Permissions Reference
All permission constants in this guide live under
Shumoul.Framework.MultiTenancy.Api.Constants.TenancyPermissions (MultiTenancyApi package) — not
Shumoul.Domain.Constants.PermissionConstants (BackEnd's own ~250-group permission set for
tenant-facing ERP features). TenancyPermissions.* is reserved for the root-tenant-only SaaS admin
surface this guide documents; ApplicationDbSeeder.SeedAdminUserAsync only ever grants
TenancyPermissions.* to the root tenant's Admin role.
Every permission group follows the same 8-member CRUD+lifecycle+apply shape unless noted:
ViewAll · View · Create · Edit · Delete · Activate · Deactivate · Apply
| Permission group | Members | Notes |
|---|---|---|
TenancyPermissions.BusinessActivities | ViewAll, View, Create, Edit, Delete, Activate, Deactivate | No Apply (no apply flow for BusinessActivities itself) |
TenancyPermissions.AccountingChartTemplates | ViewAll, View, Create, Edit, Delete, Activate, Deactivate, Import, Apply, ApplyMappings | ApplyMappings is a dedicated permission, separate from Apply — mapping-apply touches more sensitive settings |
TenancyPermissions.InventoryAccountCategoryTemplates | ViewAll, View, Create, Edit, Delete, Activate, Deactivate, Apply | |
TenancyPermissions.CostCenterTemplates | ViewAll, View, Create, Edit, Delete, Activate, Deactivate, Apply | |
TenancyPermissions.ProductCatalogPrerequisiteTemplates | ViewAll, View, Create, Edit, Delete, Activate, Deactivate, Apply | |
TenancyPermissions.ProductCatalogTemplates | ViewAll, View, Create, Edit, Delete, Activate, Deactivate, Apply | Also gates Items/ItemUnits CRUD (.Edit) and item apply (.Apply) — no separate permission group was created for items/units, following the real ERP's own ProductUnitController precedent of reusing Product.* permissions |
TenancyPermissions.TenantStarterKits | View, Preview, Apply only | Deliberately not a CRUD shape — this is an orchestration surface over existing templates, not an entity of its own |
Subscription/entitlement admin permissions (BackEnd, PermissionConstants.*)
| Group | Members | Route |
|---|---|---|
SubscriptionFeatureSettingsGroups | ViewAll, Edit | api/Subscription/Features/SettingsGroups |
SubscriptionFeatureReportActions | ViewAll, Edit | api/Subscription/Features/ReportActions |
The Apply-vs-Edit separation, and why it matters
Across every template family in this guide, applying a template to a tenant (writing real tenant
business data) is gated by a permission distinct from editing the SaaS-side template catalog. This
is deliberate: an admin who can curate/author templates is not automatically an admin who can push data
into a live tenant database. AccountingChartTemplates goes one step further and separates
ApplyMappings from plain Apply, since mapping-apply can silently repoint GL account resolution for a
tenant — a materially more sensitive action than inserting brand-new, previously-nonexistent accounts.
MenuClaims coverage requirement
Every permission constant above must have a matching row in MenuClaims.json before it is usable by any
real admin role — see SaaS Admin Authorization and MenuClaims.
TenancyPermissions.TenantStarterKits, .ProductCatalogTemplates, and
.ProductCatalogPrerequisiteTemplates are all confirmed present in the shipped MenuClaims.json.