FR-01.12 — Role-Based Access Control

Trigger: An authenticated user requests a protected function/route.

System shall:

• Identify the authenticated user.
• Determine the user's role.
• Verify that the role is authorized for the requested operation.
• Reject unauthorized access.

Example:

User	Resource	Result
Company	Own products	Allowed
Company	Another company's products	Denied
Rep	Own commissions	Allowed
Rep	Another rep's commissions	Denied
Admin	Authorized platform functions	Allowed
Rep	Admin functions	Denied

Acceptance Criteria:

• PASS: Authorized role can access permitted functionality.
• PASS: Unauthorized role is denied.
• FAIL: Changing a client-side role value bypasses authorization.