Unauthorized access behaviour

What Triggers Unauthorized Access

1. Attempting to navigate to a route that requires a permission you do not have.
2. Trying to perform an action (create, update, delete) without the required action-level permission.
3. Accessing a resource in an account context where you lack the necessary role assignment.

How the WebUI Responds

1. Protected routes redirect you to an /unauthorized page with an explanatory message.
2. UI elements (buttons, forms, menu items) that require missing permissions are hidden or disabled.
3. API calls return 403 Forbidden errors, which the UI handles gracefully by showing error messages.

Common Scenarios

1. You see a menu item in one account context but not in another (permission scope varies by account).
2. You can view a list page but cannot see the "Create" button (you have read but not create permission).
3. You are redirected to /unauthorized when directly accessing a URL for a restricted page.

Troubleshooting Unauthorized Access

1. Verify your current account context (root/home vs child account).
2. Check your assigned roles and their permissions with your administrator.
3. Confirm you are using the correct user account (you may have multiple accounts with different access levels).
4. Review the RBAC documentation to understand permission requirements for specific modules.

Best Practices

• Do not attempt to bypass unauthorized access restrictions (this may trigger security alerts).
• If you believe you should have access but are blocked, contact your administrator to review your role assignments.
• Use the principle of least privilege: request only the permissions you need for your job function.