IAM Principles and Access Control

The Access Control Model

The SSM.ro platform implements access control at the server-side application and database query layer, not at the UI level. The graphical interface reflects the user's permissions for usability reasons (menus, buttons and fields are hidden when not applicable), but the UI is not the enforcement boundary; every request is authorized independently on the server before any data is returned.

RBAC Enforcement

• Authentication is enforced server-side on every request — no request reaches an application action without a valid session
• Authorization is performed server-side based on the authenticated user's role and the organization they belong to — bypassing the UI (e.g. direct calls to endpoints) does not bypass the role check
• Tenant isolation is enforced at the database query level — every query on a tenant-scoped resource is automatically constrained to the current tenant, so a user cannot read or write data belonging to another tenant, regardless of the request's form
• Subdomain verification provides an additional server-side check that the authenticated user is operating within their own tenant

---

Tenant Isolation (Multi-Tenant)

The SSM.ro platform isolates tenants through two complementary mechanisms applied to every request:

1. Tenant Identification via Subdomain

• Each organization (tenant) accesses the platform on a dedicated subdomain — on *.appssm.ro in the Shared model, or on subdomains of clientdomain.ext in the Enterprise model
• Every incoming request is inspected at the application level, and the requesting subdomain is mapped to the corresponding tenant identifier
• Requests arriving on a subdomain that does not correspond to a valid tenant are rejected

2. Logical Partitioning of Data per Tenant

• Every record belonging to a tenant carries a tenant identifier as part of its data
• The application establishes the active tenant from the subdomain at the start of every request and constrains all subsequent data access to that tenant identifier
• Read and write operations on tenant-scoped data are transparently restricted to the active tenant — another tenant's data cannot be returned, modified or deleted, regardless of the request's form

Enforcement Properties

• All tenant restriction checks are performed server-side — the UI is not the enforcement boundary
• The active tenant is resolved before the user's role and permissions are evaluated — a user cannot operate outside the tenant they belong to, even with elevated roles
• Authentication is enforced on every request before data access — an unauthenticated request does not reach any tenant data
• Cross-tenant boundaries are independent of the UI and cannot be bypassed through direct calls to the platform's endpoints

---

Role Catalog

The SSM.ro platform structures access around a business account, which can contain one or more organizations. The Super User role is held at the business account level. The User, Control/Audit and Employee Personnel roles are assigned per organization — a person can hold different roles in different organizations within the same business account.

Note: A person can hold different roles in different organizations. The list of specific users and role assignments per organization within the client's business account is managed by the client's own Super User.