Role-Based Access Control

Security That Scales

Tuli's RBAC system provides granular control over who can see, create, edit, and delete data — down to individual fields and rows.

Object-Level Permissions

Control access at the object level with fine-grained verbs:

• View — Can see records in list and detail views
• Create — Can create new records
• Edit — Can modify existing records
• Delete — Can remove records
• Export — Can export data to Excel/CSV
• Import — Can bulk import data
• Workflow — Can initiate and act on workflow steps

Row-Level Security

Filter which records a user can see based on data attributes:

@company "{company}"

role Lease_Manager {
	allow Contract {
		view {
			filter: " AssignedTo = '{User.RecordId}' OR Department = '{User.Department}' "
		}
		create
		update
		patch
	}

	allow Building {
		view {
			filter: " Portfolio = '{User.Portfolio}' "
		}
	}

	allow Payment {
		view
		create
		update
		patch
	}

	report *
}

Role Profiles

Group permissions into reusable profiles:

• Administrator — Full access to all objects and settings
• Department Manager — Full access within their department
• Team Member — Create and edit own records, view team records
• Viewer — Read-only access to assigned modules
• Auditor — Read-only access with export capabilities across all modules

Menu Visibility

Control which navigation items appear for each role:

• Users only see modules they have access to
• Dashboard widgets respect data permissions
• Search results filter based on row-level security
• API responses honor all permission rules

Audit Logging

Every access and modification is logged:

• Login/logout tracking with device and IP information
• Record access logs showing who viewed what and when
• Permission change history tracking all RBAC modifications
• Failed access attempts for security monitoring
• Data export tracking for compliance