Managing system personas for Inventory

Inventory Packaged Business Capability (Inventory PBC) uses persona-based access control and centralized Identity and Access Management (IAM) integration to secure inventory data.

Role-based permissions and organizational scoping keep internal operations secure, authorized, and auditable.

Objectives

  • Data security: Prevents unauthorized modifications and restricts visibility based on explicit user permissions.
  • Organizational scoping: Restricts user data access within the designated organization scope.
  • Auditability: Attributes all permission-based actions to a verifiable user identity for a secure operating model.

Supported Personas and Capabilities

Inventory PBC evaluates incoming user identity, organization, and persona claims to enforce access tiers.

Persona Description Allowed Actions Restrictions
Inventory Manager Internal administrative persona responsible for inventory operations.
  • View, create, edit, and update statuses for received inventory.
  • View and update organized inventory.
  • View and adjust available inventory between locations or stores.
  • View and edit SKU configurations and overrides.
  • Create and update expected inventory.
  • Update purchase order statuses.
None.
System Administrator Manage the inventory and location service. Site Administrator role can call Inventory PBC APIs while working with the Commerce Lab. For more infromation, see Inventory Dashboard and Inventory Management for more information. None.

Technical Mechanisms

  1. Identity and Role Integration

    Inventory PBC integrates with enterprise identity providers, such as Auth0, Azure AD, Okta, or equivalent centralized IAM platforms. For every incoming request, the interceptor evaluates:

    • User identity claims
    • Organization assignment
    • Persona or role claims
  2. Scope Enforcement and Security Boundaries
    • Organization-scoped access: Permissions are bound to the assigned organization scope of the user. You cannot view or alter inventory if you are an unauthorized user for an organization.
    • User interface and API enforcement: The user interface automatically hides restricted components. If you attempt an unauthorized action through an application programming interface (API) or direct endpoint access, Inventory PBC denies the request.