Role-Based Access Control

Without role enforcement, any authenticated user could access another organisation's data, approve their own expense claims, or trigger Bufdir exports - all of which would be security and compliance failures. RBAC is the mechanism that implements the strict tenant isolation and access boundaries described throughout the source document. The time-bounded Global Admin support access grant addresses a real operational need (Norse staff may need to investigate production issues) while satisfying the audit and privacy requirements of the partner organisations. Correct role enforcement from day one is non-negotiable: the platform handles personal health information, financial reimbursements, and encrypted sensitive assignments.

Roles and organisation memberships are stored in user_roles and user_organization_memberships tables. The Authentication Module attaches a generic claims bag (role, org membership) to access tokens without encoding product-specific semantics; the consuming products perform actual authorization checks. RoleGuardMiddleware on the backend validates role and org scope before executing any module endpoint. On mobile, the module registry reads the enabled module set and role from the bootstrap response to build the correct navigation surface at runtime. The support_access_grants table implements time-bounded Global Admin access with automatic expiry and an audit log entry written on every support session.