Important Rules & Restrictions

• Authentication and Tenancy. Every protected action requires a valid bearer token and a tenant name. Missing or invalid credentials are rejected.
• Scope Fail-Closed. For dheEmployees, missing designation or organisation identity results in no access rather than open access. Requesting a school or department outside the resolved scope is treated the same as no-access.
• Permission Hierarchy. schoolADMIN and dhe bypass most permission checks in their scopes. All other users rely on role defaults plus explicit grants (Employee, Document, Contact, and Department Access permissions).
• Ownership. Regular employees can act only on their own record, contacts, addresses, qualifications, employment history, and documents unless a grant lifts the restriction.
• Approval Workflow Guardrails. Only one pending request per section per employee at a time. Every request must contain at least one changed field. Reviewed requests cannot be re-reviewed. Employees can acknowledge only their own outcomes and only after review.
• Deletion Limits. DHE users can delete only department employees. Batch delete requires a non-empty list.
• Document Access. Files are served only through an authenticated, ownership-aware endpoint. Uploading a new document of an existing type replaces the previous version.
• Bulk Operations. Only CSV and Excel formats are accepted for bulk onboarding. Bulk approve inherits the same per-request permission rules as individual approval.
• Auditing. Every create, update, and delete records the acting user (preferring the "managed by" identity from the token) and is written to the application log.
• External Dependencies. School details come from the Org service, department details from the Metadata service, attendance summaries from the Attendance service, and permissions from the Auth service. If any of these are unavailable, the affected fields may be missing or stale, but core employee data remains accessible.
• Rate Limiting and CORS. The API is protected by rate limiting and cross-origin controls configured at deployment time.