Foundera OS

Roles and permissions

Authorization engine

Deny by default
Multiple roles per membershipNo direct user permission grantsPermission changes invalidate effective authorization

Role permission assignment

Approval limits

Limits use uppercase ISO currency codes and integer minor units. Currency mismatch is denied.

Effective authorization records load after local Supabase role fixtures are available.