User Management & Access ControlCore Module

Matrix Permissions

1. Overview & Purpose

What are Matrix Permissions?

Matrix Permissions provides a two-dimensional access grid mapping navigational menus and API endpoints to operational roles. It governs granular CRUD capabilities (View, Create, Update, Delete, Export, Approve) ensuring users can only interact with authorized screens and server resources.

Menu Location:User Management > Matrix Permissions

2. When to Use Matrix Permissions

Principle of Least Privilege for Cashiers & Store Staff

Frontline cashiers should only view the POS interface, customer lookup, and shift tools, while all general ledger, supplier cost prices, and system settings must be completely invisible.

Recommended Action:In the Matrix Permissions grid, uncheck View permissions for accounting, procurement, and setup modules under the "Cashier" role column.

Customer Data Export Authorization & Leakage Prevention

Preventing rogue store employees or junior staff from downloading entire customer phone/email lists into Excel or CSV spreadsheets.

Recommended Action:Grant View and Create capabilities on Customers, but strictly uncheck the Export capability for all operational roles except the Data Compliance Officer.

Maker-Checker Segregation of Duties (SO / PO / Adjustments)

Ensuring inventory clerks can create draft stock adjustment slips or purchase orders, but cannot authorize their own transactions.

Recommended Action:Grant Create and Update permissions on Stock Adjustments, but reserve Approve and Post permissions strictly for the Warehouse Supervisor role.

Hot-Reload Authorization Cache Invalidation

A company security audit requires immediately revoking delete rights for a compromised user role across all currently logged-in browser sessions.

Recommended Action:Uncheck the target permission in Matrix Permissions and click Save Changes; the application invalidates redis/memory cache instantly, enforcing 403 Forbidden on the next API call.

Granular API Route HTTP Method Security (GET vs POST/DELETE)

Junior store clerks should be able to view inventory levels via GET API calls, but all POST creation and DELETE removal calls must be blocked at backend middleware.

Recommended Action:Configure the Matrix Permissions grid to permit read operations while disallowing mutating HTTP methods for the clerk role profile.

3. Data Dictionary & Fields

Schema structure for the role_access cross-reference table and permissions registry:

Field / Column	Input Type	Requirement	Description & Operational Guide
roleId	BIGINT (FK)	Required	Reference to roles table designating the target authorization group.
permissionId	BIGINT (FK)	Required	Reference to permissions table defining the action capability or API route.
isAllowed	BOOLEAN	Required	Boolean switch governing whether the role is granted access to the permission.
menuId	BIGINT (FK)	Optional	Navigational menu node associated with this permission item.
code	STRING(100)	Required	Machine-readable permission slug (e.g. pos:cashier:create, inventories:transfer:approve).
method	STRING(10)	Required	HTTP method enforced at backend API route guards (GET, POST, PUT, DELETE).
endpoint	STRING(255)	Optional	Backend REST API endpoint pattern protected by this permission rule.

4. Interface Preview

Two-dimensional matrix console showing expandable menu hierarchies, action capability rows, and role access checkboxes.

inventories-web

Menu Location:Route: /admin/user-management/matrix-permissions

Screen Preview: Matrix Permissions Console Interface

Visual interface illustration and control layout for menu Route: /admin/user-management/matrix-permissions

1Hierarchical Menu Expanders2Role Column Checkboxes3CRUD Capability Badges4Batch Commit Button

Matrix permission grid displaying hierarchical module trees, CRUD capability rows, role matrix columns, and bulk save buttons.

5. Configuring Matrix Permissions

Navigate to Matrix Permissions

Open User Management > Matrix Permissions from the sidebar navigation.

Expand Target Menu Node

Click Chevron icon next to any primary module to expand its sub-menus and actions.

Toggle Capability Checkboxes

Click interactive checkboxes matching role columns and specific permission rows.

Save Matrix Changes

Click Save Changes button to persist updated role access rules to the database.

6. Role Privilege Mapping

Inspect Role Columns

Scroll horizontally across role columns to compare access matrices side by side.

Modify Granular Actions

Toggle individual capabilities such as Create, Update, Delete, or Export independently.

Confirm Bulk Submission

Submit updates. The application dispatches payload changes in a single atomic transaction.

7. Permission Cache Invalidation

Hot-Reload Authorization Cache

Saving matrix updates invalidates in-memory and Redis permission caches instantaneously. Affected users experience updated permissions on their next API interaction without needing to sign out.

Immediate Access Revocation

Unchecking an allowed permission and saving revokes API access instantly without restarting servers.

Active user sessions revalidate permissions on next API route request or token refresh.

8. Cross-Module Impact

Target Subsystem	Relational & Transactional Effect
Navigation Sidebar & Menus	Hides navigation links entirely from users whose role lacks View permissions for that menu.
API Security Middleware	Blocks unauthorized HTTP requests with HTTP 403 Forbidden when role_access is missing.
Audit Trail & Compliance	Provides clear verifiable records of which roles possess data creation and deletion privileges.

Operational Best Practices

Apply the principle of least privilege: grant only the minimum permissions necessary for each role.
Always verify newly created roles in Matrix Permissions before onboarding staff to that role.