Identity and Security

Summary

Authentication, tenant isolation, authorization, compatibility trust, and security limitations.

Audience

Engineers, architects, QA, support, security reviewers, and operators working with the Performance module.

Overview

The service registers bearer authentication and authorization middleware. Request identity and tenant context are resolved from authenticated claims or forwarded context. Persistence global filters isolate tenant-owned records unless a super-administrator context is present.

Confirmed implementation

• Write services require a tenant identifier.
• Global query filters protect cycles, appraisals, goals, reviews, audit, and timeline data.
• Workflow calls forward current tenant and identity context.
• Endpoint modules do not declare an authorization requirement.
• Compatibility endpoints use the same tenant context and filters but also lack explicit endpoint authorization.

Classification

Transitional: authentication and isolation exist, but endpoint permission enforcement is Not implemented.

Requires confirmation

Gateway trust, forwarded-context validation, role and permission policy, employee ownership, manager scope, HR scope, and callback authentication require confirmation.

Related Articles

• Performance technical documentation
• Performance module

See Also

• Technical known limitations
• Performance business documentation

Keywords

• Performance service
• Identity and Security
• Draft technical documentation

Source References

• microservices/src/performance-service/Program.cs
• microservices/src/performance-service/Infrastructure/Persistence.cs
• microservices/src/performance-service/Api/PerformanceEndpoints.cs
• microservices/src/performance-service/Api/PerformanceCompatEndpoints.cs

Revision Information

• Status: Draft
• Last reviewed: 2026-07-16
• Review cycle: Quarterly