Permission scopes

Permission scopes translate our CQRS architecture into granular access policy. By adhering to the principle of least privilege, scopes ensure an automated process or AI agent is granted exactly the authorization needed for its specific task — and nothing more.

Read-only vs. Read/Write authorization

The first line of defense is the distinction between read-only and write access:

• Read-only keys: Restrict credentials to query endpoints (GET). By construction, a read-only key cannot modify database records, upload files, or trigger state changes. This is the optimal configuration for analytics dashboards, reporting agents, and semantic search interfaces.
• Read/write keys: Authorize an agent to execute state-changing command endpoints (POST) within explicitly defined capability domains.

Domain-level capability scoping

Beyond the coarse read/write division, permissions are granted across discrete functional domains:

• contacts — Reading or modifying tenant, owner, and service provider contacts.
• properties — Accessing objects, buildings, and individual rental/ownership units.
• documents — Ingesting, downloading, and indexing documents and attachments.
• accounting — Accessing financial postings, bank transactions, and billing cycles.

An invoice extraction agent requires documents and accounting scopes, but should never be granted access to votings or system-level configuration.

Isolated gating for destructive actions

Deleting business data carries fundamentally higher operational risk than creating or modifying records. Consequently, etg24 isolates destructive operations behind a dedicated delete scope:

• A key granted write access to documents can upload and classify files, but cannot delete them without an explicit delete grant.
• In MCP environments, tools that remove entities are flagged with required destructive scopes.
• Even if delete permissions are granted, Soft delete & rollback ensures that accidental deletions remain fully restorable.

Recommended scope profiles

Every authorization decision is recorded in the Audit trail & change attribution, ensuring complete compliance traceability.