Access Control
Owner: Security
Reviewers: Backend, Web, Mobile, QA
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Per auth change
Roles
Confirmed role concepts include admin, owner, manager, technician and viewer/owner-facing user flows.
Required Controls
| Control | Status |
|---|---|
| Authenticated API routes | PARTIAL |
| Role-based route access | PARTIAL |
| Farm-scoped data access | PARTIAL |
| Web protected routes | PARTIAL |
| Mobile role navigation | PARTIAL |
| Permission regression tests | PARTIAL |
Required Follow-Up
- Remove temporary bypass comments/logic.
- Add regression tests for cross-farm access denial.
- Align backend permissions with web/mobile navigation visibility.