Securing Nexus HCM

Roles, module permissions, and the API paths each permission governs.

How access is decided

Every request passes three gates, in order. A failure at any gate is a refusal, and a later gate never widens what an earlier one denied.

1. Authentication — a valid session. See Identity and sign-in.
2. Entity scope — the request is bound to the company the user is signed in to. Someone with access to two entities still cannot read across both in one call.
3. Module permission — the role must grant the action on the module that owns the route, per the table below.

Module permission matrix

13 modules. The last column lists the API paths each module actually governs, taken from the enforcement map inside the application rather than from documentation.