Multi-tenant, Role-based Access

Purpose — Ensure every user only accesses the data they are entitled to, across many isolated organisations on the same platform.

Who Can Use It 

 Applies to everyone using the system.

Key Capabilities

• Multi-tenant isolation — every request is routed to the caller's tenant using a tenant header; data is never mixed across tenants.
• Role-based defaults — schoolADMIN, dhe, dheEmployee, employee, and student have sensible built-in access levels.
• Explicit permission grants — Employee Create / Read / Update / Delete / Export, Document Create / Read / Update / Delete, and Department Access (Current / Additional) permissions can be granted per user to unlock additional capabilities.
• Ownership checks — regular employees are limited to their own records unless explicitly elevated.
• Scope resolution for department users — dheEmployees' accessible schools and departments are computed from their designation and organisation, with results cached for performance.
• Fail-closed behaviour — missing scope or missing permissions never accidentally expose data; results are limited or refused.

Rules & Restrictions

• All protected endpoints require a valid bearer token issued by the platform's Auth service.
• The tenant name header is required for tenant resolution.
• Service-to-service endpoints authenticate via service key or API key and are not intended for end users.