Annex A.2 — 5 roles × 10 capabilities. Denied actions render disabled-with-tooltip, never hidden.
| Capability | Agency Admin | Booking Agent | Ticketing Agent | Finance Officer | Agency Manager |
|---|---|---|---|---|---|
| Create / Edit Staff | ✓ | ✗ | ✗ | ✗ | ✓ |
| Assign Roles | ✓ | ✗ | ✗ | ✗ | ✓ |
| Search Availability | ✓ | ✓ | ✓ | ✗ | ✓ |
| Create Bookings | ✓ | ✓ | ✗ | ✗ | ✓ |
| Issue Flight Tickets | ✓ | ✗ | ✓ | ✗ | ✓ |
| Void / Reissue / Refund | ✓ | ✗ | ✓ | ✗ | ✓ |
| Cancel Hotel / Car | ✓ | ✓ | ✗ | ✗ | ✓ |
| View Financials | ✓ | ✗ | ✗ | ✓ | ✓ |
| Manage Payments / Deposits | ✓ | ✗ | ✗ | ✓ | ✓ |
| Access Reports | ✓ | ✗ | ✗ | ✓ | ✓ |
Ticketing Agent is the SoD counterparty to Booking Agent — can ticket/void/reissue/refund but cannot create bookings (§5.2.9 role- and Office-ID-restricted ticketing).