supplementalRoles
-            if (roles && !userHasSupplementalMenuRole(user, location, roles, sectionId)) {
+            if (roles && !customRolePolicyService.userHasSupplementalMenuRole(user, location, roles, sectionId)) {
                 return
             }
             ActivityCode[] activitiesAny = it.requiredActivitiesAny ?: []
@@ -147,11 +127,11 @@ class MegamenuService {
         def parsedMenuConfig = []
         menuConfig.each { key, value ->
             def minRole = value.minimumRequiredRole
-            if (minRole && !userHasMinimumMenuRole(user, location, [minRole], key)) {
+            if (minRole && !customRolePolicyService.userHasMinimumMenuRole(user, location, [minRole], key)) {
                 return
             }
             def roles = value.supplementalRoles
-            if (roles && !userHasSupplementalMenuRole(user, location, roles, key)) {
+            if (roles && !customRolePolicyService.userHasSupplementalMenuRole(user, location, roles, key)) {
                 return
             }
             ActivityCode[] activitiesAny = value.requiredActivitiesAny ?: []
diff --git a/grails-app/services/org/pih/warehouse/core/UserService.groovy b/grails-app/services/org/pih/warehouse/core/UserService.groovy
index d303fcdaa23..aa0aeebf9e4 100644
--- a/grails-app/services/org/pih/warehouse/core/UserService.groovy
+++ b/grails-app/services/org/pih/warehouse/core/UserService.groovy
@@ -323,6 +323,10 @@ class UserService {
         return Boolean.TRUE.equals(customRolePolicyService.hasCustomPolicy(u, locationId, RoleType.ROLE_REPORTING_USER))
     }
 
+    Boolean hasAnyCustomPolicy(User u, String locationId) {
+        return Boolean.TRUE.equals(customRolePolicyService.hasAnyCustomPolicy(u, locationId))
+    }
+
     // Checks if requestor role exist for any location - for location chooser purposes
     Boolean hasRoleRequestorInAnyLocations(User u) {
         if (u) {
diff --git a/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy b/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
index 71b091b17db..023a7efebb2 100644
--- a/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
+++ b/grails-app/services/org/pih/warehouse/custom/roles/CustomRolePolicyService.groovy
@@ -301,6 +301,24 @@ class CustomRolePolicyService {
                 roleTypes?.any { it in [RoleType.ROLE_SUPERUSER, RoleType.ROLE_ADMIN, RoleType.ROLE_REGIONAL_WAREHOUSE] }
     }
 
+    boolean userHasMinimumMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
+        if (shouldAllowRpcSuperuserMenuMinRole(user, location?.id, sectionId, roleTypes)) {
+            return true
+        }
+        Set<String> acceptedRoleTypeNames = (RoleType.expand(roleTypes)*.name()) as Set<String>
+        Set<String> effectiveRoleNames = getEffectiveRoleNames(user, location?.id)
+        return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
+    }
+
+    boolean userHasSupplementalMenuRole(User user, Location location, Collection roleTypes, String sectionId = null) {
+        if (shouldAllowRpcSuperuserMenuSupplementalRole(user, location?.id, sectionId, roleTypes)) {
+            return true
+        }
+        Set<String> acceptedRoleTypeNames = (roleTypes*.name()) as Set<String>
+        Set<String> effectiveRoleNames = getEffectiveRoleNames(user, location?.id)
+        return effectiveRoleNames.any { acceptedRoleTypeNames.contains(it) }
+    }
+
     private RoleType getActivePolicy(User user, String locationId) {
         if (!user || !locationId) {
             return null
diff --git a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
index 315d013c29c..3007b90e2f2 100644
--- a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
+++ b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
@@ -141,24 +141,16 @@ class AuthTagLib {
     }
 
     def hasHighestRoleAuthenticated = { attrs, body ->
-        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
+        boolean hasCustomPolicy = customRolePolicyService.hasAnyCustomPolicy(session?.user, session?.warehouse?.id)
         if (userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) &&
-                !hasFacilityStorekeeperPolicy &&
-                !hasRegionalWarehousePolicy &&
-                !hasRpcSuperuserPolicy)
+                !hasCustomPolicy)
             out << body()
     }
 
     def hasHigherRoleThanAuthenticated = { attrs, body ->
-        boolean hasFacilityStorekeeperPolicy = userService.hasFacilityStorekeeperPolicy(session?.user, session?.warehouse?.id)
-        boolean hasRegionalWarehousePolicy = userService.hasRegionalWarehousePolicy(session?.user, session?.warehouse?.id)
-        boolean hasRpcSuperuserPolicy = userService.hasRpcSuperuserPolicy(session?.user, session?.warehouse?.id)
+        boolean hasCustomPolicy = customRolePolicyService.hasAnyCustomPolicy(session?.user, session?.warehouse?.id)
         if (!userService.hasHighestRole(session?.user, session?.warehouse?.id, RoleType.ROLE_AUTHENTICATED) ||
-                hasFacilityStorekeeperPolicy ||
-                hasRegionalWarehousePolicy ||
-                hasRpcSuperuserPolicy)
+                hasCustomPolicy)
             out << body()
     }
 }
diff --git a/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/.openspec.yaml b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/.openspec.yaml
new file mode 100644
index 00000000000..fd706ac496e
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-26
diff --git a/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/design.md b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/design.md
new file mode 100644
index 00000000000..d07e319305a
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/design.md
@@ -0,0 +1,84 @@
+## Context
+
+The custom roles PR introduces four policy-driven operational roles and wires them through backend authorization, menu visibility, app-context payloads, server-rendered taglibs, and React action gates. Manual review found several places where upstream files enumerate individual custom roles directly, omit `ROLE_REPORTING_USER`, or duplicate role-resolution logic that should live behind the custom policy layer.
+
+This fork must keep custom behavior isolated where possible. Because these role policies necessarily hook into upstream controllers, taglibs, and services, the implementation should minimize upstream edits and centralize the custom logic in `CustomRolePolicyService` and frontend helpers under `src/js/custom/roles`.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Replace repeated custom-role flag checks with canonical `hasAnyCustomPolicy` or named capability methods.
+- Keep the app-context payload focused on `customRolePermissions` instead of redundant per-role policy booleans.
+- Make `ROLE_REPORTING_USER` behavior consistent with the other custom policies in authenticated/requestor routing decisions.
+- Centralize menu authorization helper logic outside `MegamenuService` so menu construction delegates policy decisions.
+- Clarify the intended hierarchy rule: custom roles are policy roles at priority `4`, below `ROLE_ASSISTANT`, and higher core roles retain standard behavior.
+- Add regression coverage for location chooser behavior, policy precedence, role priority expansion, and menu helper decisions.
+
+**Non-Goals:**
+
+- Redesign the custom role access matrix.
+- Add new roles or migrations.
+- Change standard OpenBoxes authorization for users without an active custom policy.
+- Rework frontend action visibility beyond consuming the canonical permissions payload.
+
+## Decisions
+
+1. Use `CustomRolePolicyService.hasAnyCustomPolicy` for requestor/authenticated branching.
+
+Rationale: The branch should answer “is a custom policy active?” rather than enumerate every custom role. This fixes the missing `ROLE_REPORTING_USER` case and avoids future omissions.
+
+Alternative considered: Add `hasReportingUserPolicy` alongside the existing three checks. That is smaller but preserves the duplication and future maintenance risk.
+
+2. Keep `customRolePermissions` as the session payload contract.
+
+Rationale: `customRolePermissions.activeCustomRolePolicy` identifies the active policy, and the remaining properties express behavior. Returning separate `has{role}Policy` fields duplicates state and encourages consumers to branch on role names instead of capabilities.
+
+Alternative considered: Keep both payloads for compatibility. This is unnecessary unless existing committed frontend code consumes the individual flags.
+
+3. Move menu role decisions into the policy layer or a reusable service helper.
+
+Rationale: `MegamenuService` should build and translate menus. Custom exceptions such as RPC Superuser seeing Assistant-gated purchasing/product sections are authorization decisions and belong with the custom role policy.
+
+Alternative considered: Keep private helper methods in `MegamenuService`. This works functionally but repeats role-resolution logic and blurs service responsibilities.
+
+4. Treat custom role priority `4` as an explicit policy-role hierarchy level.
+
+Rationale: Priority `4` makes custom roles stronger than `ROLE_AUTHENTICATED` but weaker than `ROLE_ASSISTANT`, preventing automatic access to Assistant-gated write actions. Policy-specific allowances are then granted by `CustomRolePolicyService`.
+
+Alternative considered: Give RPC Superuser a higher core-role-like priority. That would make it pass many generic checks implicitly and undermine the explicit policy matrix.
+
+5. Preserve higher core role precedence.
+
+Rationale: The existing spec states that Assistant, Manager, Admin, or Superuser effective access should not be reduced by an additional custom role. Implementation should keep this behavior but document and test it, especially because `ROLE_ASSISTANT` in `HIGHER_CORE_ROLE_NAMES` is easy to misread.
+
+Alternative considered: Let custom roles restrict mixed-role users. That would be more restrictive but would contradict the current access spec and surprise users who already hold core roles.
+
+## Risks / Trade-offs
+
+- Risk: Removing individual app-context flags could break an unnoticed frontend consumer. Mitigation: search for all usages before removal and keep only if a current committed consumer exists.
+- Risk: Location chooser semantics for default custom roles may be broader than intended. Mitigation: add tests for default-role and location-role-only users and preserve the current approved behavior explicitly.
+- Risk: Moving menu helper logic could accidentally change menu visibility. Mitigation: add focused `MegamenuService` or `CustomRolePolicyService` tests for minimum role, supplemental role, and RPC Superuser exceptions.
+- Risk: Upstream-file edits can increase merge conflicts. Mitigation: keep upstream changes surgical and document upstream touch points in this design.
+
+## Migration Plan
+
+No database migration is required. Deploy as a code-only change. Rollback is the previous custom-role PR behavior.
+
+Implementation should proceed in small steps: add reusable policy/helper methods first, switch callers, remove redundant payload fields if unused, then add regression tests.
+
+## Open Questions
+
+- Should default custom roles see all enabled login/location-chooser locations, or should custom roles only grant access through explicit location assignments? The current implementation appears to allow default custom roles to behave like default Assistant for location visibility; tests should lock whichever behavior is approved.
+
+## Upstream Touch Points
+
+- `grails-app/controllers/org/pih/warehouse/api/ApiController.groovy`: session payload and requestor menu branching.
+- `grails-app/controllers/org/pih/warehouse/api/LocationApiController.groovy`: location chooser role handling.
+- `grails-app/controllers/org/pih/warehouse/user/DashboardController.groovy`: authenticated/requestor redirect and megamenu branching.
+- `grails-app/services/org/pih/warehouse/api/MegamenuService.groovy`: menu authorization delegation.
+- `grails-app/services/org/pih/warehouse/core/LocationService.groovy`: login location role handling.
+- `grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy`: authenticated/higher-than-authenticated checks.
+- `src/main/groovy/org/pih/warehouse/core/RoleType.groovy`: comments/tests around role priority and expansion.
+
+Deploy status: not deployed; proposal only.
diff --git a/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/proposal.md b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/proposal.md
new file mode 100644
index 00000000000..9f1de922b2d
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/proposal.md
@@ -0,0 +1,31 @@
+## Why
+
+Manual review of the custom roles PR found duplicated policy checks, inconsistent treatment of `ROLE_REPORTING_USER`, and unclear role hierarchy/location chooser behavior. Addressing these now reduces authorization drift and makes the custom-role implementation safer to maintain across upstream merges.
+
+## What Changes
+
+- Centralize custom-policy presence checks instead of enumerating individual custom roles in controllers and taglibs.
+- Remove redundant per-role policy flags from the app-context payload when the canonical `customRolePermissions` payload already conveys active policy and capabilities.
+- Clarify and test location chooser behavior for default custom roles versus location-scoped custom roles.
+- Move menu role helper logic out of `MegamenuService` into the canonical custom-role policy layer or a reusable service method.
+- Document and test the intended relationship between custom roles, `ROLE_ASSISTANT`, and role priority `4`.
+- Preserve backend enforcement as the source of truth and keep frontend permissions as UI visibility helpers only.
+
+## Capabilities
+
+### New Capabilities
+
+- None.
+
+### Modified Capabilities
+
+- `custom-role-policy-isolation`: Tighten the requirement that custom-role-sensitive decisions use canonical policy/capability methods rather than repeated direct role-specific flags.
+- `custom-roles-access`: Clarify custom-role hierarchy, higher core role precedence, and location chooser behavior for default and location-scoped custom roles.
+
+## Impact
+
+- Backend controllers: `ApiController`, `DashboardController`, and `LocationApiController` custom-role checks and app-context payload.
+- Backend services: `CustomRolePolicyService`, `MegamenuService`, `LocationService`, and possibly `UserService` helper methods.
+- Backend taglibs: `AuthTagLib` role policy checks.
+- Role model: comments/tests around `RoleType` priority and expansion behavior.
+- Tests: backend unit tests for policy flags, menu helpers, location chooser behavior, role priority/expansion, and higher core role precedence.
diff --git a/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-role-policy-isolation/spec.md b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-role-policy-isolation/spec.md
new file mode 100644
index 00000000000..dead9de2848
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-role-policy-isolation/spec.md
@@ -0,0 +1,72 @@
+## MODIFIED Requirements
+
+### Requirement: Custom role policy SHALL be isolated behind custom services and helpers
+The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy. Controllers, GSPs, taglibs, and React components SHALL use reusable capability checks when a custom-role-sensitive business decision is needed, instead of duplicating direct custom role-name checks or individual per-role policy flags outside the canonical policy layer.
+
+#### Scenario: Custom backend policy is discoverable
+- **WHEN** a developer reviews backend custom-role authorization behavior
+- **THEN** the role matrix, endpoint restrictions, and menu/action capability decisions SHALL be implemented under `org.pih.warehouse.custom.*`
+- **AND** upstream backend files SHALL NOT contain duplicated custom-role matrices or role-specific endpoint lists
+
+#### Scenario: Custom backend callers use capability checks
+- **WHEN** controllers, interceptors, services, taglibs, or GSPs evaluate custom-role-sensitive actions such as stocklist management, inbound movement creation, requestor menu branching, or authenticated-role branching
+- **THEN** they SHALL delegate to `CustomRolePolicyService` capability methods or backend permission payloads derived from that service
+- **AND** they SHALL NOT repeat direct checks for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, or `ROLE_REPORTING_USER` for those business decisions
+
+#### Scenario: Custom frontend policy is discoverable
+- **WHEN** a developer reviews frontend custom-role action visibility
+- **THEN** custom-role permission helpers SHALL live under `src/js/custom/*`
+- **AND** React components outside `src/js/custom/*` SHALL consume those helpers or the canonical permission payload instead of repeating custom-role checks inline
+
+#### Scenario: Direct role-name references are limited to policy plumbing
+- **WHEN** a developer searches for custom role identifiers
+- **THEN** direct custom role-name references SHALL be limited to the canonical policy service, role constants, role seeding or migrations, tests, and compatibility plumbing whose explicit purpose is role membership exposure
+- **AND** custom-role-sensitive business decisions outside those locations SHALL use named capability checks
+
+#### Scenario: Custom policy presence is checked generically
+- **WHEN** code needs to decide whether the active user has any custom-role policy
+- **THEN** it SHALL use a canonical policy-presence method such as `CustomRolePolicyService.hasAnyCustomPolicy`
+- **AND** it SHALL NOT enumerate individual custom policy flags in the caller
+
+### Requirement: Custom role decisions SHALL use one canonical policy model
+The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, app-context permissions, and frontend action gates from one canonical custom-role policy model. The backend `CustomRolePolicyService` SHALL be the source of truth for capability decisions, and frontend custom-role helpers SHALL consume backend-provided permissions instead of deriving the access matrix independently. Frontend helpers SHALL only control UI visibility and SHALL NOT be treated as authorization enforcement.
+
+#### Scenario: Backend callers receive consistent decisions
+- **WHEN** the interceptor, menu service, taglibs, controllers, or app-context generation ask whether a custom-role user can perform an action
+- **THEN** they SHALL receive decisions derived from the same backend custom-role policy service
+
+#### Scenario: Frontend callers receive consistent decisions
+- **WHEN** React screens decide whether to render custom-role-sensitive actions
+- **THEN** they SHALL use backend-provided custom-role permissions through custom frontend helpers
+- **AND** the visible action SHALL match the backend enforcement decision for the same workflow
+
+#### Scenario: Named capabilities remain consistent across layers
+- **WHEN** a named capability such as `canManageStocklists`, `canCreateInboundMovement`, `canManageProducts`, or `canUseSuperuserPurchasingActions` is exposed to more than one caller
+- **THEN** backend enforcement, server-rendered visibility, and React visibility SHALL derive that capability from `CustomRolePolicyService`
+- **AND** any frontend helper for the capability SHALL read the canonical permission payload rather than checking role names directly
+
+#### Scenario: Frontend helpers do not duplicate authorization logic
+- **WHEN** a frontend helper decides whether to show a custom-role-sensitive action
+- **THEN** it SHALL use the backend-provided custom role permission payload or default visibility behavior
+- **AND** it SHALL NOT independently reimplement the custom role access matrix from role names
+
+#### Scenario: Backend still denies hidden restricted actions
+- **WHEN** a custom-role user calls a restricted action directly despite the frontend hiding that action
+- **THEN** backend enforcement SHALL deny the request according to `CustomRolePolicyService`
+- **AND** the frontend helper SHALL NOT be the only authorization layer
+
+#### Scenario: Standard core roles are unaffected without custom policy
+- **WHEN** a user has only standard OpenBoxes roles and no active custom role policy
+- **THEN** custom-role capability checks and frontend permission helpers SHALL preserve existing standard-role behavior
+- **AND** the custom policy layer SHALL NOT remove access granted by the standard OpenBoxes authorization model
+- **AND** custom-only manage capabilities SHALL NOT grant product or stocklist write UI to standard users who lack the existing core-role access
+
+#### Scenario: App context exposes canonical custom permissions
+- **WHEN** the frontend requests app context for a user with or without an active custom role policy
+- **THEN** the response SHALL include the canonical `customRolePermissions` payload
+- **AND** the response SHALL NOT require consumers to combine separate per-role policy flags with the canonical payload to determine custom-role behavior
+
+#### Scenario: Menu authorization delegates policy exceptions
+- **WHEN** megamenu construction evaluates minimum roles, supplemental roles, or custom policy exceptions such as RPC Superuser menu access
+- **THEN** the decision SHALL be delegated to a reusable service method derived from the canonical custom-role policy model
+- **AND** `MegamenuService` SHALL remain responsible for menu construction and translation rather than embedding custom-role matrices
diff --git a/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-roles-access/spec.md b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-roles-access/spec.md
new file mode 100644
index 00000000000..84897f76571
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/specs/custom-roles-access/spec.md
@@ -0,0 +1,59 @@
+## MODIFIED Requirements
+
+### Requirement: Custom operational roles SHALL be assignable role types
+The system SHALL define and seed assignable role records for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, and `ROLE_REPORTING_USER`. The backend `RoleType` enum and frontend role constants SHALL expose the same role identifiers. These custom roles SHALL be treated as policy roles below `ROLE_ASSISTANT` and above `ROLE_AUTHENTICATED` in the core role ordering so they do not automatically satisfy Assistant-level authorization checks.
+
+#### Scenario: Custom roles are available for assignment
+- **WHEN** an administrator opens user role assignment for a location
+- **THEN** the role options SHALL include Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User
+
+#### Scenario: Frontend and backend use matching role identifiers
+- **WHEN** the session payload includes one of the custom role identifiers
+- **THEN** frontend permission checks SHALL evaluate the same identifier used by backend authorization checks
+
+#### Scenario: Custom roles do not expand to Assistant access
+- **WHEN** authorization expands `ROLE_ASSISTANT` or compares custom roles against the core hierarchy
+- **THEN** Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User SHALL NOT automatically satisfy Assistant, Manager, Admin, or Superuser access
+- **AND** any write access above Browser/Authenticated behavior SHALL be granted explicitly by the custom policy service
+
+#### Scenario: Role priority is documented
+- **WHEN** a developer reviews the `RoleType` enum
+- **THEN** the custom role priority SHALL be documented as a policy-role level below Assistant and above Authenticated
+- **AND** tests SHALL cover that role expansion preserves this hierarchy
+
+### Requirement: Custom role enforcement SHALL be applied consistently across UI and backend
+The system SHALL enforce custom role policy at menu visibility, page action visibility, server-rendered views, React views, controller interceptors, and API/controller endpoints. UI hiding SHALL improve usability but SHALL NOT be the only enforcement layer. Requestor/authenticated routing decisions SHALL treat every active custom policy consistently, including `ROLE_REPORTING_USER`.
+
+#### Scenario: Hidden action is still denied by direct URL
+- **WHEN** a custom-role user calls a hidden action directly by URL or API
+- **THEN** the backend SHALL deny the request according to that role's policy
+
+#### Scenario: Allowed action remains visible and executable
+- **WHEN** a custom-role user opens a module with Read/Write access
+- **THEN** the allowed page actions SHALL be visible
+- **AND** the matching backend request SHALL be accepted
+
+#### Scenario: Higher core role takes precedence
+- **WHEN** a user has a custom role and also has Assistant, Manager, Admin, or Superuser access in the effective current-location roles
+- **THEN** the higher core role SHALL retain its existing authorization behavior
+- **AND** custom role restrictions SHALL NOT reduce that higher-role access
+- **AND** this precedence SHALL be covered by regression tests so `ROLE_ASSISTANT` handling is explicit
+
+#### Scenario: Unrelated existing roles are unchanged
+- **WHEN** a user has only pre-existing OpenBoxes roles
+- **THEN** authorization, menu visibility, and page actions SHALL behave as they did before this change
+
+#### Scenario: Location-scoped custom role can choose an authorized warehouse
+- **WHEN** a custom-role-only user has the role assigned only at a location and logs in without a remembered warehouse
+- **THEN** the location chooser SHALL return the authorized locations for that user
+- **AND** the user SHALL NOT need a global default role or remembered warehouse to select an authorized location
+
+#### Scenario: Default custom role location visibility is explicit
+- **WHEN** a custom-role-only user has Facility Storekeeper, Regional Warehouse User, RPC Superuser, or Reporting User assigned as a default role
+- **THEN** location chooser behavior SHALL follow the approved default-role rule for custom roles
+- **AND** automated tests SHALL distinguish default custom roles from location-scoped custom roles
+
+#### Scenario: Active custom policies are not treated as plain authenticated requestors
+- **WHEN** a user has highest role `ROLE_AUTHENTICATED` or otherwise enters authenticated/requestor menu branching while an active custom policy exists
+- **THEN** the system SHALL use custom-policy-aware branching rather than the plain requestor menu behavior
+- **AND** Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User SHALL be handled consistently
diff --git a/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/tasks.md b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/tasks.md
new file mode 100644
index 00000000000..cc9f819fecf
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-fix-custom-role-code-review/tasks.md
@@ -0,0 +1,35 @@
+## 1. Policy Helpers
+
+- [x] 1.1 Add or expose a canonical `hasAnyCustomPolicy` helper through the service layer used by upstream callers.
+- [x] 1.2 Add reusable menu role decision helpers for minimum-role and supplemental-role checks, including RPC Superuser exceptions.
+- [x] 1.3 Add a short code comment documenting why custom role priority `4` is below Assistant and above Authenticated.
+
+## 2. Backend Caller Cleanup
+
+- [x] 2.1 Update `ApiController.getMenuConfig` to use a generic custom-policy presence check instead of enumerating individual custom policies.
+- [x] 2.2 Update `ApiController.getAppContext` to avoid exposing redundant per-role policy flags unless a current committed consumer requires them.
+- [x] 2.3 Update `DashboardController` authenticated/requestor branching to use a generic custom-policy presence check consistently, including Reporting User.
+- [x] 2.4 Update `AuthTagLib` authenticated/higher-than-authenticated tags to use a generic custom-policy presence check.
+- [x] 2.5 Update `MegamenuService` to delegate menu authorization decisions to reusable policy/service helpers rather than private duplicated role-resolution logic.
+
+## 3. Location Chooser Behavior
+
+- [x] 3.1 Confirm the approved behavior for default custom roles in location chooser and login location flows.
+- [x] 3.2 Update `LocationApiController` and `LocationService` only if default custom roles should not behave like default Assistant for location visibility.
+- [x] 3.3 Preserve location-scoped custom role selection for users without a default chooser role.
+
+## 4. Regression Tests
+
+- [x] 4.1 Add backend tests proving Reporting User is handled by generic custom-policy branching and not omitted from authenticated/requestor decisions.
+- [x] 4.2 Add backend tests for app-context custom permissions and absence of redundant role flags if removed.
+- [x] 4.3 Add backend tests for menu minimum-role and supplemental-role helper decisions, including RPC Superuser menu exceptions.
+- [x] 4.4 Add backend tests for default custom roles versus location-scoped custom roles in location chooser/login location behavior.
+- [x] 4.5 Add backend tests proving higher core roles, including Assistant, take precedence over custom policy restrictions.
+- [x] 4.6 Add tests proving `RoleType.expand(RoleType.ROLE_ASSISTANT)` does not accidentally include custom roles and that priority `4` remains below Assistant.
+
+## 5. Verification
+
+- [x] 5.1 Run focused backend tests for custom role policy, taglib, location chooser, and menu behavior.
+- [x] 5.2 Run frontend tests if app-context/session payload changes affect React consumers.
+- [x] 5.3 Search for remaining direct custom-role checks outside canonical policy plumbing and justify or remove any business-decision duplicates.
+- [x] 5.4 Verify no generated bundles or unrelated upstream-file formatting changes are included.
diff --git a/openspec/specs/custom-role-policy-isolation/spec.md b/openspec/specs/custom-role-policy-isolation/spec.md
index 67e4c622118..6fa5dbe59c4 100644
--- a/openspec/specs/custom-role-policy-isolation/spec.md
+++ b/openspec/specs/custom-role-policy-isolation/spec.md
@@ -4,7 +4,7 @@
 TBD - created by archiving change custom-roles-refactor. Update Purpose after archive.
 ## Requirements
 ### Requirement: Custom role policy SHALL be isolated behind custom services and helpers
-The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy. Controllers, GSPs, taglibs, and React components SHALL use reusable capability checks when a custom-role-sensitive business decision is needed, instead of duplicating direct custom role-name checks outside the canonical policy layer.
+The system SHALL keep custom-role authorization rules in custom backend services under `org.pih.warehouse.custom.*` and custom frontend helpers under `src/js/custom/*`. Upstream files SHALL only contain narrow delegation calls when required to connect existing OpenBoxes extension points to the custom policy. Controllers, GSPs, taglibs, and React components SHALL use reusable capability checks when a custom-role-sensitive business decision is needed, instead of duplicating direct custom role-name checks or individual per-role policy flags outside the canonical policy layer.
 
 #### Scenario: Custom backend policy is discoverable
 - **WHEN** a developer reviews backend custom-role authorization behavior
@@ -12,7 +12,7 @@ The system SHALL keep custom-role authorization rules in custom backend services
 - **AND** upstream backend files SHALL NOT contain duplicated custom-role matrices or role-specific endpoint lists
 
 #### Scenario: Custom backend callers use capability checks
-- **WHEN** controllers, interceptors, services, taglibs, or GSPs evaluate custom-role-sensitive actions such as stocklist management, inbound movement creation, or product management
+- **WHEN** controllers, interceptors, services, taglibs, or GSPs evaluate custom-role-sensitive actions such as stocklist management, inbound movement creation, requestor menu branching, or authenticated-role branching
 - **THEN** they SHALL delegate to `CustomRolePolicyService` capability methods or backend permission payloads derived from that service
 - **AND** they SHALL NOT repeat direct checks for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, or `ROLE_REPORTING_USER` for those business decisions
 
@@ -26,8 +26,13 @@ The system SHALL keep custom-role authorization rules in custom backend services
 - **THEN** direct custom role-name references SHALL be limited to the canonical policy service, role constants, role seeding or migrations, tests, and compatibility plumbing whose explicit purpose is role membership exposure
 - **AND** custom-role-sensitive business decisions outside those locations SHALL use named capability checks
 
+#### Scenario: Custom policy presence is checked generically
+- **WHEN** code needs to decide whether the active user has any custom-role policy
+- **THEN** it SHALL use a canonical policy-presence method such as `CustomRolePolicyService.hasAnyCustomPolicy`
+- **AND** it SHALL NOT enumerate individual custom policy flags in the caller
+
 ### Requirement: Custom role decisions SHALL use one canonical policy model
-The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, and frontend action gates from one canonical custom-role policy model. The backend `CustomRolePolicyService` SHALL be the source of truth for capability decisions, and frontend custom-role helpers SHALL consume backend-provided permissions instead of deriving the access matrix independently. Frontend helpers SHALL only control UI visibility and SHALL NOT be treated as authorization enforcement.
+The system SHALL evaluate custom-role route access, menu visibility, page action visibility, GSP action visibility, API access, app-context permissions, and frontend action gates from one canonical custom-role policy model. The backend `CustomRolePolicyService` SHALL be the source of truth for capability decisions, and frontend custom-role helpers SHALL consume backend-provided permissions instead of deriving the access matrix independently. Frontend helpers SHALL only control UI visibility and SHALL NOT be treated as authorization enforcement.
 
 #### Scenario: Backend callers receive consistent decisions
 - **WHEN** the interceptor, menu service, taglibs, controllers, or app-context generation ask whether a custom-role user can perform an action
@@ -59,6 +64,16 @@ The system SHALL evaluate custom-role route access, menu visibility, page action
 - **AND** the custom policy layer SHALL NOT remove access granted by the standard OpenBoxes authorization model
 - **AND** custom-only manage capabilities SHALL NOT grant product or stocklist write UI to standard users who lack the existing core-role access
 
+#### Scenario: App context exposes canonical custom permissions
+- **WHEN** the frontend requests app context for a user with or without an active custom role policy
+- **THEN** the response SHALL include the canonical `customRolePermissions` payload
+- **AND** the response SHALL NOT require consumers to combine separate per-role policy flags with the canonical payload to determine custom-role behavior
+
+#### Scenario: Menu authorization delegates policy exceptions
+- **WHEN** megamenu construction evaluates minimum roles, supplemental roles, or custom policy exceptions such as RPC Superuser menu access
+- **THEN** the decision SHALL be delegated to a reusable service method derived from the canonical custom-role policy model
+- **AND** `MegamenuService` SHALL remain responsible for menu construction and translation rather than embedding custom-role matrices
+
 ### Requirement: Custom role behavior SHALL have regression coverage
 The system SHALL include automated regression tests for custom-role policy resolution, menu visibility, page action visibility, direct controller/API enforcement, location chooser behavior, and frontend permission helpers.
 
diff --git a/openspec/specs/custom-roles-access/spec.md b/openspec/specs/custom-roles-access/spec.md
index 61eda46dc68..d1745b72b2d 100644
--- a/openspec/specs/custom-roles-access/spec.md
+++ b/openspec/specs/custom-roles-access/spec.md
@@ -8,7 +8,7 @@ seeded role records, and role constants.
 Source change: `openspec/changes/archive/2026-05-21-custom-roles/`
 ## Requirements
 ### Requirement: Custom operational roles SHALL be assignable role types
-The system SHALL define and seed assignable role records for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, and `ROLE_REPORTING_USER`. The backend `RoleType` enum and frontend role constants SHALL expose the same role identifiers.
+The system SHALL define and seed assignable role records for `ROLE_FACILITY_STOREKEEPER`, `ROLE_REGIONAL_WAREHOUSE`, `ROLE_RPC_SUPERUSER`, and `ROLE_REPORTING_USER`. The backend `RoleType` enum and frontend role constants SHALL expose the same role identifiers. These custom roles SHALL be treated as policy roles below `ROLE_ASSISTANT` and above `ROLE_AUTHENTICATED` in the core role ordering so they do not automatically satisfy Assistant-level authorization checks.
 
 #### Scenario: Custom roles are available for assignment
 - **WHEN** an administrator opens user role assignment for a location
@@ -18,6 +18,16 @@ The system SHALL define and seed assignable role records for `ROLE_FACILITY_STOR
 - **WHEN** the session payload includes one of the custom role identifiers
 - **THEN** frontend permission checks SHALL evaluate the same identifier used by backend authorization checks
 
+#### Scenario: Custom roles do not expand to Assistant access
+- **WHEN** authorization expands `ROLE_ASSISTANT` or compares custom roles against the core hierarchy
+- **THEN** Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User SHALL NOT automatically satisfy Assistant, Manager, Admin, or Superuser access
+- **AND** any write access above Browser/Authenticated behavior SHALL be granted explicitly by the custom policy service
+
+#### Scenario: Role priority is documented
+- **WHEN** a developer reviews the `RoleType` enum
+- **THEN** the custom role priority SHALL be documented as a policy-role level below Assistant and above Authenticated
+- **AND** tests SHALL cover that role expansion preserves this hierarchy
+
 ### Requirement: Facility Storekeeper SHALL follow the approved access matrix
 The system SHALL enforce the Facility Storekeeper policy:
 
@@ -139,7 +149,7 @@ The system SHALL enforce the Reporting User policy:
 - **THEN** the views SHALL be available when the user is authorized for the current location
 
 ### Requirement: Custom role enforcement SHALL be applied consistently across UI and backend
-The system SHALL enforce custom role policy at menu visibility, page action visibility, server-rendered views, React views, controller interceptors, and API/controller endpoints. UI hiding SHALL improve usability but SHALL NOT be the only enforcement layer.
+The system SHALL enforce custom role policy at menu visibility, page action visibility, server-rendered views, React views, controller interceptors, and API/controller endpoints. UI hiding SHALL improve usability but SHALL NOT be the only enforcement layer. Requestor/authenticated routing decisions SHALL treat every active custom policy consistently, including `ROLE_REPORTING_USER`.
 
 #### Scenario: Hidden action is still denied by direct URL
 - **WHEN** a custom-role user calls a hidden action directly by URL or API
@@ -154,6 +164,7 @@ The system SHALL enforce custom role policy at menu visibility, page action visi
 - **WHEN** a user has a custom role and also has Assistant, Manager, Admin, or Superuser access in the effective current-location roles
 - **THEN** the higher core role SHALL retain its existing authorization behavior
 - **AND** custom role restrictions SHALL NOT reduce that higher-role access
+- **AND** this precedence SHALL be covered by regression tests so `ROLE_ASSISTANT` handling is explicit
 
 #### Scenario: Unrelated existing roles are unchanged
 - **WHEN** a user has only pre-existing OpenBoxes roles
@@ -164,3 +175,12 @@ The system SHALL enforce custom role policy at menu visibility, page action visi
 - **THEN** the location chooser SHALL return the authorized locations for that user
 - **AND** the user SHALL NOT need a global default role or remembered warehouse to select an authorized location
 
+#### Scenario: Default custom role location visibility is explicit
+- **WHEN** a custom-role-only user has Facility Storekeeper, Regional Warehouse User, RPC Superuser, or Reporting User assigned as a default role
+- **THEN** location chooser behavior SHALL follow the approved default-role rule for custom roles
+- **AND** automated tests SHALL distinguish default custom roles from location-scoped custom roles
+
+#### Scenario: Active custom policies are not treated as plain authenticated requestors
+- **WHEN** a user has highest role `ROLE_AUTHENTICATED` or otherwise enters authenticated/requestor menu branching while an active custom policy exists
+- **THEN** the system SHALL use custom-policy-aware branching rather than the plain requestor menu behavior
+- **AND** Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User SHALL be handled consistently
diff --git a/src/js/reducers/sessionReducer.jsx b/src/js/reducers/sessionReducer.jsx
index 97db9144e5e..6962a4bec94 100644
--- a/src/js/reducers/sessionReducer.jsx
+++ b/src/js/reducers/sessionReducer.jsx
@@ -1,5 +1,5 @@
-import _ from 'lodash';
 import { DEFAULT_CUSTOM_ROLE_PERMISSIONS } from 'custom/roles/customRolePermissions';
+import _ from 'lodash';
 
 import {
   CHANGE_CURRENT_LOCALE,
@@ -25,10 +25,6 @@ const initialState = {
   isUserAdmin: false,
   isUserApprover: false,
   isUserRequestApprover: false,
-  hasFacilityStorekeeperPolicy: false,
-  hasRegionalWarehousePolicy: false,
-  hasRpcSuperuserPolicy: false,
-  hasReportingUserPolicy: false,
   customRolePermissions: DEFAULT_CUSTOM_ROLE_PERMISSIONS,
   supportedActivities: [],
   menuConfig: [],
@@ -93,7 +89,7 @@ const initialState = {
   maxUploadFileSize: 2097152,
 };
 
-export default function (state = initialState, action) {
+export default function sessionReducer(state = initialState, action) {
   switch (action.type) {
     case FETCH_SESSION_INFO:
       return {
@@ -105,10 +101,6 @@ export default function (state = initialState, action) {
         isUserApprover: _.get(action, 'payload.data.data.isUserApprover', false),
         isUserRequestApprover: _.get(action, 'payload.data.data.isUserRequestApprover', false),
         isUserManager: _.get(action, 'payload.data.data.isUserManager', false),
-        hasFacilityStorekeeperPolicy: _.get(action, 'payload.data.data.hasFacilityStorekeeperPolicy', false),
-        hasRegionalWarehousePolicy: _.get(action, 'payload.data.data.hasRegionalWarehousePolicy', false),
-        hasRpcSuperuserPolicy: _.get(action, 'payload.data.data.hasRpcSuperuserPolicy', false),
-        hasReportingUserPolicy: _.get(action, 'payload.data.data.hasReportingUserPolicy', false),
         customRolePermissions: _.get(action, 'payload.data.data.customRolePermissions', state.customRolePermissions),
         supportedActivities: _.get(action, 'payload.data.data.supportedActivities'),
         activeLanguage: _.get(action, 'payload.data.data.activeLanguage'),
diff --git a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
index 47cab5f3411..47867f12649 100644
--- a/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
+++ b/src/main/groovy/org/pih/warehouse/core/RoleType.groovy
@@ -63,6 +63,8 @@ enum RoleType {
     ROLE_RECEIVER('Receiver', 50),
     ROLE_SHIPMENT_CLERK('Shipment Clerk', 50),
     ROLE_STOCKER('Stocker', 50),
+    // Custom policy roles: below Assistant and above Authenticated.
+    // They do not automatically inherit Assistant-level access; policy service grants explicit capabilities.
     ROLE_FACILITY_STOREKEEPER('Facility Storekeeper', 4),
     ROLE_REGIONAL_WAREHOUSE('Regional Warehouse User', 4),
     ROLE_RPC_SUPERUSER('RPC Superuser', 4),
diff --git a/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy b/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
index 77d174e388d..d52352000a8 100644
--- a/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
+++ b/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
@@ -43,4 +43,36 @@ class AuthTagLibCustomRolesSpec extends Specification implements TagLibUnitTest<
         then:
         output == 'Allowed'
     }
+
+    def "hasHighestRoleAuthenticated should hide body when any custom policy is active"() {
+        given:
+        tagLib.userService = Stub(UserService) {
+            hasHighestRole(_, _, _) >> true
+        }
+        tagLib.customRolePolicyService = Stub(CustomRolePolicyService) {
+            hasAnyCustomPolicy(_, _) >> true
+        }
+
+        when:
+        String output = applyTemplate('<g:hasHighestRoleAuthenticated>Allowed</g:hasHighestRoleAuthenticated>')
+
+        then:
+        output == ''
+    }
+
+    def "hasHigherRoleThanAuthenticated should render body when any custom policy is active"() {
+        given:
+        tagLib.userService = Stub(UserService) {
+            hasHighestRole(_, _, _) >> true
+        }
+        tagLib.customRolePolicyService = Stub(CustomRolePolicyService) {
+            hasAnyCustomPolicy(_, _) >> true
+        }
+
+        when:
+        String output = applyTemplate('<g:hasHigherRoleThanAuthenticated>Allowed</g:hasHigherRoleThanAuthenticated>')
+
+        then:
+        output == 'Allowed'
+    }
 }
diff --git a/src/test/groovy/org/pih/warehouse/core/RoleTypeCustomRolesSpec.groovy b/src/test/groovy/org/pih/warehouse/core/RoleTypeCustomRolesSpec.groovy
new file mode 100644
index 00000000000..47895e38fff
--- /dev/null
+++ b/src/test/groovy/org/pih/warehouse/core/RoleTypeCustomRolesSpec.groovy
@@ -0,0 +1,28 @@
+package org.pih.warehouse.core
+
+import spock.lang.Specification
+
+class RoleTypeCustomRolesSpec extends Specification {
+
+    def "assistant expansion should not include custom policy roles"() {
+        when:
+        Set<RoleType> expanded = RoleType.expand(RoleType.ROLE_ASSISTANT) as Set<RoleType>
+
+        then:
+        !expanded.contains(RoleType.ROLE_FACILITY_STOREKEEPER)
+        !expanded.contains(RoleType.ROLE_REGIONAL_WAREHOUSE)
+        !expanded.contains(RoleType.ROLE_RPC_SUPERUSER)
+        !expanded.contains(RoleType.ROLE_REPORTING_USER)
+        expanded.contains(RoleType.ROLE_ASSISTANT)
+        expanded.contains(RoleType.ROLE_MANAGER)
+        expanded.contains(RoleType.ROLE_ADMIN)
+        expanded.contains(RoleType.ROLE_SUPERUSER)
+    }
+
+    def "custom policy roles should remain below assistant and above authenticated"() {
+        expect:
+        RoleType.ROLE_FACILITY_STOREKEEPER.sortOrder == RoleType.ROLE_BROWSER.sortOrder
+        RoleType.ROLE_FACILITY_STOREKEEPER.sortOrder > RoleType.ROLE_ASSISTANT.sortOrder
+        RoleType.ROLE_FACILITY_STOREKEEPER.sortOrder < RoleType.ROLE_AUTHENTICATED.sortOrder
+    }
+}
diff --git a/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
index 8801b795403..622e7980e1b 100644
--- a/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
+++ b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
@@ -189,6 +189,17 @@ class CustomRolePolicyServiceSpec extends Specification implements ServiceUnitTe
         service.hasLocationChooserRole(user)
     }
 
+    def "should recognize default custom role as location chooser role"() {
+        given:
+        User user = mockUser(
+                [RoleType.ROLE_REPORTING_USER],
+                [RoleType.ROLE_REPORTING_USER]
+        )
+
+        expect:
+        service.hasLocationChooserRole(user)
+    }
+
     def "should resolve detached user before evaluating custom role policy"() {
         given:
         User detachedUser = Stub(User) {
@@ -214,6 +225,47 @@ class CustomRolePolicyServiceSpec extends Specification implements ServiceUnitTe
         !flags.hasReportingUserPolicy
     }
 
+    def "should expose hasAnyCustomPolicy for reporting user"() {
+        given:
+        User user = mockUser([RoleType.ROLE_REPORTING_USER], [RoleType.ROLE_REPORTING_USER])
+
+        expect:
+        service.hasAnyCustomPolicy(user, 'loc-1')
+    }
+
+    def "should allow rpc superuser to pass assistant minimum menu role in allowed sections"() {
+        given:
+        User user = mockUser([RoleType.ROLE_RPC_SUPERUSER], [RoleType.ROLE_RPC_SUPERUSER])
+        Location location = Stub(Location) {
+            getId() >> 'loc-1'
+        }
+
+        expect:
+        service.userHasMinimumMenuRole(user, location, [RoleType.ROLE_ASSISTANT], 'purchasing')
+    }
+
+    def "should deny reporting user assistant minimum menu role"() {
+        given:
+        User user = mockUser([RoleType.ROLE_REPORTING_USER], [RoleType.ROLE_REPORTING_USER])
+        Location location = Stub(Location) {
+            getId() >> 'loc-1'
+        }
+
+        expect:
+        !service.userHasMinimumMenuRole(user, location, [RoleType.ROLE_ASSISTANT], 'purchasing')
+    }
+
+    def "should allow rpc superuser supplemental menu role for purchasing section"() {
+        given:
+        User user = mockUser([RoleType.ROLE_RPC_SUPERUSER], [RoleType.ROLE_RPC_SUPERUSER])
+        Location location = Stub(Location) {
+            getId() >> 'loc-1'
+        }
+
+        expect:
+        service.userHasSupplementalMenuRole(user, location, [RoleType.ROLE_SUPERUSER], 'purchasing')
+    }
+
     private User mockUser(List<RoleType> effectiveRoleTypes, List<RoleType> allRoleTypes) {
         List<Role> effectiveRoles = effectiveRoleTypes.collect { role(it) }
         List<Role> allRoles = allRoleTypes.collect { role(it) }
diff --git a/test/unit/org/pih/warehouse/api/ApiControllerTests.groovy b/test/unit/org/pih/warehouse/api/ApiControllerTests.groovy
index 0caf56691d6..9dd40801d8e 100644
--- a/test/unit/org/pih/warehouse/api/ApiControllerTests.groovy
+++ b/test/unit/org/pih/warehouse/api/ApiControllerTests.groovy
@@ -108,6 +108,21 @@ class ApiControllerTests extends ControllerUnitTestCase {
                 hasRolePurchaseApprover: { User user -> return true },
                 getEffectiveRoles: { User user -> return [] }
         ]
+        controller.customRolePolicyService = [
+                getCustomRolePermissions: { User user, String locationId ->
+                    [
+                            activeCustomRolePolicy: null,
+                            canCreateInboundMovement: true,
+                            canCreateInboundFromPurchaseOrder: true,
+                            canCreateOutboundMovement: true,
+                            canManageProducts: false,
+                            canManagePurchasing: true,
+                            canManageStocklists: false,
+                            canSendStocklistEmail: true,
+                            canUseSuperuserPurchasingActions: false,
+                    ]
+                }
+        ]
         controller.localizationService = [
                 getCurrentLocale: { -> return localeEn }
         ]
@@ -143,5 +158,12 @@ class ApiControllerTests extends ControllerUnitTestCase {
 
         assert jsonResponse.data.isHelpScoutEnabled
         assert jsonResponse.data.localizedHelpScoutKey == 'localized string'  // from what was GIVEN
+        assert jsonResponse.data.customRolePermissions
+        assert jsonResponse.data.customRolePermissions.canManagePurchasing == true
+        assert jsonResponse.data.customRolePermissions.canManageStocklists == false
+        assert !jsonResponse.data.containsKey('hasFacilityStorekeeperPolicy')
+        assert !jsonResponse.data.containsKey('hasRegionalWarehousePolicy')
+        assert !jsonResponse.data.containsKey('hasRpcSuperuserPolicy')
+        assert !jsonResponse.data.containsKey('hasReportingUserPolicy')
     }
 }

From 6e6fbcd1e971caf352c56bb2487a45bd86406251 Mon Sep 17 00:00:00 2001
From: Matias Arriola <matias@eyeseetea.com>
Date: Tue, 26 May 2026 14:20:51 -0300
Subject: [PATCH 10/10] fix(custom-roles): hide read-only product metadata
 write actions

Hide server-rendered and React product write affordances for read-only custom roles by gating create/import/edit/delete controls behind product-management permissions.

Includes follow-up fixes from manual testing and review, plus archived OpenSpec documentation updates to keep upstream touch points accurate.
---
 .../org/pih/warehouse/AuthTagLib.groovy       |  6 ++
 .../views/product/_productAssociations.gsp    | 57 ++++++++--------
 grails-app/views/product/_productGroups.gsp   | 62 +++++++++---------
 grails-app/views/product/_productPackages.gsp | 50 +++++++-------
 grails-app/views/product/_uomClassDialog.gsp  |  4 +-
 grails-app/views/product/_uomDialog.gsp       | 12 ++--
 grails-app/views/productAssociation/list.gsp  | 20 +++---
 grails-app/views/productComponent/index.gsp   | 10 +--
 grails-app/views/productGroup/list.gsp        | 10 +--
 grails-app/views/tag/_summary.gsp             | 10 +--
 .../views/unitOfMeasureConversion/list.gsp    |  4 +-
 .../.openspec.yaml                            |  2 +
 .../design.md                                 | 65 +++++++++++++++++++
 .../proposal.md                               | 26 ++++++++
 .../specs/custom-roles-access/spec.md         | 22 +++++++
 .../tasks.md                                  | 29 +++++++++
 openspec/specs/custom-roles-access/spec.md    | 22 +++++++
 .../products/ProductsListHeader.jsx           |  2 +-
 .../products/ProductsListHeader.test.jsx      | 52 +++++++++++++++
 .../AuthTagLibCustomRolesSpec.groovy          | 32 +++++++++
 .../roles/CustomRolePolicyServiceSpec.groovy  | 28 ++++++++
 21 files changed, 418 insertions(+), 107 deletions(-)
 create mode 100644 openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/.openspec.yaml
 create mode 100644 openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/design.md
 create mode 100644 openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/proposal.md
 create mode 100644 openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/specs/custom-roles-access/spec.md
 create mode 100644 openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/tasks.md
 create mode 100644 src/js/tests/products/ProductsListHeader.test.jsx

diff --git a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
index 3007b90e2f2..25f6e13b480 100644
--- a/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
+++ b/grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy
@@ -88,6 +88,12 @@ class AuthTagLib {
             out << body()
         }
     }
+    def canManageProducts = { attrs, body ->
+        Map<String, Object> permissions = customRolePolicyService.getCustomRolePermissions(session?.user, session?.warehouse?.id)
+        if (userService.isUserAdmin(session?.user) || permissions.canManageProducts) {
+            out << body()
+        }
+    }
     def isUserManager = { attrs, body ->
         if (userService.isUserManager(session?.user))
             out << body()
diff --git a/grails-app/views/product/_productAssociations.gsp b/grails-app/views/product/_productAssociations.gsp
index 4d2a7af9d07..ae9b015717a 100644
--- a/grails-app/views/product/_productAssociations.gsp
+++ b/grails-app/views/product/_productAssociations.gsp
@@ -46,27 +46,28 @@
                         <td><g:formatDate date="${productAssociation.dateCreated}" /></td>
 
                         <td>
-
-                            <g:link controller="productAssociation" action="edit" id="${productAssociation.id}" class="button" params="[isFromProductEditPage: true]">
-                                <g:message code="default.button.edit.label"/>
-                            </g:link>
-
-                            <g:if test="${productAssociation?.mutualAssociation}">
-                                <button type="button"
-                                        class="button"
-                                        onclick="$('#product-association-delete-dialog')
-                                          .data('productAssociationId', `${productAssociation?.id}`)
-                                          .data('reload', true)
-                                          .dialog('open')">
-                                    ${warehouse.message(code: 'default.button.delete.label', default: 'Delete')}
-                                </button>
-                            </g:if>
-                            <g:else>
-                                <button class="button"
-                                        onclick="deleteSingleProductAssociation('${productAssociation?.id}')">
-                                    <g:message code="default.button.delete.label"/>
-                                </button>
-                            </g:else>
+                            <g:canManageProducts>
+                                <g:link controller="productAssociation" action="edit" id="${productAssociation.id}" class="button" params="[isFromProductEditPage: true]">
+                                    <g:message code="default.button.edit.label"/>
+                                </g:link>
+
+                                <g:if test="${productAssociation?.mutualAssociation}">
+                                    <button type="button"
+                                            class="button"
+                                            onclick="$('#product-association-delete-dialog')
+                                              .data('productAssociationId', `${productAssociation?.id}`)
+                                              .data('reload', true)
+                                              .dialog('open')">
+                                        ${warehouse.message(code: 'default.button.delete.label', default: 'Delete')}
+                                    </button>
+                                </g:if>
+                                <g:else>
+                                    <button class="button"
+                                            onclick="deleteSingleProductAssociation('${productAssociation?.id}')">
+                                        <g:message code="default.button.delete.label"/>
+                                    </button>
+                                </g:else>
+                            </g:canManageProducts>
                         </td>
 
                     </tr>
@@ -85,12 +86,14 @@
                 <tr>
                     <td colspan="8">
                         <div class="center">
-                            <button class="button btn-show-dialog"
-                                    data-title="${g.message(code: 'default.create.label', args: [g.message(code:'productAssociation.label')])}"
-                                    data-url="${request.contextPath}/productAssociation/dialog?product.id=${productInstance?.id}">
-                                <img src="${resource(dir: 'images/icons/silk', file:'add.png')}" />
-                                ${g.message(code: 'default.create.label', args: [g.message(code:'productAssociation.label')])}
-                            </button>
+                            <g:canManageProducts>
+                                <button class="button btn-show-dialog"
+                                        data-title="${g.message(code: 'default.create.label', args: [g.message(code:'productAssociation.label')])}"
+                                        data-url="${request.contextPath}/productAssociation/dialog?product.id=${productInstance?.id}">
+                                    <img src="${resource(dir: 'images/icons/silk', file:'add.png')}" />
+                                    ${g.message(code: 'default.create.label', args: [g.message(code:'productAssociation.label')])}
+                                </button>
+                            </g:canManageProducts>
                         </div>
                     </td>
                 </tr>
diff --git a/grails-app/views/product/_productGroups.gsp b/grails-app/views/product/_productGroups.gsp
index a34edf148ac..2348cf8ee81 100644
--- a/grails-app/views/product/_productGroups.gsp
+++ b/grails-app/views/product/_productGroups.gsp
@@ -34,15 +34,17 @@
 
                         </td>
                         <td class="middle">
-                            <g:link controller="productGroup" action="edit" id="${productGroup.id}" class="button">
-                                <img src="${resource(dir: 'images/icons/silk', file:'pencil.png')}" />&nbsp;
-                                <warehouse:message code="default.button.edit.label"/>
-                            </g:link>
-                            <g:remoteLink controller="product" action="removeFromProductGroups" update="productGroups" class="button"
-                                          id="${productGroup.id}" params="[productId:productInstance.id]">
-                                <img src="${resource(dir: 'images/icons/silk', file:'link_break.png')}" />&nbsp;
-                                <warehouse:message code="default.button.unlink.label" default="Unlink"/>
-                            </g:remoteLink>
+                            <g:canManageProducts>
+                                <g:link controller="productGroup" action="edit" id="${productGroup.id}" class="button">
+                                    <img src="${resource(dir: 'images/icons/silk', file:'pencil.png')}" />&nbsp;
+                                    <warehouse:message code="default.button.edit.label"/>
+                                </g:link>
+                                <g:remoteLink controller="product" action="removeFromProductGroups" update="productGroups" class="button"
+                                              id="${productGroup.id}" params="[productId:productInstance.id]">
+                                    <img src="${resource(dir: 'images/icons/silk', file:'link_break.png')}" />&nbsp;
+                                    <warehouse:message code="default.button.unlink.label" default="Unlink"/>
+                                </g:remoteLink>
+                            </g:canManageProducts>
                         </td>
                     </tr>
                 </g:each>
@@ -54,29 +56,29 @@
                     </tr>
                 </g:unless>
             </tbody>
-            <tfoot>
-                <tr>
-                    <td colspan="4">
-                        <g:formRemote id="addProductGroupToProduct" name="addProductGroupToProduct"
-                                      update="productGroups" onSuccess="onSuccess(data,textStatus)" onComplete="onComplete()"
-                                      url="[controller: 'product', action:'addProductGroupToProduct']">
-                            <input name="id" type="hidden" value="${productInstance?.id}" />
-                            <g:autoSuggestString id="productGroup" name="productGroup" size="80" class="medium text"
-                                                 jsonUrl="${request.contextPath}/json/autoSuggestProductGroups"
-                                                 value=""
-                                                 placeholder="${warehouse.message(code:'product.addProductGroup.label', default: 'Enter product group name')}"/>
-
-                            <button  class="button">
-                                <img src="${resource(dir: 'images/icons/silk', file:'add.png')}" />&nbsp;
-                                ${warehouse.message(code:'default.button.add.label')}
-                            </button>
-                        </g:formRemote>
-
+            <g:canManageProducts>
+                <tfoot>
+                    <tr>
+                        <td colspan="4">
+                            <g:formRemote id="addProductGroupToProduct" name="addProductGroupToProduct"
+                                          update="productGroups" onSuccess="onSuccess(data,textStatus)" onComplete="onComplete()"
+                                          url="[controller: 'product', action:'addProductGroupToProduct']">
+                                <input name="id" type="hidden" value="${productInstance?.id}" />
+                                <g:autoSuggestString id="productGroup" name="productGroup" size="80" class="medium text"
+                                                     jsonUrl="${request.contextPath}/json/autoSuggestProductGroups"
+                                                     value=""
+                                                     placeholder="${warehouse.message(code:'product.addProductGroup.label', default: 'Enter product group name')}"/>
 
-                    </td>
-                </tr>
+                                <button  class="button">
+                                    <img src="${resource(dir: 'images/icons/silk', file:'add.png')}" />&nbsp;
+                                    ${warehouse.message(code:'default.button.add.label')}
+                                </button>
+                            </g:formRemote>
+                        </td>
+                    </tr>
 
-            </tfoot>
+                </tfoot>
+            </g:canManageProducts>
         </table>
     </div>
 </div>
diff --git a/grails-app/views/product/_productPackages.gsp b/grails-app/views/product/_productPackages.gsp
index 68b9a77effe..9ff596762d2 100644
--- a/grails-app/views/product/_productPackages.gsp
+++ b/grails-app/views/product/_productPackages.gsp
@@ -60,15 +60,17 @@
                     </g:hasRoleFinance>
                 </td>
                 <td class="right">
-                    <a href="javascript:void(0);" dialog-id="editProductPackage-${pkg?.id }" class="open-dialog button">
-                        <img src="${resource(dir:'images/icons/silk', file:'pencil.png')}" />
-                        <warehouse:message code="default.button.edit.label" />
-                    </a>
-                    <g:link controller="product" action="removePackage" id="${pkg.id }"
-                            params="['product.id':productInstance.id]" class="button">
-                        <img src="${resource(dir:'images/icons/silk', file:'delete.png')}" />
-                        <warehouse:message code="default.button.delete.label" />
-                    </g:link>
+                    <g:canManageProducts>
+                        <a href="javascript:void(0);" dialog-id="editProductPackage-${pkg?.id }" class="open-dialog button">
+                            <img src="${resource(dir:'images/icons/silk', file:'pencil.png')}" />
+                            <warehouse:message code="default.button.edit.label" />
+                        </a>
+                        <g:link controller="product" action="removePackage" id="${pkg.id }"
+                                params="['product.id':productInstance.id]" class="button">
+                            <img src="${resource(dir:'images/icons/silk', file:'delete.png')}" />
+                            <warehouse:message code="default.button.delete.label" />
+                        </g:link>
+                    </g:canManageProducts>
                 </td>
 
             </tr>
@@ -87,21 +89,25 @@
             <tr>
                 <td colspan="7">
                     <div class="right">
-                        <a href="javascript:void(0);" class="open-dialog create button" dialog-id="uom-dialog">
-                            <img src="${resource(dir:'images/icons/silk', file:'add.png')}" />&nbsp;
-                            <warehouse:message code="default.add.label" args="[g.message(code:'unitOfMeasure.label')]"/>
-                        </a>
-                        <a href="javascript:void(0);" class="open-dialog create button" dialog-id="uom-class-dialog">
-                            <img src="${resource(dir:'images/icons/silk', file:'add.png')}" />
-                            <warehouse:message code="default.add.label" args="[g.message(code:'unitOfMeasureClass.label')]"/>
-                        </a>
+                        <g:canManageProducts>
+                            <a href="javascript:void(0);" class="open-dialog create button" dialog-id="uom-dialog">
+                                <img src="${resource(dir:'images/icons/silk', file:'add.png')}" />&nbsp;
+                                <warehouse:message code="default.add.label" args="[g.message(code:'unitOfMeasure.label')]"/>
+                            </a>
+                            <a href="javascript:void(0);" class="open-dialog create button" dialog-id="uom-class-dialog">
+                                <img src="${resource(dir:'images/icons/silk', file:'add.png')}" />
+                                <warehouse:message code="default.add.label" args="[g.message(code:'unitOfMeasureClass.label')]"/>
+                            </a>
+                        </g:canManageProducts>
                     </div>
                     <div class="left">
-                        <a href="javascript:void(0);" class="open-dialog create button"
-                           dialog-id="product-package-dialog">
-                            <img src="${resource(dir:'images/icons/silk', file:'add.png')}" />&nbsp;
-                            <warehouse:message code="default.create.label" args="[g.message(code:'productPackage.label')]"/>
-                        </a>
+                        <g:canManageProducts>
+                            <a href="javascript:void(0);" class="open-dialog create button"
+                               dialog-id="product-package-dialog">
+                                <img src="${resource(dir:'images/icons/silk', file:'add.png')}" />&nbsp;
+                                <warehouse:message code="default.create.label" args="[g.message(code:'productPackage.label')]"/>
+                            </a>
+                        </g:canManageProducts>
                     </div>
                 </td>
             </tr>
diff --git a/grails-app/views/product/_uomClassDialog.gsp b/grails-app/views/product/_uomClassDialog.gsp
index 58ec687a2ce..cce5968569d 100644
--- a/grails-app/views/product/_uomClassDialog.gsp
+++ b/grails-app/views/product/_uomClassDialog.gsp
@@ -33,7 +33,9 @@
             <td></td>
             <td>
                 <div>
-                    <button type="submit" name="create" class="button icon approve" value="Create" id="create">${warehouse.message(code: 'default.button.create.label', default: 'Create')}</button>
+                    <g:canManageProducts>
+                        <button type="submit" name="create" class="button icon approve" value="Create" id="create">${warehouse.message(code: 'default.button.create.label', default: 'Create')}</button>
+                    </g:canManageProducts>
                     <a href="#" class="btn-close-dialog button icon remove" data-target="uom-class-dialog">${warehouse.message(code: 'default.button.cancel.label', default: 'Cancel')}</a>
                 </div>
             </td>
diff --git a/grails-app/views/product/_uomDialog.gsp b/grails-app/views/product/_uomDialog.gsp
index 872858fcc96..c291da181ac 100644
--- a/grails-app/views/product/_uomDialog.gsp
+++ b/grails-app/views/product/_uomDialog.gsp
@@ -7,9 +7,11 @@
             <td class="value ">
                 <g:select name="uomClass.id" from="${org.pih.warehouse.core.UnitOfMeasureClass.list() }"
                           optionValue="name" optionKey="id" value="${pacakageInstance?.uom }" noSelection="['null':'']" class="chzn-select-deselect"></g:select>
-                <span class="linkButton">
-                    <a href="javascript:void(0);" class="open-dialog create" dialog-id="uom-class-dialog">Add UoM Class</a>
-                </span>
+                <g:canManageProducts>
+                    <span class="linkButton">
+                        <a href="javascript:void(0);" class="open-dialog create" dialog-id="uom-class-dialog">Add UoM Class</a>
+                    </span>
+                </g:canManageProducts>
             </td>
         </tr>
         <tr class="prop">
@@ -42,7 +44,9 @@
             <td></td>
             <td>
                 <div>
-                    <button type="submit" name="create" class="button icon approve" value="Create" id="create">${warehouse.message(code: 'default.button.create.label', default: 'Create')}</button>
+                    <g:canManageProducts>
+                        <button type="submit" name="create" class="button icon approve" value="Create" id="create">${warehouse.message(code: 'default.button.create.label', default: 'Create')}</button>
+                    </g:canManageProducts>
                     <a href="#" class="btn-close-dialog" data-target="uom-dialog">${warehouse.message(code: 'default.button.cancel.label', default: 'Cancel')}</a>
                 </div>
             </td>
diff --git a/grails-app/views/productAssociation/list.gsp b/grails-app/views/productAssociation/list.gsp
index 82600d8e94d..9d04afa2582 100644
--- a/grails-app/views/productAssociation/list.gsp
+++ b/grails-app/views/productAssociation/list.gsp
@@ -19,18 +19,22 @@
                         <img src="${resource(dir: 'images/icons/silk', file: 'application_view_list.png')}" />&nbsp;
                         <warehouse:message code="default.list.label" args="[g.message(code:'productAssociations.label')]"/>
                     </g:link>
-                    <g:link class="button" action="create">
-                        <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-                        <warehouse:message code="default.add.label" args="[g.message(code:'productAssociation.label')]"/>
-                    </g:link>
+                    <g:canManageProducts>
+                        <g:link class="button" action="create">
+                            <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+                            <warehouse:message code="default.add.label" args="[g.message(code:'productAssociation.label')]"/>
+                        </g:link>
+                    </g:canManageProducts>
                     <g:link class="button" controller="batch" action="downloadExcel" params="[type:'ProductAssociation']">
                         <img src="${resource(dir: 'images/icons/silk', file: 'page_excel.png')}" />&nbsp;
                         <warehouse:message code="default.export.label" args="[g.message(code:'productAssociations.label')]"/>
                     </g:link>
-                    <g:link class="button" controller="batch" action="importData" params="[type: 'productAssociation']" >
-                        <img src="${resource(dir: 'images/icons/silk', file: 'database_refresh.png')}" />&nbsp;
-                        <warehouse:message code="default.import.label" args="[g.message(code:'productAssociations.label')]"/>
-                    </g:link>
+                    <g:canManageProducts>
+                        <g:link class="button" controller="batch" action="importData" params="[type: 'productAssociation']" >
+                            <img src="${resource(dir: 'images/icons/silk', file: 'database_refresh.png')}" />&nbsp;
+                            <warehouse:message code="default.import.label" args="[g.message(code:'productAssociations.label')]"/>
+                        </g:link>
+                    </g:canManageProducts>
 	        	</div>
 
                 <div class="yui-gf">
diff --git a/grails-app/views/productComponent/index.gsp b/grails-app/views/productComponent/index.gsp
index be30fd8d244..aaad60ae938 100644
--- a/grails-app/views/productComponent/index.gsp
+++ b/grails-app/views/productComponent/index.gsp
@@ -13,10 +13,12 @@
                 <img src="${resource(dir: 'images/icons/silk', file: 'application_view_list.png')}" />&nbsp;
                 <warehouse:message code="default.list.label" args="[entityName]"/>
             </g:link>
-            <g:link class="button" action="create">
-                <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-                <warehouse:message code="default.add.label" args="[entityName]"/>
-            </g:link>
+            <g:canManageProducts>
+                <g:link class="button" action="create">
+                    <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+                    <warehouse:message code="default.add.label" args="[entityName]"/>
+                </g:link>
+            </g:canManageProducts>
         </div>
         <div id="list-productComponent" class="box content scaffold-create" role="main">
             <h2><warehouse:message code="default.list.label" args="[entityName]" /></h2>
diff --git a/grails-app/views/productGroup/list.gsp b/grails-app/views/productGroup/list.gsp
index 4d597542f1d..f86dbc06eb5 100644
--- a/grails-app/views/productGroup/list.gsp
+++ b/grails-app/views/productGroup/list.gsp
@@ -24,10 +24,12 @@
                     <img src="${resource(dir:'images/icons/silk',file:'application_view_list.png')}"/>&nbsp;
                     <warehouse:message code="default.list.label" args="[warehouse.message(code:'productGroups.label')]"/>
                 </g:link>
-                <g:link class="button" action="create">
-                    <img src="${resource(dir:'images/icons/silk',file:'add.png')}"/>&nbsp;
-                    <warehouse:message code="default.add.label" args="[warehouse.message(code:'productGroup.label')]"/>
-                </g:link>
+                <g:canManageProducts>
+                    <g:link class="button" action="create">
+                        <img src="${resource(dir:'images/icons/silk',file:'add.png')}"/>&nbsp;
+                        <warehouse:message code="default.add.label" args="[warehouse.message(code:'productGroup.label')]"/>
+                    </g:link>
+                </g:canManageProducts>
             </div>
 
             <div class="yui-gf">
diff --git a/grails-app/views/tag/_summary.gsp b/grails-app/views/tag/_summary.gsp
index 324ee321697..4fcb6e2935d 100644
--- a/grails-app/views/tag/_summary.gsp
+++ b/grails-app/views/tag/_summary.gsp
@@ -27,10 +27,12 @@
         <img src="${resource(dir: 'images/icons/silk', file: 'application_side_list.png')}" />&nbsp;
         <warehouse:message code="default.list.label" args="[g.message(code: 'tags.label')]" />
     </g:link>
-    <g:link class="button" action="create" controller="tag">
-        <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
-        <warehouse:message code="default.create.label" args="[g.message(code: 'tag.label')]" />
-    </g:link>
+    <g:canManageProducts>
+        <g:link class="button" action="create" controller="tag">
+            <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
+            <warehouse:message code="default.create.label" args="[g.message(code: 'tag.label')]" />
+        </g:link>
+    </g:canManageProducts>
     <g:if test="${tagInstance?.id && tagInstance?.products?.size() > 0}">
         <div class="right">
             <g:link class="button right" controller="productApi" action="list" params="[tagId: tagInstance?.id, format: 'csv', fileName: tagInstance?.tag]">
diff --git a/grails-app/views/unitOfMeasureConversion/list.gsp b/grails-app/views/unitOfMeasureConversion/list.gsp
index 7cd5aa6b479..7b7ca5db043 100644
--- a/grails-app/views/unitOfMeasureConversion/list.gsp
+++ b/grails-app/views/unitOfMeasureConversion/list.gsp
@@ -23,12 +23,12 @@
                     <img src="${resource(dir: 'images/icons/silk', file: 'table.png')}" />&nbsp;
                     <warehouse:message code="default.list.label" args="[entityName]"/>
                 </g:link>
-                <g:isUserAdmin>
+                <g:canManageProducts>
                     <g:link class="button" action="create">
                         <img src="${resource(dir: 'images/icons/silk', file: 'add.png')}" />&nbsp;
                         <warehouse:message code="default.add.label" args="[entityName]"/>
                     </g:link>
-                </g:isUserAdmin>
+                </g:canManageProducts>
             </div>
 
             <div class="box">
diff --git a/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/.openspec.yaml b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/.openspec.yaml
new file mode 100644
index 00000000000..fd706ac496e
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-26
diff --git a/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/design.md b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/design.md
new file mode 100644
index 00000000000..cf9ff89861f
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/design.md
@@ -0,0 +1,65 @@
+## Context
+
+Custom roles define module-level read and read/write access. Product access for roles such as `ROLE_REPORTING_USER` and `ROLE_REGIONAL_WAREHOUSE` is read-only, and backend authorization already denies direct product write actions. Some product-related pages still render add/create buttons, so users discover the restriction only after clicking and seeing an access denied alert.
+
+The implementation must preserve upstream compatibility. Most affected UI is likely in existing upstream GSP or React product screens, so edits should be surgical and limited to permission checks around existing controls rather than broader rewrites.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Inventory product-related read pages where read-only product users can see add/create actions.
+- Hide product add/create controls from users whose effective Products access is read-only.
+- Keep backend/controller/API authorization unchanged or stricter so direct URL access remains denied.
+- Add regression coverage for representative product-related add controls and direct write denial.
+
+**Non-Goals:**
+
+- Changing the role matrix or granting new product permissions.
+- Replacing backend authorization with UI-only checks.
+- Redesigning product pages or refactoring unrelated product UI.
+- Adding new database tables, migrations, or external dependencies.
+
+## Decisions
+
+- Use the existing custom role access policy as the source for read-only versus read/write decisions.
+  - Rationale: the same policy already controls menu/action/backend authorization, avoiding a second hard-coded role list in product screens.
+  - Alternative considered: check explicitly for `ROLE_REPORTING_USER`; rejected because `ROLE_REGIONAL_WAREHOUSE` also has read-only product access and future custom roles may share the same access level.
+
+- Guard only create/add UI affordances on product read pages, keeping read affordances visible.
+  - Rationale: read-only product users should still browse product data, product groups, product components, and related product metadata.
+  - Alternative considered: hide whole pages when any write action exists; rejected because it would reduce approved read access.
+
+- Prefer small conditional checks at existing button render sites.
+  - Rationale: these product screens are likely upstream-owned, and surgical edits minimize merge conflicts.
+  - Alternative considered: introduce a new shared component or full product action registry; rejected unless implementation discovery shows repeated logic that can be isolated without broad upstream edits.
+
+- Keep direct URL/API denial tests separate from UI visibility tests.
+  - Rationale: hidden UI is a usability improvement, while backend authorization remains the security boundary.
+  - Alternative considered: rely only on UI tests; rejected because direct access must remain protected.
+
+## Risks / Trade-offs
+
+- Missing one product-related page with a create button -> perform a targeted audit of product controllers/views/routes for `add`, `create`, `import`, and `new` actions before implementing.
+- Existing permission helpers may not expose the needed product write flag to every GSP/React context -> extend the smallest existing view model or helper path rather than duplicating role checks in each page.
+- Touching upstream views can increase future merge conflicts -> keep changes limited to conditional rendering around affected buttons and document upstream touch points when archiving.
+- UI-hidden actions may still be callable through bookmarked URLs -> preserve and test backend denial for read-only product users.
+
+## Upstream touch points
+
+- `grails-app/taglib/org/pih/warehouse/AuthTagLib.groovy`: Added a `canManageProducts` tag so upstream GSP pages can hide product add/create affordances using existing custom-role policy state.
+- `grails-app/views/productGroup/list.gsp`: Wrapped the Product Group create button with `g:canManageProducts`.
+- `grails-app/views/productComponent/index.gsp`: Wrapped the Product Component create button with `g:canManageProducts`.
+- `grails-app/views/product/_productGroups.gsp`: Wrapped the add-to-product-group form in `g:canManageProducts`.
+- `grails-app/views/product/_productGroups.gsp`: Wrapped row-level Product Group edit and unlink actions in `g:canManageProducts`.
+- `grails-app/views/productAssociation/list.gsp`: Wrapped Product Association add and import controls in `g:canManageProducts`.
+- `grails-app/views/product/_productAssociations.gsp`: Wrapped row-level Product Association edit and delete actions, and create action, in `g:canManageProducts`.
+- `grails-app/views/tag/_summary.gsp`: Wrapped Tag create control in `g:canManageProducts`.
+- `grails-app/views/unitOfMeasureConversion/list.gsp`: Switched unit-of-measure conversion create control from admin-only to product-management permission gating.
+- `grails-app/views/product/_uomDialog.gsp`: Wrapped UoM Class quick-add link and UoM create submit control in `g:canManageProducts`.
+- `grails-app/views/product/_uomClassDialog.gsp`: Wrapped UoM Class create submit control in `g:canManageProducts`.
+- `grails-app/views/product/_productPackages.gsp`: Wrapped Product Package create action and row-level edit/delete actions in `g:canManageProducts`.
+- `src/js/components/products/ProductsListHeader.jsx`: Exported the component for focused UI visibility tests while keeping existing connected default export.
+- `src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy`: Added regression tests for `g:canManageProducts` rendering behavior.
+- `src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy`: Added regression coverage that read-only product custom roles are denied direct product create route access.
+- `src/js/tests/products/ProductsListHeader.test.jsx`: Added UI regression tests for Reporting User, Regional Warehouse User, and product write users.
diff --git a/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/proposal.md b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/proposal.md
new file mode 100644
index 00000000000..a6a64456e58
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/proposal.md
@@ -0,0 +1,26 @@
+## Why
+
+Users with read-only access to the Products menu, such as `ROLE_REPORTING_USER`, can still see product-related "Add" actions on screens like product components and product groups. Clicking those actions results in an access denied alert, so hiding unavailable actions up front will reduce confusion and align the UI with the enforced permissions.
+
+## What Changes
+
+- Identify product-area pages where read-only product users can see create/add controls despite lacking write permission.
+- Hide or disable product-related add/create controls for users whose Products menu access is read-only.
+- Preserve server-side and API authorization as the source of truth; this change improves UI affordances only.
+- Add regression coverage for representative product-related pages/actions so read-only roles do not see unavailable add controls.
+
+## Capabilities
+
+### New Capabilities
+
+- None.
+
+### Modified Capabilities
+
+- `custom-roles-access`: Product-menu read-only access must not expose create/add UI actions for product-related resources.
+
+## Impact
+
+- Product-related GSP and/or React screens that render add/create controls, including product components and product groups.
+- Existing permission/menu helpers or role-access UI checks used to determine whether a user can modify Products-area resources.
+- Tests around custom role access, product page action visibility, and direct access denial behavior.
diff --git a/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/specs/custom-roles-access/spec.md b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/specs/custom-roles-access/spec.md
new file mode 100644
index 00000000000..5a8a2c5480b
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/specs/custom-roles-access/spec.md
@@ -0,0 +1,22 @@
+## ADDED Requirements
+
+### Requirement: Product read-only roles SHALL NOT see product create affordances
+The system SHALL hide product-related add/create UI controls from users whose effective Products access is read-only. This SHALL include server-rendered and React product screens for product records and related product metadata such as product components and product groups. Backend authorization SHALL continue to deny direct product write requests for those users.
+
+#### Scenario: Reporting User opens product metadata pages
+- **WHEN** a Reporting User opens product-related read pages, including product components and product groups
+- **THEN** add/create controls for product records and related product metadata SHALL be hidden
+- **AND** read-only navigation and data views SHALL remain available when the user is authorized for the current location
+
+#### Scenario: Regional Warehouse User opens product metadata pages
+- **WHEN** a Regional Warehouse User opens product-related read pages, including product components and product groups
+- **THEN** add/create controls for product records and related product metadata SHALL be hidden
+- **AND** read-only navigation and data views SHALL remain available when the user is authorized for the current location
+
+#### Scenario: Product write user opens product metadata pages
+- **WHEN** a user with Products Read/Write access opens product-related pages
+- **THEN** add/create controls for product records and related product metadata SHALL remain visible according to existing authorization behavior
+
+#### Scenario: Hidden product create action is requested directly
+- **WHEN** a user whose effective Products access is read-only calls a product-related create endpoint directly by URL or API
+- **THEN** the backend SHALL deny the request according to that role's policy
diff --git a/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/tasks.md b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/tasks.md
new file mode 100644
index 00000000000..0f61d7ed1ef
--- /dev/null
+++ b/openspec/changes/archive/2026-05-26-hide-readonly-product-add-actions/tasks.md
@@ -0,0 +1,29 @@
+## 1. Audit Product Add Actions
+
+- [x] 1.1 Search product-related GSP, controller, route, and React code for add/create/import/new controls and endpoints.
+- [x] 1.2 Confirm which product pages are available to read-only Products users and list visible create affordances, including product components and product groups.
+- [x] 1.3 Identify the existing permission helper, view model, taglib, or frontend state that best represents Products Read/Write access.
+
+## 2. UI Implementation
+
+- [x] 2.1 Hide product record add/create controls when the current user has read-only Products access.
+- [x] 2.2 Hide product metadata add/create controls, including product component and product group actions, when the current user has read-only Products access.
+- [x] 2.3 Verify users with Products Read/Write access still see existing product add/create controls.
+- [x] 2.4 Keep read-only product navigation, list, and detail views available to read-only Products users.
+
+## 3. Authorization Verification
+
+- [x] 3.1 Verify direct product create/update/delete/import URLs and APIs remain denied for read-only Products users.
+- [x] 3.2 Add or update backend authorization tests for representative direct product write requests if coverage is missing.
+
+## 4. Regression Tests
+
+- [x] 4.1 Add or update UI/view tests for Reporting User product pages to assert product add/create controls are hidden.
+- [x] 4.2 Add or update UI/view tests for Regional Warehouse User product pages to assert product add/create controls are hidden.
+- [x] 4.3 Add or update UI/view tests for a Products Read/Write role to assert product add/create controls remain visible.
+
+## 5. Validation And Documentation
+
+- [x] 5.1 Run the targeted backend and/or frontend tests covering the changed files.
+- [x] 5.2 Record upstream touch points in this change's design document before archiving.
+- [x] 5.3 Confirm no generated frontend bundles or unrelated upstream reformatting are included in the final diff.
diff --git a/openspec/specs/custom-roles-access/spec.md b/openspec/specs/custom-roles-access/spec.md
index d1745b72b2d..3b70d750de5 100644
--- a/openspec/specs/custom-roles-access/spec.md
+++ b/openspec/specs/custom-roles-access/spec.md
@@ -184,3 +184,25 @@ The system SHALL enforce custom role policy at menu visibility, page action visi
 - **WHEN** a user has highest role `ROLE_AUTHENTICATED` or otherwise enters authenticated/requestor menu branching while an active custom policy exists
 - **THEN** the system SHALL use custom-policy-aware branching rather than the plain requestor menu behavior
 - **AND** Facility Storekeeper, Regional Warehouse User, RPC Superuser, and Reporting User SHALL be handled consistently
+
+### Requirement: Product read-only roles SHALL NOT see product create affordances
+The system SHALL hide product-related add/create UI controls from users whose effective Products access is read-only. This SHALL include server-rendered and React product screens for product records and related product metadata such as product components and product groups. Backend authorization SHALL continue to deny direct product write requests for those users.
+
+#### Scenario: Reporting User opens product metadata pages
+- **WHEN** a Reporting User opens product-related read pages, including product components and product groups
+- **THEN** add/create controls for product records and related product metadata SHALL be hidden
+- **AND** read-only navigation and data views SHALL remain available when the user is authorized for the current location
+
+#### Scenario: Regional Warehouse User opens product metadata pages
+- **WHEN** a Regional Warehouse User opens product-related read pages, including product components and product groups
+- **THEN** add/create controls for product records and related product metadata SHALL be hidden
+- **AND** read-only navigation and data views SHALL remain available when the user is authorized for the current location
+
+#### Scenario: Product write user opens product metadata pages
+- **WHEN** a user with Products Read/Write access opens product-related pages
+- **THEN** add/create controls for product records and related product metadata SHALL remain visible according to existing authorization behavior
+
+#### Scenario: Hidden product create action is requested directly
+- **WHEN** a user whose effective Products access is read-only calls a product-related create endpoint directly by URL or API
+- **THEN** the backend SHALL deny the request according to that role's policy
+
diff --git a/src/js/components/products/ProductsListHeader.jsx b/src/js/components/products/ProductsListHeader.jsx
index 3f92a5d542d..5b394329f89 100644
--- a/src/js/components/products/ProductsListHeader.jsx
+++ b/src/js/components/products/ProductsListHeader.jsx
@@ -8,7 +8,7 @@ import Button from 'components/form-elements/Button';
 import { PRODUCT_URL } from 'consts/applicationUrls';
 import Translate from 'utils/Translate';
 
-const ProductsListHeader = ({ isUserAdmin, customRolePermissions }) => {
+export const ProductsListHeader = ({ isUserAdmin, customRolePermissions }) => {
   const permissions = getCustomRolePermissions({ customRolePermissions });
   return (
     <div className="d-flex list-page-header">
diff --git a/src/js/tests/products/ProductsListHeader.test.jsx b/src/js/tests/products/ProductsListHeader.test.jsx
new file mode 100644
index 00000000000..3ba24bd6e3e
--- /dev/null
+++ b/src/js/tests/products/ProductsListHeader.test.jsx
@@ -0,0 +1,52 @@
+import React from 'react';
+
+import { render, screen } from '@testing-library/react';
+
+import { ProductsListHeader } from 'components/products/ProductsListHeader';
+
+describe('ProductsListHeader', () => {
+  it('hides add and import actions for reporting user', () => {
+    render(
+      <ProductsListHeader
+        isUserAdmin={false}
+        customRolePermissions={{
+          activeCustomRolePolicy: 'ROLE_REPORTING_USER',
+          canManageProducts: false,
+        }}
+      />,
+    );
+
+    expect(screen.queryByText('Import products')).toBeNull();
+    expect(screen.queryByText('Add product')).toBeNull();
+  });
+
+  it('hides add and import actions for regional warehouse user', () => {
+    render(
+      <ProductsListHeader
+        isUserAdmin={false}
+        customRolePermissions={{
+          activeCustomRolePolicy: 'ROLE_REGIONAL_WAREHOUSE',
+          canManageProducts: false,
+        }}
+      />,
+    );
+
+    expect(screen.queryByText('Import products')).toBeNull();
+    expect(screen.queryByText('Add product')).toBeNull();
+  });
+
+  it('shows add and import actions for product write users', () => {
+    render(
+      <ProductsListHeader
+        isUserAdmin={false}
+        customRolePermissions={{
+          activeCustomRolePolicy: 'ROLE_RPC_SUPERUSER',
+          canManageProducts: true,
+        }}
+      />,
+    );
+
+    expect(screen.queryByText('Import products')).not.toBeNull();
+    expect(screen.queryByText('Add product')).not.toBeNull();
+  });
+});
diff --git a/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy b/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
index d52352000a8..7b4bdceb577 100644
--- a/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
+++ b/src/test/groovy/org/pih/warehouse/AuthTagLibCustomRolesSpec.groovy
@@ -75,4 +75,36 @@ class AuthTagLibCustomRolesSpec extends Specification implements TagLibUnitTest<
         then:
         output == 'Allowed'
     }
+
+    def "canManageProducts should hide body for read-only product custom role"() {
+        given:
+        tagLib.userService = Stub(UserService) {
+            isUserAdmin(_) >> false
+        }
+        tagLib.customRolePolicyService = Stub(CustomRolePolicyService) {
+            getCustomRolePermissions(_, _) >> [canManageProducts: false]
+        }
+
+        when:
+        String output = applyTemplate('<g:canManageProducts>Allowed</g:canManageProducts>')
+
+        then:
+        output == ''
+    }
+
+    def "canManageProducts should render body when custom policy allows product management"() {
+        given:
+        tagLib.userService = Stub(UserService) {
+            isUserAdmin(_) >> false
+        }
+        tagLib.customRolePolicyService = Stub(CustomRolePolicyService) {
+            getCustomRolePermissions(_, _) >> [canManageProducts: true]
+        }
+
+        when:
+        String output = applyTemplate('<g:canManageProducts>Allowed</g:canManageProducts>')
+
+        then:
+        output == 'Allowed'
+    }
 }
diff --git a/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
index 622e7980e1b..470116aa87b 100644
--- a/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
+++ b/src/test/groovy/org/pih/warehouse/custom/roles/CustomRolePolicyServiceSpec.groovy
@@ -137,6 +137,34 @@ class CustomRolePolicyServiceSpec extends Specification implements ServiceUnitTe
         permissions.canUseSuperuserPurchasingActions == true
     }
 
+    def "should deny product create action for read-only product policies"() {
+        when:
+        Map<String, Object> reportingUserAccess = service.evaluateRouteAccess(
+                mockUser([RoleType.ROLE_REPORTING_USER], [RoleType.ROLE_REPORTING_USER]),
+                'loc-1',
+                'product',
+                'create',
+                [:],
+                null
+        )
+        Map<String, Object> regionalWarehouseAccess = service.evaluateRouteAccess(
+                mockUser([RoleType.ROLE_REGIONAL_WAREHOUSE], [RoleType.ROLE_REGIONAL_WAREHOUSE]),
+                'loc-1',
+                'product',
+                'create',
+                [:],
+                null
+        )
+
+        then:
+        reportingUserAccess.hasPolicy
+        reportingUserAccess.denied
+        !reportingUserAccess.allowed
+        regionalWarehouseAccess.hasPolicy
+        regionalWarehouseAccess.denied
+        !regionalWarehouseAccess.allowed
+    }
+
     def "should preserve standard core role behavior without custom policy"() {
         given:
         User user = mockUser([RoleType.ROLE_ASSISTANT], [RoleType.ROLE_ASSISTANT])