# OHS Module Permissions Migration

The Occupational Health & Safety (OHS) module introduces new API resources. To secure these endpoints, grant the following permissions to roles in the `roles_permissions` table.

## Recommended Permissions

| Role               | Permissions |
|--------------------|-------------|
| **HR Administrator** | `ohs_actions.manage`, `ohs_inspections.view`, `ohs_regulations.manage`, `documents.*`, `ohs_compliance_tasks.manage`, `ohs_hazard_types.manage` |
| **Location Officer** | `ohs_inspections.view` |
| **Super Admin**      | already covered by wildcard `*.*` |

Run SQL updates similar to:

```sql
UPDATE roles_permissions
SET permissions = JSON_SET(permissions,
  '$.ohs_actions', JSON_ARRAY('manage'),
  '$.ohs_inspections', JSON_ARRAY('view'),
  '$.ohs_regulations', JSON_ARRAY('manage'),
  '$.documents', JSON_ARRAY('*'),
  '$.ohs_compliance_tasks', JSON_ARRAY('manage'),
  '$.ohs_hazard_types', JSON_ARRAY('manage'))
WHERE role = 'HR Administrator';

UPDATE roles_permissions
SET permissions = JSON_SET(permissions,
  '$.ohs_inspections', JSON_ARRAY('view'))
WHERE role = 'Location Officer';
```

Adjust the statements for your environment if the table already contains these keys.