Scope
Oto uses scoped role-based access control with IAM-style permissions. The principal is the person or system requesting access. A role is a named collection of permissions. Each permission is written as service:resource:action, such as inventory:stock:adjust or messaging:inbox:assign. A scope limits the permission to the applicable operator, branch, department, or record relationship. Effective permissions are the permissions available to the principal after combining all assigned roles and scopes.
Design
Authorized administrators assign one or more roles and scopes to a staff account and can review the resulting effective permissions. When a person lists, opens, or changes a protected record, Oto checks the required service:resource:action permission within the applicable scope. Public and kiosk access is limited to the record and action associated with that workflow.
Failure handling
If the principal lacks the required permission or the requested record is outside the permission’s scope, Oto denies the action and does not read or change the protected record.
Requirements
- Roles are named collections of service:resource:action permissions.
- A principal’s effective permissions combine permissions from all assigned roles within their assigned scopes.
- Authorized administrators can assign and remove roles and scopes and review the resulting effective permissions.
- Protected reads and changes require the applicable permission and scope.
- Public and kiosk access remains limited to its documented workflow.
Verification
- Test allowed and denied service:resource:action permissions for each applicable scope.
- Test effective permissions for principals with one role, multiple roles, and removed roles.
- Test cross-branch, cross-operator, and cross-department record access.