Please enable JavaScript.
Coggle requires JavaScript to display documents.
Module 02: Authentication & Access - Coggle Diagram
Module 02: Authentication & Access
About
Purpose: Sign-in, SSO/MFA, roles, permissions, scope and field-level access
Group: A. Foundation and administration
🟢 Starts in MVP1 [MVP1]
Personas
All users
Resource Manager
Project Manager
Program Director
Planner
Compliance Coordinator
Mobilization Coordinator
Contingent Manager
HR
Tenant / Integration Admin
Platform Admin
PRD references
ACC-001, ACC-002, ACC-003, ACC-004, UX-002, WFV-007
🗂 Legend
🟢 MVP1: PRD Phase 0 + 1
🔵 MVP2: PRD Phase 2
🟡 MVP3: PRD Phase 3
⚪ MVP4: PRD Phase 4
🟠TBD: docx only, decision needed
Connected modules
Receives from
Tenant Management
Sends to
All modules (decides what each user sees)
Menus, pages, features and functionality
All areas
Menu: Sign-in
🟢 Page: SSO login [MVP1]
🟢 Login, SSO and MFA [MVP1]
🟢 Sign in with tenant SSO (SAML and OIDC) and MFA [MVP1]
🟢 Email login stub for dev [MVP1]
🟢 Page: Access denied, session expired, logout [MVP1]
🟢 Sign-in pages [MVP1]
🟢 Show access denied for missing role; session timeout with re-login; logout clears session on all tabs [MVP1]
Manager workspace
Menu: Global header > Header
🟢 Page: Business-unit and region switcher [MVP1]
🟢 Scope switcher [MVP1]
🟢 Switch business unit or region within the user's allowed scope; all pages filter to it [MVP1]
🟢 Page: My account, help and logout [MVP1]
🟢 My account [MVP1]
🟢 View own role and scope, help links, sign out [MVP1]
Menu: Workforce > Workforce 360
🟢 Page: Resource profile [MVP1]
🟢 Field-level permissions [MVP1]
🟢 Hide cost rates, contact details, screening status, medical fitness and HR notes from unauthorized roles at API level [MVP1]
🟢 Audit each view [MVP1]
Menu: Admin > Integrations
🔵 Page: Connections and adapters [MVP2]
🔵 SCIM user provisioning [MVP2]
🔵 Automatic create and remove of users tied to HR status [MVP2]
Menu: Admin > Admin & Policies
🟢 Page: Users and roles [MVP1]
🟢 Roles and permissions [MVP1]
🟢 12 roles (Tenant Admin, Integration Admin, Program Director, Resource Manager, Project Manager, Planner, Compliance Coordinator, Mobilization Coordinator, Contingent Manager, HR, Viewer, DC Resource) scoped by business unit and region [MVP1]
🟢 Page: Roles and permissions [MVP1]
🟢 Default roles [MVP1]
🟢 Ship the 12 PRD roles as read-only defaults; each role lists its module, page and action permissions [MVP1]
🟢 Custom roles [MVP1]
🟢 Clone a default role and add or remove permissions; sensitive permissions sit in a separate restricted group [MVP1]
🟢 Permission engine [MVP1]
🟢 One permission list (module.page.action) checked on the server for every API call; menus and buttons render from the user's permissions [MVP1]
🟢 View as user [MVP1]
🟢 Admin previews the portal as a chosen user to check what they can see; audited [MVP1]
🟢 Role change audit [MVP1]
🟢 Every role and permission change is logged with who, when and what changed [MVP1]