Permissions

Permissions follow the pattern action:resource (for example create:inbound-order). Users receive permissions through the roles assigned to them.

How permission checks actually work

When an endpoint is protected, the system looks for a role permission whose value exactly matches the required action:resource string, or the single super-permission *:*.

This has two important consequences that differ from many RBAC systems:

• There is no manage expansion. A manage:warehouse permission does not grant create:warehouse, read:warehouse, etc. Each action must be granted explicitly.
• There are no partial wildcards. read:* or *:warehouse are not honoured. The only wildcard that works is the exact string *:*, which grants everything.

So in practice you grant the four concrete actions you need, or you grant *:* for a full administrator.

Actions

Only four actions are enforced, plus the *:* super-permission.

Action	Description
create	Create new records
read	View records
update	Modify existing records (includes workflow steps such as start-receiving, reserve, complete)
delete	Remove records
*:*	Full access to everything (super-administrator)

A manage action and a scan action exist in the permission catalogue and can be assigned to a role, but no endpoint currently checks for them — they grant nothing on their own. Don’t rely on them.

Resources

These are the resources that are actually enforced by an endpoint, and which actions are available for each. (Some entities exist in the system but have no permission check — see the note below.)

Resource	Actions enforced	Description
warehouse	create, read, update, delete	Warehouse entities
warehouse-item	read	Item enrollments per warehouse (create/update/delete are not permission-checked)
item	create, read, update, delete	Global item catalog
category	create, read, update, delete	Item categories
zone	create, read, update, delete	Warehouse zones
aisle	create, read, update, delete	Aisles
rack	create, read, update, delete	Racks
shelf	create, read, update, delete	Shelves
bin	create, read, update, delete	Storage bins
lot	create, read, update	Lots / batches (no delete)
inbound-order	create, read, update, delete	Inbound (receiving) orders — lines are managed through the order
outbound-order	create, read, update, delete	Outbound (dispatch) orders — lines are managed through the order
transfer-order	create, read, update, delete	Internal transfer orders — lines are managed through the order
stock-count	create, read, update, delete	Stock count sessions
inventory-transaction	create, read, update, delete	Inventory transaction ledger
serialized-unit	read	Serialized / RFID unit records
user	create, read, update, delete	User accounts
role	create, read, update, delete	Roles
permission	create, read, update, delete	Permission records
role-permission	create, read, update, delete	Role-permission assignments
audit-log	read	Audit log entries

Unguarded operations. Stock adjustments (stock-adjustment) and the create/update/delete of warehouse-item enrollments currently have no permission check — any authenticated user can perform them. Order lines (inbound-line, outbound-line, transfer-line) are not checked individually; they are created and edited through their parent order, so the order permission is what matters.

Common permission sets

Receiving team

create:inbound-order
read:inbound-order
update:inbound-order
read:warehouse-item
read:bin
read:lot

(update:inbound-order covers start-receiving, recording receipts, and completing the order.)

Picking / dispatch team

create:outbound-order
read:outbound-order
update:outbound-order
read:warehouse-item
read:bin

(update:outbound-order covers reserving and completing the order.)

Transfer / putaway team

create:transfer-order
read:transfer-order
update:transfer-order
read:warehouse-item
read:bin

(update:transfer-order covers completing the transfer.)

Stock count team

create:stock-count
read:stock-count
update:stock-count
read:warehouse-item
read:bin

(update:stock-count covers recording counts and completing the session.)

Warehouse manager

Grant the concrete actions explicitly — manage:* does nothing.

create:warehouse-item
read:warehouse-item
update:warehouse-item
create:category
read:category
update:category
delete:category
create:stock-count
read:stock-count
update:stock-count
delete:stock-count
read:inventory-transaction
read:audit-log
create:zone
read:zone
update:zone
delete:zone
create:bin
read:bin
update:bin
delete:bin
create:rack
read:rack
update:rack
delete:rack
create:shelf
read:shelf
update:shelf
delete:shelf
create:aisle
read:aisle
update:aisle
delete:aisle

System administrator

*:*