Best Practices

Cross-framework engineering best practices for building on the Shumoul platform will accumulate here as more frameworks are published. A few platform-wide rules already established by the ERP's own engineering standards apply to every framework documented on this portal:

• Never bypass multi-tenant query filters (.IgnoreQueryFilters()) in a tenant-facing code path.
• Always soft-delete business entities — never a hard RemoveAsync on user-facing data.
• Every new HTTP action must declare its required permission explicitly — never rely on authentication alone.
• Prefer the narrowest permission that satisfies a given integration (see the Notification Framework's own Permissions chapter for a worked example of this principle).

Framework-specific best practices (e.g. WhatsApp template authoring, retry-policy tuning) live inside each framework's own chapters.