Securing Nexus Suite

Roles, module permissions, and the API paths each permission governs.

How access is decided

Every request passes three gates, in order. A failure at any gate is a refusal, and a later gate never widens what an earlier one denied.

1. Authentication — a valid session. See Identity and sign-in.
2. Entity scope — the request is bound to the company the user is signed in to. Someone with access to two entities still cannot read across both in one call.
3. Module permission — the role must grant the action on the module that owns the route, per the table below.

Module permission matrix

14 modules. The last column lists the API paths each module actually governs, taken from the enforcement map inside the application rather than from documentation.

Report group permissions

Reporting is granted separately from module access, so a role can read a screen without being able to export or schedule its reports.