Nexobiz Foundation Console

Phase 2 Foundation

# Auth, RBAC, and tenant runtime control

Lock down the operating identity layer before workflows, CRM, AI agents, and business modules start moving customer data.

Runtime guarded
Guarded

## Auth runtime

Deny by default

## RBAC

Resolved

## Tenant context

Idempotent

## Installer handoff

## Auth Runtime

First admin bootstrap
Email password login
MFA step-up
Session revoke

## RBAC Roles

### system.owner

platform

Controls installation, licensing, and platform authority

### tenant.owner

tenant

Owns tenant users, roles, branches, and subscription handoff

### branch.admin

branch

Manages branch-level users and local operations

### operator

branch

Executes daily work inside assigned tenant boundaries

### auditor

tenant

Reads audit, security, and compliance evidence

## Tenant Runtime

Verified domain
Subdomain
Tenant header
License binding
Cross-tenant access defaults to deny

## Installer Handoff

1. 1 Write environment
2. 2 Test database
3. 3 Run migrations
4. 4 Seed permissions
5. 5 Create company
6. 6 Create primary branch
7. 7 Create first admin
8. 8 Activate license
9. 9 Write installation lock

## Phase 2 Exit Gates

Phase 1 release gate
Phase 2 foundation validator
API route contract validator
Frontend production build
Signed release manifest
Package cleanliness
Smoke test