The control plane behind every setting, permission, and feature flag in the platform
Hierarchical inheritance governs every configurable surface
Every setting, theme, menu item, and feature flag flows through the Cascade tree. Admin mode gives you control over this inheritance. Parent nodes set defaults; child nodes override only what they need to.
58 Cascade domains across 6 categories. Each domain has a merge strategy that controls how parent and child values combine.
Parent sets a floor. Child can only strengthen, never weaken.
Security policies: parent requires 8-char password, child can raise to 12 but never lower to 6.
Parent items + child items combined, deduplicated. Additive only.
Menu items: parent has Dashboard + Reports, child adds Analytics. Result: all three.
Only items in BOTH parent AND child survive. The authority-scoping strategy.
Agent authority: parent grants [read, write, delete], agent config has [read, write]. Agent gets [read, write] only.
Child completely overrides parent.
Branding: tenant replaces platform logo with their own.
Deep-merge objects. Child keys win on collision, parent keys preserved.
Theme: parent sets font + color, child overrides color only. Font inherited.
Child appended to parent. Order preserved.
Audit logs: parent events + child events in chronological order.
Three role systems, one unified access decision
Roles define what actions you can take. Stakeholder roles define what you see. Three independent systems resolve in parallel and merge into a single TenantAccessPayload.
global-admin, platform-admin
Source: Entra + platform_roles table
community-admin, partner-admin, member
Source: ledger-api role assignments
project-manager, estimator, field-engineer...
Source: stakeholder_roles table (dynamic)
Attribute-based access control with AND logic
Every API request flows through the ABAC pipeline. All rules evaluate with AND logic: every rule must pass for the request to proceed.
Incoming request with signed JWT token
Platform + Ledger + Stakeholder roles resolved in parallel
Handler's requirePermission() verified against resolved roles
All attribute rules evaluated with AND logic (all must pass)
Cascade tree scoping via INTERSECT limits visible resources
Only authorized, scoped data returned
Has specific permission
has("cascade.write")
Has stakeholder role
eq("project-manager")
Subscription tier check
gte("contributor")
Industry vertical match
eq("construction")
Feature flag enabled
has("dynamic_layout")
Platform role match
in(["global-admin","partner-admin"])
Active solution type
has("velocity")
Factory access granted
has("website_factory")
Portal-scoped check
eq("velocity")
Rules combine with AND logic. A request must satisfy every rule to proceed. Operators available: has, notHas, eq, gte, in, notIn.
From creation to go-live in five steps
Provision a new organization node in the Cascade tree under the correct vertical.
Invite users via Entra sync or email. Each gets a stakeholder role and permissions.
Enable solution types (e.g., Velocity, SuretyBind). Each activates its Cascade domains.
Set logo, accent color, portal name. Theme inherits from vertical, overrides allowed.
Tenant is active. TenantAccessPayload is the single source of truth for all decisions.
The single source of truth for all downstream decisions. Contains: tenant ID, resolved roles, stakeholder roles, active solutions, feature flags, Cascade node path, credit balance, and agent delegation grants. Computed once per request, cached per-session.
Autonomy tiers, sponsor inheritance, and INTERSECT scoping
Agents inherit their sponsor's access and can never exceed it. Agent access is the INTERSECT of sponsor permissions and agent configuration.
read, write, delete, approve, configure
read, write, approve
read, write, approve
Agent cannot act. All requests queued for human review.
Agent can suggest actions but cannot execute. Human approves each action.
Agent can execute low-risk actions automatically. High-risk actions require approval.
Agent can execute most actions. Only irreversible or high-value actions need approval.
Agent acts autonomously within its INTERSECT-scoped authority. Emergency stop available.
Sponsor: Don (Construction)
Access = min(sponsor access, agent config) via INTERSECT
Sponsor: Pat (Insurance)
Access = min(sponsor access, agent config) via INTERSECT
Sponsor: System (Finance)
Access = min(sponsor access, agent config) via INTERSECT
Every administrative action flows through the same pipeline as user actions: JWT validation, role resolution, ABAC evaluation, Cascade scoping, and provenance logging. There are no backdoors. The Cascade tree is the single control plane.