عرض عملي: مديرو المتاجر ووكلاء مركز الاتصال والشركاء في نموذج وصول واحد

خطوة بخطوة

1. List user groups: head-office staff, store managers, customer-service agents, marketplace partners, customers.
2. Define coarse roles and the attributes that scope them: storeId, region, case ownership, partner ID.
3. Map federation: workforce from the directory, partners via their identity providers, customers via customer identity.
4. Planned mistake: create roles per store (120 manager roles). Fix: one StoreManager role with a storeId attribute check.
5. Design privileged access for platform operators with just-in-time rights and logged sessions.
6. Test with five representative users and show least privilege for each: what they can and cannot do.