1. Moving Beyond Binary "Admin vs. User" Permissions
In many off-the-shelf business tools, access control is an afterthought—offering little more than a global "Administrator" toggle and a basic "Standard User" role. In real Indian enterprises, hospitals, and multi-branch operations, permissions are rarely that simple.
A branch warehouse supervisor needs permission to record inward goods receipts for their specific location without viewing company-wide pricing margins. A clinic receptionist needs to register patients and print receipts without accessing clinical diagnosis history across other departments.
2. Branch, Department, and Action-Scoped RBAC
Across both our Orina enterprise suite and our bespoke software builds, Astrake implements three-dimensional access control combining Role, Resource Action, and Organizational Scope:
- Explicit Action Verbs: Permissions are separated into distinct actions—
view,create,edit,approve,cancel, andexport—enforced on the server on every request. - Location & Department Boundaries: User sessions are bound to specific branches, warehouses, or clinical departments so queries automatically filter records to the user’s authorized scope.
- Maker-Checker Approvals: High-impact changes—such as stock write-offs, purchase approvals, or billing credit notes—can require a second authorized supervisor’s confirmation before taking effect.
3. Chronological, Tamper-Evident Operational Audit Logs
Whenever a record is modified in an operational system, management should be able to answer three questions immediately: Who made the change, When did it happen, and What were the exact values before and after?
| Audit Field | Captured Value | Operational Purpose |
|---|---|---|
| Actor & Session ID | Authenticated user ID, role snapshot, and request timestamp | Establishes clear individual accountability for every state change |
| Entity & Record Key | Module name, primary key, and branch/facility identifier | Allows instant filtering of the complete history of any single invoice, order, or record |
| Structured Diff Payload | JSON snapshot of previous and updated field values | Preserves exact before-and-after values without overwriting historical entries |
4. Technical Alignment with DPDP Act 2023 & OWASP ASVS Principles
Designing software with strict purpose limitation, least-privilege access, and clear activity logs keeps your organization technically aligned with—and principle-ready for—the India Digital Personal Data Protection (DPDP) Act 2023 and OWASP Application Security Verification Standard (ASVS) guidelines. While software architecture alone is not a statutory certification, building these controls into the database and application layer from day one makes internal governance straightforward.
Learn more about our Enterprise Software & Orina capabilities or contact our team to discuss your application requirements.