DFE-Digital / DFE-Digital/compass
Security and RBAC for demand and triage module
Open
@andyjones81 is already working on this.
Since Dec 5, 2025.
- Dominant language
- HTML
- Stars
- 0
- Forks
- 1
- Avg merge
- 1m
- Merged PRs (30d)
- 3
Description
User story
As a platform architect, I need access to demand, triage and prioritisation features to be controlled by role so sensitive information is protected.
Description
Map the new capabilities to existing roles (or define new ones if needed) and enforce RBAC in API and UI.
Acceptance criteria
- Role mapping completed for actions including:
- Creating a demand request
- Viewing own requests
- Viewing all requests
- Editing request details
- Changing workflow states
- Viewing and editing scores
- Creating and editing board decisions
- RBAC checks implemented in:
- API endpoints
- UI (hiding or disabling controls where necessary)
- Attempted unauthorised actions are blocked and logged
- Security test scenarios defined to cover typical misuse or escalation attempts
Non-functional
- Security model documented and shared with relevant teams
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.