Federation Overview

Centralized permission orchestration across multiple applications.

Federation enables Enterprise tenants to manage permissions across multiple applications from a single authorization namespace. Instead of configuring roles and modules independently in each app, you create a federation group that links apps together.

What federation solves

Without federation, each application manages its own authorization independently:

• Roles are duplicated across apps with subtle differences
• Permission changes require coordinated updates in every app
• No single view of a user's effective permissions across the organization

With federation, a shared namespace brings all modules together. You define roles once, and push resolved permissions to every member app.

How it works

1. Create a federation group — one organization owns the group
2. Add members — each member app gets a unique 2-4 character prefix (e.g., LT, CC)
3. Pull modules — fetch module definitions from all member apps into the shared namespace
4. Configure roles — assign actions on any module from any member app
5. Push permissions — send resolved permission sets to all member apps

Automatic sync

A daily cron job runs at 02:00 UTC to synchronize federation groups. This ensures module changes in member apps propagate even if manual pull/push is missed. You can also trigger pull and push manually at any time via the API.

Federated key format

Modules in the shared namespace use prefixed keys to avoid naming collisions:

PREFIX:MODULE:ACTION

For example, if the Lettings app (prefix LT) registers a BOOKINGS module, it appears as LT:BOOKINGS in the federation namespace. A role might include LT:BOOKINGS:CREATE and CC:TASKS:READ in the same permission set.

Next steps

• Groups — create and manage federation groups
• Members — add and remove member apps
• Pull & Push — synchronize modules and permissions
• Migration Guide — move from local to federated authorization