Core Platform
•
Specification
Permissions & Authorization
Hierarchical RBAC, contextual ABAC, and explicit resource policies.
Alegor Permissions separates authorization policy definitions from business logic. It provides deterministic, cached permission checks that can evaluate roles, explicit capability grants, and resource context attributes in sub-millisecond time.
Capabilities
Core Functional Capabilities
✓
Role-Based Access Control (RBAC) with customizable tenant roles
✓
Attribute-Based Access Control (ABAC) for contextual evaluations
✓
Explicit capability matrix for UI components and API endpoints
✓
Inherited role hierarchies (e.g. Owner > Admin > Member > Viewer)
✓
Fast in-memory and Redis permission caching with instant invalidation
✓
Dry-run permission simulation for administrative troubleshooting
Contracts
Public Interface Contracts
Other modules and domain action classes interact exclusively via these typed PHP contracts.
interface
AuthorizationEngineInterface
interface
PolicyEvaluatorInterface
interface
RoleManagerInterface
interface
PermissionRegistrarInterface
Reactivity
Dispatched Domain Events
Dispatched upon state mutation for downstream audit recording, webhook firing, and asynchronous notifications.
⚡
RoleCreatedOrUpdated
⚡
PermissionGrantedToRole
⚡
UserRoleAssigned
⚡
PolicyEvaluatedWithDenial
Customization
Extension Points
- • Custom ABAC condition rules (time-of-day, IP range, resource state)
- • External permission provider synchronization (e.g. Active Directory / Okta groups)
🛡 Security & Isolation
- • Default-deny authorization posture across all endpoints
- • Tamper-resistant permission cache tagging
- • Detailed rejection logging with evaluation stack trace for security audits
Core Entities & Models
- Role (Name, key, description, tenant_id)
- Permission (Key, module, description, default_grant)
- PolicyRule (Condition JSON, action, target_resource)
Explore Other Platform Modules
Identity & Tenancy
Multi-tenant identity boundaries, user lifecycle, and authentication.
Documents & Storage
S3-compatible asset pipeline, metadata indexing, and access-controlled streaming.
Audit & Compliance Logging
Append-only immutable event streams for compliance and forensic analysis.
Workflows & State Machines
Deterministic state machine engine with visual transitions and guard conditions.
Notifications & Messaging
Omni-channel delivery engine across Email, SMS, Webhooks, Push, and In-App.
Integrations & Webhooks
Bi-directional webhook engine, REST API gateway, and external sync pipeline.
Reporting & Aggregation
High-performance analytical queries, export queues, and scheduled summaries.