1.0.0-rc.1 · Release Candidate1 min read
AutoCore Permission Evaluation and API Boundaries
How AutoCore evaluates authentication, roles, permissions, and service-level ownership checks.
Authorization is layered: JwtAuthGuard establishes the user, RolesGuard evaluates declared role requirements, PermissionsGuard evaluates declared permissions, and the service applies ownership, dealer membership, state, concurrency, and configuration checks.
| Area | Source-verified boundary |
|---|---|
| UI gate | The Admin shell hides links and controls when the permission is absent. |
| API gate | Direct requests without the required permission fail even when the route is known. |
| Service gate | State transitions, ownership, revision timestamps, and external configuration are enforced after authorization. |
| API-only behavior | Bulk reindex, catalog merge/import, orphan deletion, policy authoring, consent publication, provider configuration, and integrity repair are not described as ordinary UI controls unless verified. |
Verification
Verify the route, permission, response state, audit outcome, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.