Workflow Permissions & Visibility
Verified layers
| Layer | Verified rule | Boundary |
|---|---|---|
| Operations sidebar | Admin/manager audience, selected manager/admin roles, and any eligible Workflow/settings value | Presentation only |
| Settings sidebar | Admin audience, HR-admin role and any eligible Workflow/settings value | Presentation only |
| Route guard | Authenticated tenant session and any eligible Workflow/settings value | Does not repeat role/audience check |
| Workflow endpoints | No authorization policy applied | Foundation gap |
| Task query | Pending tasks assigned to caller email or any caller role | Query-level ownership filter |
| Persistence | Tenant query filters and required tenant context | Tenant isolation |
The service registers authentication middleware, but its policy catalog is empty and the Workflow endpoint group does not require authorization. Tenant headers/claims and caller identity therefore need a trusted ingress boundary that is not verified in this repository path.
Requires Confirmation
Authoritative permissions, trusted ingress, role normalization, author-versus-approver separation and endpoint authorization rollout require confirmation and security review.
Source References
UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsxUI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsxmicroservices/src/workflow-service/Api/Policies.csmicroservices/src/workflow-service/Api/WorkflowEndpoints.csmicroservices/src/workflow-service/Infrastructure/Persistence.csmicroservices/src/workflow-service/Infrastructure/WorkflowDbContext.cs
Related Articles
See Also
Keywords
Workflow permissions, visibility, authorization, tenant isolation.
Revision Information
Draft source-backed documentation reviewed on 2026-07-20; next quarterly review is 2026-10-20.