Federation

Multi-app permission orchestration for Enterprise tenants.

Federation allows Enterprise tenants to link multiple applications into a shared authorization namespace. Permissions, modules, and roles are synchronized across apps without duplicating configuration.

What federation solves

In multi-app environments, each app typically manages its own permissions independently. This leads to:

• Duplicated role definitions across apps
• Inconsistent permission models
• No centralized view of a user's access across the organization

Federation solves this by creating a shared namespace where modules from different apps coexist, and resolved permissions can be pushed to any member app.

Architecture

Federation Group
├── App A (prefix: LT)  — Lettings
│   └── modules: LT:BOOKINGS, LT:PROPERTIES
├── App B (prefix: CC)  — Concierge
│   └── modules: CC:TASKS, CC:CONTACTS
└── App C (prefix: XA)  — xAdmin
    └── modules: XA:USERS, XA:REPORTS

1. Create a group — the owning organization creates a federation group
2. Add members — invite other organizations with unique 2-4 character prefixes
3. Pull modules — fetch module definitions from all member apps into the shared namespace
4. Assign roles — create roles that span modules from multiple apps
5. Push permissions — send resolved permission sets to member apps

Pull and push cycle

Pull fetches the latest module definitions from each member app. After a pull, the group namespace contains all modules prefixed by their app (e.g., LT:BOOKINGS).

Push sends the resolved permission set — which roles have which actions on which modules — to each member app. The receiving app can then enforce permissions locally using the pushed data.

A daily cron runs at 02:00 UTC to automatically sync federation groups, ensuring module changes propagate even if manual pull/push is missed.

Federated key format

Modules in a federation namespace use the format PREFIX:MODULE:ACTION:

LT:BOOKINGS:CREATE
CC:TASKS:READ
XA:REPORTS:EXPORT

This prevents naming collisions when multiple apps define modules with the same name.

Next steps

• Federation Groups — create and manage groups
• Federation Members — add apps to a group
• Pull & Push — synchronize modules and permissions
• Migration Guide — move from local permissions to federated