server/AyaNova/biz/BizRoles.cs

@@ -19,6 +19,20 @@ namespace AyaNova.Biz
             //NOTE: do not need to add change roles to read roles, Authorized.cs takes care of that automatically 
             //by assuming if you can change you can read
             #region All roles initialization
+
+            ////////////////////////////////////////////////////////////
+            //USER
+            //
+            //TODO: flesh this out more when user routes are made
+            //These rights only apply to the core User object itself
+            //any settings that are user configurable should go under a UserOptions object instead
+            roles.Add(AyaType.User, new BizRoleSet()
+            {
+                Change = AuthorizationRoles.BizAdminFull,
+                EditOwn = AuthorizationRoles.NoRole,//Only biz admin has full rights to edit a user??  Maybe minor changes are allowed or not stored as a User sub field for user configurable things
+                Read = AuthorizationRoles.BizAdminFull | AuthorizationRoles.BizAdminLimited
+            });
+
             ////////////////////////////////////////////////////////////
             //WIDGET
             //