Skip to main content

Authorization

Summary​

HR Suit authorization combines authenticated JWT claims with downstream role, permission, policy, tenant, and resource-scope evaluation.

Audience​

  • Platform and customer administrators
  • Implementation partners
  • Developers and QA engineers
  • Solution architects and security engineers

Purpose​

Authorization determines whether an authenticated principal may perform an operation within the correct platform, tenant, and business-resource boundary.

Architecture​

The identity service supplies claims. The downstream application that owns an operation remains responsible for its authorization decision.

Business concepts​

  • Roles group access responsibilities and can be tenant- or portal-scoped.
  • Permissions represent access capabilities and are inherited through assigned roles.
  • Claims carry the authenticated identity and access context in a token.
  • Policies translate claims and other requirements into endpoint access rules.
  • Resource scope can further limit an allowed operation to self, team, tenant, or platform context.

Technical implementation​

Identity JWTs contain individual standard role claims, a compatibility role representation, and individual permission claims. They also carry user, portal, tenant, and employee identifiers when available.

Identity-service self-service endpoints use authenticated-user requirements; the identity service does not define a named policy catalog. Named policies and endpoint filters are implemented by downstream services and the active monolith, so policy semantics are Transitional and service-specific.

  • Super Admin: confirmed by identity-service login rules and downstream platform-level authorization checks. A super-admin identity is a platform account rather than a tenant account.
  • Platform Admin: accepted by platform-service authorization checks. Provisioning and assignment of this role through identity-service APIs are Requires confirmation.
  • Employee authorization: downstream applications use authenticated identity, employee mapping, permissions, and tenant/resource scope. An Employee identity-service role assignment workflow is Requires confirmation; employee access must not be inferred from the role name alone.

The gateway forwards authorization context but is not the primary policy enforcement point.

Confirmed source references​

  • microservices/src/identity-service/Application/Security/IdentityJwtTokenService.cs
  • microservices/src/identity-service/Application/Auth/IdentityAuthService.cs
  • microservices/src/identity-service/Domain/Entities/Role.cs
  • microservices/src/identity-service/Domain/Entities/Permission.cs
  • microservices/src/platform-service/Api/PlatformAdminEndpoints.cs
  • microservices/src/employee-service/Program.cs

See Also​

Keywords​

  • Policy enforcement
  • Permission claim
  • Resource scope

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: identity-team
  • Status: Draft