KamoCRM

Approval-tier relay with role resolved from rights

FeatureSecurityService
Shipped
12 ஆகஸ்ட், 2026 அன்று 2:08 AM UTC
Author
Kamo
Commit
6b5542e

THE ROLE IS DECIDED HERE, from the caller's rights and their relationship to the subject -- never from the request body. A body that could name its own role would let anyone claim to be payroll. Precedence: PAYROLL (broadest, edits in any state), then MANAGER, then EMPLOYEE for one's own record. Being the subject's snapshotted manager counts on its own -- a line manager approving their own report is the ordinary case and should not need an org-wide right; the right exists for everyone else who reviews. isManagerOf fails CLOSED: an unresolvable reporting line is not authority.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing