Expense Permissions Reference
Summary
UI visibility, route protection, gateway context, tenant filtering, ownership rules, and business validation provide different layers of evidence. They do not establish a complete role catalog.
Audience
Product, architecture, security, frontend/backend, QA, support, and implementation teams.
Reference Content
| Capability | Authentication evidence | Tenant requirement | Claimant/self scope | Approver scope | Finance/admin scope | UI guard evidence | API enforcement evidence | Workflow-managed behavior | Compatibility behavior | Maturity | Requires confirmation |
|---|---|---|---|---|---|---|---|---|---|---|---|
| View ESS claims | Protected portal and gateway context | Required downstream | Gateway supplies the claimant filter | Not applicable | Not established | Employee navigation checks feature/permission candidates | Native query applies tenant and claimant filters | Not applicable | ESS gateway forwards to the native path | Partial | Claimant-list authorization parity |
| Create self claim | Protected portal | Required | Portal/gateway supplies claimant context | Not applicable | Not established | Employee navigation checks self-service candidates | Domain command validates claimant context | Workflow may start after native creation when enabled | Compatibility also exposes create | Partial | Canonical identity mapping and route parity |
| View pending approvals | Protected HR Operations route | Required | Not self-only | Team/all navigation candidates exist; authority is not proven | Finance role not confirmed | Navigation and route rules use different permission candidate sets | Tenant scope exists; approver authority is not established at the endpoint | Workflow linkage does not itself grant list authority | Compatibility workspace supplies the list | Transitional | Manager/team scope and Finance visibility |
| Approve/reject | Protected presentation | Required | No self-decision restriction is documented | No authoritative manager role predicate confirmed | Finance authority unconfirmed | Shared page renders actions for its non-employee presentation | Lifecycle checks exist; actor authority remains unresolved | Direct decisions are blocked for workflow-managed claims | Compatibility delegates decisions to native commands | Requires confirmation | Approver identity, self-approval, team scope, and parity |
| Delete Pending | Protected presentation/native caller | Required | Command checks claimant ownership when caller identity is present | Not applicable | Privileged behavior exists but its role mapping is not cataloged | Compatibility employee card enables delete only for a pending presentation | Pending status plus conditional ownership check | Not applicable | Compatibility delegates delete to the native command | Partial | Privileged caller governance and identity completeness |
| Mark Paid | Authentication middleware; no Expense UI | Required | Not established | Not applicable | Authority unconfirmed | Not implemented | Approved-only lifecycle check; no confirmed Finance policy | Workflow is not the payment executor | No compatibility Paid route is confirmed | Requires confirmation | Finance authority and payment governance |
| Manage receipts | Authentication middleware; disabled portal control | Required | Receipt access governance unconfirmed | Not applicable | Governance unconfirmed | Not implemented | Claim/reference and Document dependency checks | Not applicable | No compatibility receipt route is confirmed | Requires confirmation | Claimant, approver, and administrator receipt access |
| Read audit/timeline/outbox | Authentication middleware; no Expense UI | Tenant filtering varies by store | Not established | Not established | Operational ownership unconfirmed | Not implemented | Foundation native endpoints | Not applicable | No equivalent compatibility presentation is confirmed | Foundation | Operational access policy and outbox payload governance |
The service has authentication/authorization middleware, while endpoint-level and compatibility parity require confirmation. Do not treat navigation visibility as authorization.
Requires confirmation
Canonical roles, manager/team scope, Finance authority, receipt access, operational evidence access, native/compatibility parity, and direct-route enforcement require confirmation.
Source References
UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsxUI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsxUI/salary-ui/apps/client-hrms-portal/src/pages/hr/HrOperationsPage.tsxmicroservices/src/gateway-api/EssEndpoints.csmicroservices/src/expense-service/Application/Commands/ExpenseClaimCommands.csmicroservices/src/expense-service/Api/ExpenseEndpoints.csmicroservices/src/expense-service/Api/ExpenseCompatEndpoints.cs
Related Articles
See Also
Keywords
- Expense reference
- Permissions Reference
Revision Information
- Status: Draft
- Last reviewed: 2026-07-16
- Review cycle: Quarterly