# ADR-002: Authorization and operational scope

- **Status:** Accepted
- **Date:** 2026-10-19

## Decision

Authorization is deny-by-default and evaluated on the server. Permission and data scope are separate concerns.

Supported scope levels are installation, company, branch, warehouse, department, team and own-record where applicable. A company owner has full access only inside that company. System administration is installation-wide and its sensitive actions are audited.

Warehouses belong to one company and may optionally belong to one branch. Warehouse access is granted explicitly; branch membership alone does not imply access to every warehouse.

Financial approval limits are stored as explicit rules and are not represented as simple permission flags. Controllers and routes delegate authorization to policies and domain services rather than selecting global rows directly.

## Required tests

- A user in Company A cannot read, mutate, export or fetch files belonging to Company B.
- Branch and warehouse grants cannot escape their company.
- Record identifiers from another company return a non-disclosing denial.
- Privileged bypasses produce audit events.