Why a role decides how much choice someone gets

Each role owns a notification policy, and a person's own preferences can only move within it. This is deliberate: it stops the person with the most responsibility opting out of the alert that matters.

The obvious design is to let everyone choose their own notification settings. We rejected it on purpose, and the reason is worth stating plainly.

In a workplace safety system, the person most likely to mute alerts is the person receiving the most of them — which is usually the person with the most responsibility. Give everyone a free switch and the fleet quietly configures itself into silence, one reasonable individual decision at a time. Nobody chose that outcome and nobody notices it until an emergency.

So the role sets the policy, and personal preferences apply within it.

The role can set a minimum level nobody in it can go below. A District Manager can decline Caution notices; they cannot decline Danger.
The role can require a channel. If SMS is required for Danger, an individual can add email but not remove the text.
Everything the role leaves open is genuinely the person's choice — quiet hours, digests, extra channels, lower levels.

When something on someone's preferences can't be switched off, that's the role's policy, not a bug — and the fix is to change the role, which is an explicit decision made by an administrator rather than a quiet one made by an individual.

A role with no policy set yet notifies nobody. That is deliberate — it means adding a role can never accidentally page an entire executive team — but it does mean a new role is silent until you configure it. Readiness points this out.

Related