Roles and Privileges

Enforcement Model

  • Authentication uses a real JWT (AWS Cognito). Missing or invalid tokens produce 401 responses (EQ-USR- codes).
  • Authorization is per-route. A route is protected only if it declares a required privilege; the caller’s token must grant that privilege or the request is rejected with 403.
  • Privilege claim: privileges and roles are read from configurable token claims (defaults custom:privileges and cognito:groups). The privilege string (for example inventory:createLocation) is matched against the caller’s policy.
  • Admin requirement: the four Instance CRUD routes additionally require an admin user.
  • Tenant context: resource routes require a valid, positive instanceId; the instance is loaded (cached briefly) and the request is rejected if the instance is not found (404) or not ACTIVE (409). This is tenancy enforcement, not authentication. Instance/Property/Attribute routes do not apply it.

Complete Privilege List

60 distinct privileges, all enforced:

Domain Privileges
Instance inventory:readInstance, inventory:createInstance, inventory:updateInstance, inventory:deleteInstance
Instance Property inventory:viewInstanceProperty, inventory:createInstanceProperty, inventory:updateInstanceProperty, inventory:deleteInstanceProperty
Instance Attribute inventory:viewInstanceAttribute, inventory:createInstanceAttribute, inventory:updateInstanceAttribute, inventory:deleteInstanceAttribute
Location inventory:createLocation, inventory:viewLocation, inventory:updateLocation, inventory:deleteLocation
SKU inventory:createSku, inventory:viewSku, inventory:updateSku, inventory:deleteSku
Lot inventory:createLot, inventory:viewLot, inventory:updateLot, inventory:deleteLot, inventory:manageLotLifecycle
Inventory Position inventory:createInventoryPosition, inventory:viewInventoryPosition, inventory:updateInventoryPosition, inventory:adjustInventoryQuantity, inventory:viewInventorySummary, inventory:deleteInventoryPosition
Reservation inventory:createReservation, inventory:viewReservation, inventory:createCart, inventory:updateReservation, inventory:manageReservationLifecycle
Transaction inventory:createTransaction, inventory:viewTransaction, inventory:updateTransaction, inventory:viewTransactionSummary
Availability inventory:checkAvailability, inventory:viewAvailability
Transfer inventory:createTransfer, inventory:viewTransfer, inventory:updateTransfer, inventory:deleteTransfer
Location Channel Policy inventory:createLocationChannelPolicy, inventory:viewLocationChannelPolicy, inventory:updateLocationChannelPolicy, inventory:deleteLocationChannelPolicy
Replenishment Policy inventory:createReplenishmentPolicy, inventory:viewReplenishmentPolicy, inventory:updateReplenishmentPolicy, inventory:deleteReplenishmentPolicy, inventory:viewReplenishmentSuggestions
Replenishment Order inventory:createReplenishmentOrder, inventory:viewReplenishmentOrder, inventory:updateReplenishmentOrder, inventory:manageReplenishmentOrder, inventory:deleteReplenishmentOrder

Revision History
2026-08-05 | AN – Page created and uploaded the contents