Workflow API Authorization

Summary

Backend Workflow authorization is Not implemented at the reviewed route boundary.

Policy registration

Authorization services and middleware are present, but the Workflow policy collection is empty. No native or shared operation calls an authorization-requirement method.

Decision authorization

Approve, reject and delegate commands check tenant and state, but do not verify caller email/roles against task assignment.

Authoring and diagnostics

Definition create/update/publish and audit/timeline/outbox reads have no permission separation.

Frontend distinction

Portal route/navigation permission checks are presentation controls and do not establish API authorization.

Requires Confirmation

The intended permission matrix, assignment enforcement, diagnostic administration and upstream enforcement require confirmation.

Source References

• microservices/src/workflow-service/Program.cs
• microservices/src/workflow-service/Api/Policies.cs
• microservices/src/workflow-service/Api/WorkflowEndpoints.cs
• microservices/src/workflow-service/Application/Commands/WorkflowInstanceCommands.cs

Related Articles

• API overview
• Endpoint catalog
• API limitations

See Also

• Technical documentation
• Workflow business documentation

Keywords

Workflow API, approval endpoint, Workflow Service.

Revision Information

• Status: Draft
• Last reviewed: 2026-07-20
• Next review: 2026-10-20