Skip to main content

Employee Security Boundaries

Summary​

Employee Service validates bearer authentication from the transitional and Identity token authorities, derives tenant/actor context for requests, and applies tenant-aware data filters. Fine-grained authorization enforcement remains transitional.

Audience​

  • Backend developers and QA engineers
  • DevOps engineers, solution architects, and security engineers

Purpose​

Define responsibility boundaries without exposing token material, internal trust details, or exploitable configuration.

Confirmed boundaries​

  • Authentication is configured at the Employee host and supports coexistence of current and Identity-issued token authorities.
  • Token validation includes issuer, audience, signature, lifetime, name, and role categories when corresponding configuration is present.
  • Token keys, algorithms, values, and lifetimes are intentionally not documented.
  • Tenant and actor information are supplied through the request context and used by application, audit, and persistence components.
  • Tenant query filters apply to employee, organization, audit, and profile data; a controlled platform-wide context can bypass tenant filtering.
  • Application operations requiring a tenant call RequireTenantId and fail safely when context is absent.
  • Identity owns credentials, account state, roles, permissions, and sessions. Employee owns workforce data.

Authorization status​

Employee permission policy names are defined and policies are registered. The reviewed endpoint mappings do not confirm consistent fine-grained policy enforcement across every presentation surface. Authorization coverage therefore Requires confirmation before treating permission names as an enforced matrix.

Compatibility request context exists during migration. Its production trust boundary and retirement plan Require confirmation; details are intentionally excluded from public documentation.

Security responsibilities​

  • Gateway: edge routing and preservation of authenticated request context.
  • Identity: authentication and authorization claims.
  • Employee: validate accepted tokens, require tenant context, enforce workforce invariants, isolate tenant data, and attribute audits.
  • Platform: tenant/control-plane governance.

Source References​

  • microservices/src/employee-service/Program.cs
  • microservices/src/employee-service/Infrastructure/Persistence.cs
  • microservices/src/employee-service/Infrastructure/EmployeeDbContext.cs
  • microservices/src/employee-service/Api/Endpoints.cs

See Also​

Keywords​

  • Tenant isolation
  • Authentication boundary
  • Authorization coverage

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-15
  • Review cycle: Quarterly