Skip to content

Identity and Access Management (IAM)

Purpose

BizOS implements Identity and Access Management across two strictly segregated user realms: 1. Internal platform team (Operators): Managed via the control-plane and admin portal to operate and support the platform. 2. Customer organizations (Tenants): Managed within isolated per-tenant databases to run day-to-day business operations.

This area covers identity verification, session management, access control, and credential lifecycles for tenant users, while defining the boundary between tenant access and platform operator access.

Specifications

File Prefix Capability Status
00-user-types.md USR Dual user model: system/internal team vs customer tenant users Implemented
01-sign-in.md IAM Tenant user sign-in, session issuance, and logout Draft
02-register.md REG Tenant user registration and password validation Draft
03-user-management.md USM Workspace user management (list, add, edit, lock, delete) Implemented
04-change-password.md PWD Signed-in user changes their own password and every session ends Implemented
Activity log ACT Tenant activity log (list only; tenant admins; merged into System specs) Implemented
05-notification-center.md NTF Tenant announcement catalog, per-user read state, CSV import, and event-created notices Implemented
06-password-reset.md RST Forgot-password email link and reset without the current password Implemented
07-my-profile.md PRF Signed-in user views and updates own full name and email Implemented
08-audit-writer.md AWR Persist tenant activity entries for the Activity log Implemented
09-roles-and-permissions.md PRM Role-based access control, system roles, and permission matrix across platform and tenant realms Implemented

Core Principles

  1. Strict Identity Isolation: Operator accounts on the control plane and customer accounts in tenant databases are completely separate. No shared passwords, tokens, or credential cross-authentication.
  2. Subdomain-Aware Scoping: Customer identity is scoped to <tenant>.<root-domain>. Operator identity is scoped to admin.<root-domain>.
  3. Defense in Depth: Authentication checks occur at both the ingress / reverse proxy layer and the NestJS application guard layer.
  4. Least Privilege & Role-Based Access: All operations require explicit roles. Operators cannot view customer business records, and customer users cannot access infrastructure controls.