Employee Permissions Reference

Summary

Employee access combines frontend feature evidence, monolith access scope, and extracted-service named policies whose current enforcement is authentication-only.

Audience

• Security/access reviewers, HR administrators, developers, QA/support engineers, and architects

Reference Content

Capability	Authentication	Authorization evidence	Tenant	UI guard	API enforcement	Status / confirmation
Open Employee page	Required	Workforce plus existing labor feature token	Required client tenant	Route/menu guard	List API also scoped	Implemented; role governance requires confirmation
List employees	Required	Monolith accessible-employee scope	Required	Page route only	Result narrowed by access scope	Implemented
View one employee	Required	Monolith employee access check	Required	Selection from loaded list	Forbidden outside scope	Implemented
Create/update/status	Required	Monolith tenant-wide access	Required	No component-level mutation guard	Tenant-wide scope check	Implemented in monolith
Extracted view/create/update/delete	Required	Named Employee policies exist	Required	UI not cut over	Current policy registration requires authenticated user	Transitional; permission claim enforcement requires confirmation
Manage department/designation	Required	Named extracted policy placeholders	Required	Separate organization route rules	Current policy registration authentication-only	Transitional
Generate profile documents	Required	UI role/feature check plus document API	Required	Component-level conditional action	Document API owns enforcement	Requires confirmation across services

This is not a complete role catalog. Navigation role labels do not replace API authorization.

Source References

• UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsx
• UI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsx
• Controllers/LaborController.cs
• microservices/src/employee-service/Api/Endpoints.cs
• microservices/src/employee-service/Program.cs

Related Articles

• Navigation and access
• Authentication context
• Security boundaries

See Also

• Employee overview
• Employee troubleshooting

Keywords

• Employee permissions
• access scope
• route guard

Revision Information

• Status: Draft
• Last reviewed: 2026-07-15
• Review cycle: Quarterly