Using claims to handle programmatic logic determining what is displayed

Question

I am writing an application to manage volunteers for political campaigns. This is a lot more complicated than any past multi-tenant app I've written and so am asking for guidance here on how to approach this.

Note: I'm not asking for opinion but my knowledge on this is so light that the questions are pretty open ended & general. I don't know enough yet to get into the details.

First off you have admins, managers, & volunteers. They each have different things they can see and do. But in addition, they are limited to one or a small set of campaigns. For example, the admin for a state legislative campaign in New Jersey has no access at any level to a senate race in Colorado.

While there are some web pages where you must be an admin or manager, most of the limitations, including the admin only pages, limit what specifics are displayed on the page. Every manager can go to the "create a volunteer event" page. But they are all limited to only seeing existing and creating new events for the campaign they manage.

Oh, and some user will be an admin and/or manager for several campaigns. And most volunteers will be a volunteer on several campaigns.

1. And to implement this, I have the ASP.NET Core Identity incorporated into my system with Identification(login) working. So I would use the claims part of this - correct?
2. Do I then create for each user a bunch of claims like Claim(admin, "Dave for Pres")?
3. Do I then write my queries to FindAll(ev => ev.Campaign.Name == claim.name) to populate the existing events?
4. This means I'm creating all these claims as people get/lose rights and map them to the campaigns. So I need to keep them in sync.
5. And no need to create a claim that would be given to every user. For that, just require an authenticated user - correct?
6. Am I missing anything?

The alternative is each campaign object has a collection of admins, managers, and volunteers.

• Advantage - the "claim" is a part of the campaign object and so no need to sync.
• Disadvantage - the "claim" has moved for the Identity system to a business object.
• Any other advantages/disadvantages?