Workflows & Permissions

Role is broad context; permissions authorize specific actions. Sensitive HR, Finance, CRM and platform actions use server-side guards.

Usage principles

• least privilege
• tenant context on every protected operation
• positive and negative authorization tests
• workflow transitions rather than direct state edits
• audit critical mutations