The right people see the right work—and access ends when it should.

Authorisation

• Required scope fails closed

  Tenant context is resolved for tenant-owned data. Facility context is required only where the owning model, query or policy defines it; a missing required scope is refused rather than defaulted.

• Ordered permission evaluation

  Permission evaluation applies user deny, user allow, role deny and then role allow, followed by inherited-parent checks. A matching user allow can therefore override a role deny.

• Time-bound access

  A grant can carry an expiry, after which it is excluded from evaluation and removed by maintenance processing.

• Governance history is separate evidence

  Grant history retains the actor, reason and optional reference that explain how access was created; it is not the runtime decision result.

• Four-eyes on sensitive permissions

  Escalation-capable permissions create an approval request for a different administrator. Self-approval is blocked.

• Separation of duty

  Conflict rules reject incompatible permission combinations when access is granted and defend the same boundary during evaluation.

• Narrowly explainable decisions

  Evaluation identifies the decision source and the matched literal or wildcard rule when a rule matched. Grant and audit history remain separate evidence.

Isolation

• Service-owned persistence

  Implemented services own their data boundary instead of sharing a writable application schema.

• Tenant filtering in shared persistence

  Shared EF infrastructure universally filters tenant-owned rows by tenant. Facility scope is enforced only by the owning model, query or policy; there is no universal facility persistence filter.

• Boundaries by contract

  Services exchange defined events and validated calls. One service does not reach into another service’s tables.

Identity

• Authorization-server ownership

  Auth owns the OAuth 2.0 and OpenID Connect authorization server and token issuance rather than relying on custom session code.

• Account and assurance ownership

  Identity owns accounts, memberships, MFA and passkeys, invitations, sessions and sign-in risk.

• Session control

  Identity-owned active sessions are visible and revocable, including account-lifecycle revocation paths.

• Login-risk signals

  Signals such as a new device, location or IP can contribute to a recorded sign-in risk decision.

• Explicit account lifecycle

  Pending, active, suspended, terminated and archived states make authentication eligibility a deliberate decision.

Audit

• Dedicated audit ingestion

  Audit events are ingested separately from ordinary application logging and retained outside the emitting service.

• Entity change history

  Change evidence can retain what changed, from what, to what and by whom.

• Access-governance history

  Grant, revocation, expiry, approval and rejection history records actor, reason and timestamp.

• Queryable and exportable

  Evidence retrieval is designed as a direct query and export path rather than a manual log investigation.