DevelopersBusinessPre-alpha
Overview
Groups, API keys and the one-database isolation model.
Layers
| Layer | Mechanism |
|---|---|
| Groups | core.group + implied_ids |
| ACL | sys.access.csv CRUD flags |
| API | Session cookie or X-API-Key |
| Company | Active company on the user; not separate DBs per tenant |
Operator vs developer
Operators assign users to groups in the UI. Developers ship security XML/CSV with each addon and keep manifests ordered correctly.
Security checklist
- Every new model has ACL rows for the intended groups.
- API keys map to a real user and inherit that user's groups.
- Health is public; RPC is not.
What not to do
- Do not grant
base.group_systemcasually. - Do not equate company switching with SaaS tenancy.
Next step
API keys or Isolation model; addon details in Security & access.