Role-based access control

Not everyone should reach every feature or agent. Auggy has different roles, from employees to HR to leadership, and what each can do differs. For example, HR work is not for an employee.

Roles decide which features and agents a person can use, and the interface adapts to the role. The important part is where it's enforced. Every role check happens in both the application and the backend, including the check inside the agents. A check in the application alone can be bypassed: someone can send a made-up value and get past it, which can break the backend. So the rule I use is to validate on both sides, every time.

Enforcing roles in the application only. I rejected it because it's easy to get around, and it isn't a good practice.

Implemented Role-Based Access Control (RBAC) across the application to dynamically control available functionality based on assigned user roles.

User permissions determine which actions and features are available, allowing both application behavior and relevant UI functionality to adapt according to authorization rules.

The rule has to be kept in step in two places, the application and the backend.

Access follows the role in both the interface and the AI, and it can't be skipped by changing something on the client.