Onboarding & Offboarding Permissions and Access
Summary
The client uses module features, permission names and normalized roles to control navigation and protected routes. These checks improve UX but do not replace server-side authorization, tenant scoping or record-scope rules.
Audience
Lifecycle users, security reviewers, QA and support.
Reference Content
| Surface or action | Verified client behavior | Authoritative boundary |
|---|---|---|
| Offers, Onboarding, Recruitment Reports | Talent-menu entries require Recruitment visibility and recruitment-oriented roles | Routed Recruitment/compatibility authorization |
| Recruitment dashboard | Allows recruiter, HR administrator and HR manager roles in its navigation definition | Report and workspace endpoints |
| Exit route | Protected under HR Operations permissions, including self/team/all exit scopes | HR Operations controller policies and tenant/employee scope |
| Employee exit view | Shown when the signed-in user is employee-only; uses the current employee identity | Backend self-scope |
| Exit approvals and access revoke | Shown to non-employee-only users | Backend manager/admin and permission decisions |
| Public offer response | Does not require the authenticated application shell | Possession and validity of the opaque action link plus server rules |
The exit page derives its employee-only presentation from user data stored by the client. A mixed-role user may receive the privileged presentation. This is not proof that a privileged mutation will be allowed; the server must reject unauthorized requests.
Tenant and subject identifiers are supplied or inferred across the request chain. Support staff should diagnose absence or denial without copying those identifiers into public documentation or tickets. Never infer permission from a visible button, hidden menu item or successful page load.
Source References
UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsxUI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsxUI/salary-ui/apps/client-hrms-portal/src/pages/hr/HrOperationsPage.tsxmicroservices/src/employee-service/Program.cs
Related Articles
See Also
Keywords
- Authorization
- Route guard
- Tenant scope
Revision Information
- Status: Draft
- Last reviewed: 2026-07-20
- Review cycle: Quarterly