Asset Permissions Matrix
Summary
This matrix separates what gates visibility (frontend navigation and route guards) from what authorizes an API call. The critical fact: asset native and compatibility endpoints are anonymous and tenant-scoped, with no backend role authorization. Ownership narrowing for employee self-service happens at the gateway by labor id, not on the endpoints.
Audience
Security engineers assessing exposure, solution architects reasoning about defense in depth, and QA engineers verifying access behavior.
Reference Content
Enforcement layers
Action matrix
| Action | UI visibility | Route guard | Role check | Feature flag | API authorization | Tenant enforcement | Resource ownership | Classification | Source path |
|---|---|---|---|---|---|---|---|---|---|
| Admin view asset requests | Role/permission gated | Prefix rule | hr-admin/it-asset-admin | hr-operations | None (tenant-scoped) | EF filter | None | Visibility-gated only | microservices/src/asset-service/Api/AssetCompatEndpoints.cs |
| Admin create/assign/reject | Role/permission gated | Prefix rule | hr-admin/it-asset-admin | hr-operations | None (tenant-scoped) | EF filter | None | Visibility-gated only | microservices/src/asset-service/Api/AssetEndpoints.cs |
| Admin status change | Role/permission gated | Prefix rule | hr-admin/it-asset-admin | hr-operations | None (tenant-scoped) | EF filter | None | Visibility-gated only | microservices/src/asset-service/Api/AssetEndpoints.cs |
| ESS view my assets | Permission gated | Prefix rule | employee | self-service | None (tenant-scoped) | EF filter | Gateway labor-id filter | Ownership via gateway | microservices/src/gateway-api/Program.cs |
| ESS raise request | Permission gated | Prefix rule | employee | self-service | None (tenant-scoped) | EF filter | Gateway labor-id filter | Ownership via gateway | microservices/src/asset-service/Api/AssetEndpoints.cs |
| Workflow callback | Not UI | Not UI | None | workflow flag | None (tenant-scoped, idempotent) | EF filter | None | Anonymous inbound | microservices/src/asset-service/Api/AssetEndpoints.cs |
Posture summary
- UI visibility: role and permission gated at the frontend.
- API authorization: none; endpoints are anonymous and tenant-scoped.
- Tenant enforcement: EF global query filters plus tenant context (application-level, not database row-level security).
- Ownership: gateway labor-id filter for ESS reads; no per-record ownership authorization on the endpoints.
Source References
microservices/src/asset-service/Api/AssetEndpoints.csmicroservices/src/asset-service/Api/AssetCompatEndpoints.csmicroservices/src/gateway-api/Program.cs
Related Articles
See Also
Keywords
asset permissions, authorization, tenant enforcement, ownership, anonymous endpoints
Revision Information
- Status: Draft
- Last reviewed: 2026-07-17
- Review cycle: Quarterly