LMS Permission Evidence

Summary

UI visibility exists, but Training endpoint authorization is not registered. Permissions must not be inferred from navigation labels.

Audience

Business, product, engineering, QA, support, operations, architecture, security, and implementation reviewers.

Reference Content

Control	Verified evidence	Boundary
Navigation visibility	Dashboard, admin, and ESS entries have role/feature/audience categories	UI-only
Route visibility	Protected client shell and prefix rule for Training admin	UI-only; not endpoint authorization
Dashboard visibility	Dashboard component checks configured role/feature categories	UI-only
Gateway visibility	ESS route is protected in the client; Gateway forwards the read	Downstream ownership enforcement not proven
Endpoint authorization	Training Program does not register authentication/authorization middleware or endpoint authorization requirements	Not implemented in reviewed Training service
Tenant ownership	Training DbContext applies tenant filters and assignment	Tenant context can also come from request headers; trust boundary requires confirmation
Employee ownership	Enrollment records carry employee-user references	ESS forwarding does not prove employee-specific filtering
Administrative ownership	UI labels identify Training/HR administration categories	No backend admin policy proven
Super-administrator behavior	Tenant query filters can be bypassed by super-administrator context	Governance and auditing require confirmation
Missing authorization	Fine-grained course, enrollment, assessment, certificate, session, report, and import policies absent	Security review required

Navigation visibility, route visibility, tenant filtering, employee ownership, and authorization are separate concerns.

Requires confirmation

Policy ownership, fine-grained authorization, operational governance, future-state terminology, and retirement criteria require confirmation where not implemented.

Source References

• UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsx
• UI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsx
• UI/salary-ui/apps/client-hrms-portal/src/dashboard/DashboardPages.tsx
• microservices/src/training-service/Program.cs
• microservices/src/training-service/Infrastructure/TrainingDbContext.cs
• microservices/src/gateway-api/EssEndpoints.cs

Related Articles

• LMS reference
• LMS business documentation

See Also

• Technical documentation
• API documentation

Keywords

• LMS reference
• LMS Permission Evidence

Revision Information

• Status: Draft
• Last reviewed: 2026-07-17
• Review cycle: Quarterly