# User & Access Management — Detailed Research

**Date:** 2026-04-03
**Method:** 8 parallel agents (4 SF web research + 4 NexusCRM code exploration)
**Scope:** Complete whole-picture research covering SF design details and NexusCRM implementation status

> **Note:** This document is a research reference — raw findings from 8 agents, cross-validated.
> The first-round `permission-refactor-analysis.md` was based on shallow code scans and contains inaccuracies.
> This document supersedes it for factual claims about NexusCRM's implementation.

---

## Table of Contents

1. [SF vs NexusCRM Feature Matrix](#1-sf-vs-nexuscrm-feature-matrix)
2. [Critical Findings](#2-critical-findings)
3. [SF Design Details](#3-sf-design-details)
4. [NexusCRM Implementation Details](#4-nexuscrm-implementation-details)
5. [Gap Analysis by Area](#5-gap-analysis-by-area)
6. [Prioritized Action Items](#6-prioritized-action-items)
7. [Open Questions](#7-open-questions)
8. [Source References](#8-source-references)

---

## 1. SF vs NexusCRM Feature Matrix

### Permission Resolution

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| Profile baseline permissions | Yes | Yes | **Full** |
| Profile-owned PermissionSet (implicit) | Yes | Yes (IsOwnedByProfile=1) | **Full** |
| PermissionSet CRUD + assignment | Yes | Yes (UI + backend) | **Full** |
| PermissionSet Group (PSG) | Yes | Yes (backend full, UI missing) | **Partial** |
| Muting Permission Set | Yes (1 per PSG, scoped to PSG only) | Yes (backend: delete from effective map) | **Full** (backend) |
| 4-layer resolution: Profile → PermSet → PSG → Muting | Yes | Yes (perm_system.go:67-122) | **Full** |
| Object permissions (CRUD + ViewAll + ModifyAll) | Yes | Yes (_System_ObjectPermissions, MAX aggregation) | **Full** |
| Field-level security (Read/Edit per field) | Yes | Yes (_System_FieldPermissions) | **Full** |
| System permissions (60+ boolean flags) | ~364 permissions | 60+ permissions | **Full** (for CRM scope) |
| Custom permissions | Yes | Yes (_System_CustomPermission) | **Full** |
| Permission dependencies (ModifyAllData→ViewAllData) | Yes (PermissionDependency API) | Not implemented | **Missing** |
| Session-based Permission Sets | Yes (HasActivationRequired) | Not implemented | **Missing** |
| PermissionSet License (PSL) | Yes | Not applicable (single-tenant) | **N/A** |
| PermissionSet assignment expiration | Yes (ExpirationDate field) | Not implemented | **Missing** |

### Record-Level Security

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| OWD (Organization-Wide Defaults) | Per-object: Private/PublicRO/PublicRW/ControlledByParent | SharingModel field EXISTS in metadata (enums.go) but NOT ENFORCED in access control | **Metadata exists, enforcement missing** |
| Grant Access Using Hierarchies toggle | Per-object (standard=always on, custom=configurable) | Not implemented | **Missing** |
| Role Hierarchy (tree, single parent) | Yes, in-memory + materialized groups | Yes, in-memory cache (map[roleID]*parentID) | **Full** |
| Role Hierarchy access level | Read + Edit + Delete (bounded by profile) | Read ONLY (record_access.go:69) | **Partial** |
| Sharing Rules: Owner-based | Yes | Not implemented (only role/group + criteria) | **Partial** |
| Sharing Rules: Criteria-based | Yes | Yes (formula engine evaluation) | **Full** |
| Manual Sharing (RecordShare) | Yes (Read/Edit/All + RowCause) | Yes (_System_RecordShare, Read/Edit only) | **Full** |
| Team Member access | Yes (Account/Opp/Case teams) | Yes (_System_TeamMember) | **Full** |
| Group/Queue membership | Yes (materialized Group types) | Yes (_System_GroupMember) | **Full** |
| Implicit Sharing (parent↔child) | Yes (non-configurable) | Not implemented | **Missing** |
| Share table materialization (<Object>Share) | Yes (async recalculation) | Not needed (127 users, real-time calc) | **N/A** |
| CheckRecordAccess (single record) | 10+ layer check | 5-layer check (Owner→Group→Hierarchy→Sharing→Manual→Team) | **Mostly Full** |
| SQL RLS (bulk query filtering) | WITH USER_MODE / WITH SHARING | applyRLS: owner_id = ? ONLY. Covers <1% of queries | **Critical gap** |
| ViewAllRecords bypass in RLS | Yes | Not checked (only IsSuperUser) | **Missing** |
| JOIN query RLS | Handled by Share table JOIN | Explicitly skipped (return nil) | **Missing** |

### User Management

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| User CRUD | Full (100+ fields) | Basic (21 fields) | **Partial** |
| User activation/deactivation | Active/Frozen/Deactivated states | IsActive only (no Frozen, no session revocation on deactivate) | **Partial** |
| User types (Standard/Community/Guest) | 7+ user types | Standard only | **Partial** (sufficient for scope) |
| Profile assignment | Yes | Yes | **Full** |
| Role assignment | Yes | Yes | **Full** |
| Manager hierarchy | Yes | Yes (ManagerId field) | **Full** |
| Bulk user import | Yes | Yes (BatchUpsertUsers) | **Full** |

### Profile Management

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| Profile CRUD | Yes (clone, standard locked) | Basic (create via bootstrap, no clone) | **Partial** |
| Profile controls 8 categories | Object/Field/System perms + Layout + RecordType + App + Tab + Login Hours/IP | Object/Field/System perms only | **Partial** |
| Page Layout assignment (Profile × RecordType) | Yes (Profile-only) | Via LayoutAssignment (Role × Profile × RecordType) — EXCEEDS SF | **Full+** |
| Record Type access per Profile | Yes | Not implemented | **Missing** |
| App visibility per Profile | Yes | Partial (table exists) | **Partial** |
| Tab visibility per Profile | Yes | Not implemented | **Missing** |
| Login Hours / IP Ranges | Yes (Profile-only) | Not implemented | **Missing** |

### Setup Administration

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| User Manager page | Yes | Yes (UserManager.tsx) | **Full** |
| Profile Manager page | Yes | Yes (ProfileManager.tsx) | **Full** |
| PermissionSet Manager page | Yes | Yes (PermissionSetManager.tsx) | **Full** |
| Role Manager page (hierarchy tree) | Yes | Yes (RoleManager.tsx with tree + search) | **Full** |
| Group/Queue Manager page | Yes | Yes (GroupManager.tsx) | **Full** |
| Sharing Rules Manager page | Yes | Yes (SharingRuleManager.tsx) | **Full** |
| Permission Analyzer | Yes (UAPA AppExchange app) | Yes (PermissionAnalyzer.tsx with user comparison) | **Full** |
| PSG Manager page | Yes | Backend ready, UI NOT registered | **Missing UI** |
| System Permissions catalog page | Yes | Not implemented | **Missing** |
| Custom Permissions Manager page | Yes | Backend ready, UI not built | **Missing UI** |
| OWD/Sharing Settings page | Yes | Not implemented | **Missing** |
| Connected Apps admin | Yes | Table exists, no admin UI | **Missing UI** |
| Permission Editor (object + field perms) | Yes | Yes (PermissionEditorModal) | **Full** |
| Sharing Debugger / Record Access Reasons | Yes (Sharing Hierarchy panel) | Not implemented | **Missing** |

### Authentication & OAuth

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| Username/password auth | Yes | Yes (bcrypt, JWT HS256) | **Full** |
| OAuth 2.0 authorization_code | Yes | Yes | **Full** |
| OAuth 2.0 password grant | Yes (SF-compatible security_token) | Yes | **Full** |
| OAuth 2.0 client_credentials | Yes | Yes (resolves to SystemAdmin user) | **Full** |
| Google OAuth | Yes | Yes (separate endpoint) | **Full** |
| SAML 2.0 SSO | Yes | Not implemented | **Missing** |
| MFA / 2FA | Yes (configurable) | Not implemented | **Missing** |
| Session timeout configuration | Yes (per-org or per-profile) | Hardcoded 24h JWT expiry | **Partial** |
| Connected Apps (OAuth apps) | Yes (full management) | Table + bootstrap data, no admin UI | **Partial** |

### Password Policies

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| Password complexity | Configurable | Fixed: 8+ chars, upper, lower, digit, special | **Partial** |
| Password expiration | Configurable (days) | Not implemented | **Missing** |
| Password history (reuse prevention) | Configurable (last N) | Not implemented | **Missing** |
| Account lockout after failures | Configurable (N attempts → lock M minutes) | Not implemented | **Missing** |
| Password reset (self-service email) | Yes | Not implemented | **Missing** |
| Admin-initiated password reset | Yes | Not implemented | **Missing** |

### Audit & Compliance

| Feature | SF | NexusCRM | Status |
|---------|-----|---------|--------|
| Field change history | Yes (per-object, 20 fields max) | Yes (_System_AuditLog for updates) | **Partial** (no create/delete tracking) |
| Login history (success + failures) | Yes (LoginHistory, 6mo retention) | Sessions only (no failures, no dedicated table) | **Missing** |
| Setup audit trail | Yes (SetupAuditTrail, 180 days) | Not implemented | **Missing** |
| Layout change history | Yes | Yes (_System_PageLayoutHistory with versioning) | **Full** |
| Session management (admin view/revoke) | Yes (Active Sessions page) | Sessions in DB, no admin UI or bulk revoke | **Missing UI** |
| Expired session cleanup | Yes | Not implemented (sessions accumulate indefinitely) | **Missing** |

---

## 2. Critical Findings

### Finding 1: SecurityValidator covers <1% of query traffic

**Source:** B6 agent (line-by-line code analysis)

`ValidateAndRewrite()` is called from exactly ONE place: `QueryService.ExecuteRawSQL()` (query_service.go:731). This is a raw SQL execution path used only for analytics queries.

All other query paths bypass SecurityValidator entirely:
- SOQL queries (`/query` endpoint) → `QueryService.Query()` → `repo.Find()` — **no RLS**
- Record CRUD (`GET /sobjects/:sobject/:id`) → `PersistenceService.Retrieve()` → `repo.FindOne()` — **no SQL RLS** (uses post-fetch CheckRecordAccess)
- List queries with filters → query builder → `repo.Find()` — **no RLS**
- Report queries → analytics handler → some go through ExecuteRawSQL (with RLS), some don't

**Impact:** The single-record CheckRecordAccess (5-layer) is the actual security enforcement for 99% of data access. SQL-level RLS is nearly unused.

### Finding 2: OWD SharingModel exists in metadata but is not enforced

**Source:** B4-B5 agent

- `SharingModel` enum defined in `enums.go:84-91`: Private, PublicRead, PublicReadWrite
- `SystemObject.SharingModel` field exists in the metadata model
- Bootstrap sets `SharingModel` values (schema.go:280 defaults to "PublicReadWrite", discover_tables.go:226 inserts as "Private")
- **But `record_access.go` never reads SharingModel** — it always runs the full 5-layer check regardless of OWD setting

### Finding 3: No permission cache invalidation on profile/role change

**Source:** B1-B3 agent

When `UpdateUser()` changes ProfileID or UserRoleID, the permission cache is NOT invalidated. The user operates under stale permissions for up to 5 minutes (TTL). Additionally, deactivating a user (IsActive=false) does NOT revoke their active sessions.

### Finding 4: Bootstrap has only 2 roles, not 43

**Source:** B1-B3 agent

The bootstrap data in `system_data.json` seeds only `sales_rep` and `sales_manager`. The "43 roles with 5-level hierarchy" mentioned in the original PDF report comes from SF org data, not from NexusCRM bootstrap. Roles are created by admins or migrated from SF.

### Finding 5: Profile controls only 3 of SF's 8 categories

**Source:** B1-B3 agent

NexusCRM Profile controls: Object perms, Field perms, System perms.
Missing: Record Type access, App visibility, Tab visibility, Login Hours, IP Ranges.
Page Layout assignment is implemented but via a SUPERIOR model (Role × Profile × RecordType, exceeding SF's 2D model).

---

## 3. SF Design Details

*Detailed SF research is preserved in the agent outputs. Key highlights below.*

### Profile: 8 Categories of Control

1. **Object permissions** — CRUD + ViewAll + ModifyAll per object
2. **Field-level security** — Read/Edit per field per object
3. **System permissions** — ~364 boolean flags
4. **Page Layout assignment** — Profile × RecordType → Layout (Profile-only, PermSets cannot)
5. **Record Type access** — Which RTs visible, which is default (default is Profile-only)
6. **App visibility** — Which Lightning apps visible, default app (Profile-only)
7. **Tab visibility** — Default On / Default Off / Hidden (Profile-only)
8. **Login Hours / IP Ranges** — Access time/location restrictions (Profile-only)

### PermSet: What It Cannot Control

- Page Layout assignment
- Login Hours / IP Ranges
- Default Record Type
- Default App
- Tab visibility defaults

### Muting: Scoped to PSG Only

- 1 Muting PS per PSG
- Cannot mute Profile-granted permissions
- Cannot mute permissions from other PSGs
- Auto-cascades: muting Read auto-mutes Create/Edit/Delete

### OWD Options per Object

| Object | Options |
|--------|---------|
| Account | Private, PublicReadOnly, PublicReadWrite |
| Contact | ControlledByParent, Private, PublicReadOnly, PublicReadWrite |
| Opportunity | Private, PublicReadOnly, PublicReadWrite |
| Case/Lead | Private, PublicReadOnly, PublicReadWrite, PublicReadWrite/Transfer |
| Custom Objects | Private, PublicReadOnly, PublicReadWrite, ControlledByParent (if master-detail) |

### Role Hierarchy Access

Manager gets same access as subordinate (Read+Edit+Delete), BUT bounded by manager's own object permissions. "Grant Access Using Hierarchies" is always ON for standard objects, configurable for custom.

### Record Access Decision (SF's full 10-layer flow)

1. Object-Level gate (Profile/PermSet CRUD)
2. Record Ownership
3. ViewAllData / ModifyAllData / ViewAll / ModifyAll
4. OWD baseline
5. Role Hierarchy
6. Sharing Rules
7. Territory Management
8. Teams
9. Manual Sharing
10. Implicit Sharing (parent↔child, non-configurable)

### Sharing Recalculation

Triggered by: OWD change, sharing rule change, role change, group membership change. Runs async. During recalc: increased access takes effect immediately; decreased access takes effect only after recalc completes.

### Audit Retention

- Setup Audit Trail: 180 days, non-configurable
- Login History: 6 months
- Field History: 18 months UI / 24 months API (Field Audit Trail add-on extends this)

---

## 4. NexusCRM Implementation Details

### User Table (21 fields)

Id, Username, Email, Password (bcrypt), FirstName, LastName, Phone, ProfileId (required, FK), UserRoleId (optional, FK), ManagerId (optional, self-FK), Title, Department, Division, IsActive, IsDeleted, OwnerId, CreatedById, LastModifiedById, LastLoginDate, CreatedDate, LastModifiedDate

### Password Rules (ValidatePasswordStrength — password.go:36-67)

- Min 8, max 128 characters
- At least 1 uppercase `[A-Z]`
- At least 1 lowercase `[a-z]`
- At least 1 digit `[0-9]`
- At least 1 special char `[@$!%*?&]`

### Bootstrap Profiles (5)

| Profile | System tables | Business tables | System Perms |
|---------|--------------|-----------------|--------------|
| system_admin | CRUD+ViewAll+ModifyAll | CRUD+ViewAll+ModifyAll | All 60+ |
| standard_user | Read only | Read+Create+Edit | ApiEnabled, RunReports, ExportReport, EmailSingle, CreateCustomizeFilters, LightningExperienceUser |
| sales_user | Read only | Read+Create+Edit | Same as standard |
| deal_user | Read only | CRUD (incl Delete) | Same as standard |
| legal_user | Read only | Read only | Same as standard |

### Setup Pages Registered (13 of ~19 needed)

Working: Objects, Users, Profiles, PermSets, Groups, Roles, Sharing Rules, Permission Analyzer, Flows, Apps, Import, Export, Schema Builder

Missing: PSG Manager, System Permissions, Custom Permissions, OWD/Sharing Settings, Connected Apps, Login History, Session Management

### OAuth Endpoints

- `GET /services/oauth2/authorize` — Authorization code flow
- `POST /services/oauth2/token` — Supports: authorization_code, password (SF-compatible with security_token), client_credentials
- `POST /services/oauth2/revoke` — Session revocation
- `GET /services/oauth2/userinfo` — OIDC claims + permissions (missing role_id)
- `POST /services/oauth2/google/token` — Google OAuth

### Audit Mechanisms

- `_System_AuditLog`: Field-level change tracking on record updates (not creates, not deletes, not setup changes)
- `_System_Session`: Stores IP, UserAgent, timestamps (serves as minimal login audit)
- `_System_PageLayoutHistory`: Layout versioning with change reason and rollback capability
- No: LoginHistory, SetupAuditTrail, failed login tracking, session cleanup

---

## 5. Gap Analysis by Area

### CRITICAL (Security vulnerabilities)

| # | Gap | Impact | Fix Effort |
|---|-----|--------|-----------|
| C1 | SQL RLS covers <1% of queries | Most data access has no SQL-level record filtering | 3-5d (extend to SOQL/list queries) |
| C2 | OWD not enforced (metadata exists but unused) | Cannot distinguish Public vs Private objects | 2d (read SharingModel in CheckRecordAccess + applyRLS) |
| C3 | ViewAllRecords not checked in any RLS path | Users with ViewAll perm still filtered by owner_id | 1d |
| C4 | JOIN queries bypass RLS entirely | Reports with JOINs have no data isolation | 2d |
| C5 | No session revocation on user deactivation | Deactivated users retain active sessions | 0.5d |

### HIGH (Functional gaps affecting users)

| # | Gap | Impact | Fix Effort |
|---|-----|--------|-----------|
| H1 | Role Hierarchy only passes Read (not Edit/Delete) | Managers can't edit subordinate records via hierarchy | 1d |
| H2 | Analytics route missing RunReports guard | Any authenticated user can run reports | 0.5d |
| H3 | PermApiEnabled not checked on API routes | Any authenticated user can call all APIs | 0.5d |
| H4 | No permission cache invalidation on profile/role change | Stale permissions for up to 5 min after admin changes | 1d |
| H5 | PSG Management UI not registered | Backend 100% ready, users can't manage PSGs | 2d |
| H6 | UserInfo missing role_id/role_name | Frontend can't display user's role | 0.5d |

### MEDIUM (Missing SF features, low urgency for 127 users)

| # | Gap | Fix Effort |
|---|-----|-----------|
| M1 | No Record Type access per Profile | 2d |
| M2 | No Tab/App visibility per Profile | 2d |
| M3 | Frontend ViewAll/ModifyAll hardcoded false | 1d |
| M4 | No Login History table | 2d |
| M5 | No Setup Audit Trail | 3d |
| M6 | No failed login tracking / account lockout | 2d |
| M7 | No password reset flow (email-based) | 3d |
| M8 | No expired session cleanup | 1d |
| M9 | No Sharing Debugger / Record Access Reasons | 3d |

### LOW (Enterprise features, unnecessary at 127 users)

| # | Gap |
|---|-----|
| L1 | No SAML 2.0 SSO |
| L2 | No MFA / 2FA |
| L3 | No Login Hours / IP Range restrictions |
| L4 | No password expiration / history |
| L5 | No delegated administration |
| L6 | No Implicit Sharing (parent↔child) |
| L7 | No Territory Management |
| L8 | No Session-based Permission Sets |
| L9 | No PermSet assignment expiration |

---

## 6. Prioritized Action Items

### Phase 0: Security (This week, 3-4 days)

1. **Enforce OWD SharingModel** — Read from metadata in CheckRecordAccess + applyRLS. PublicReadWrite = skip RLS. Private = full check.
2. **Check ViewAllRecords** in CheckRecordAccess and applyRLS before owner_id filter.
3. **Fix Role Hierarchy to pass Edit/Delete** (configurable per-object via GrantAccessUsingHierarchies).
4. **Add RunReports guard** to analytics routes.
5. **Add PermApiEnabled check** to API routes.
6. **Revoke sessions on user deactivation.**

### Phase 1: RLS Coverage (2-3 weeks)

7. **Extend SecurityValidator to SOQL /query endpoint** — all list queries go through RLS.
8. **Fix JOIN support in applyRLS** — inject RLS on each table.
9. **Upgrade applyRLS WHERE clause** to include Role Hierarchy subordinates + Sharing Rules + Manual Share (real-time subquery, not just owner_id = ?).
10. **Invalidate permission cache** on profile/role change.

### Phase 2: Admin Completeness (2-3 weeks)

11. **Register PSG Manager** in SetupRegistry + build UI.
12. **Add UserInfo role_id/role_name.**
13. **Frontend ViewAll/ModifyAll** from real API data.
14. **Login History table** + failed login tracking.
15. **Session cleanup** (scheduled job for expired sessions).
16. **Setup Audit Trail** (track permission/config changes).

### Phase 3: Polish (4-6 weeks, optional)

17. Account lockout after N failed logins.
18. Password reset flow.
19. System/Custom Permissions admin pages.
20. OWD/Sharing Settings admin page.
21. Connected Apps admin UI.
22. Sharing Debugger / Record Access Reasons.

---

## 7. Open Questions

1. **OWD default for new objects** — Private (secure) or PublicReadWrite (convenient)? SF defaults most to Private.
2. **Role Hierarchy Edit/Delete** — default ON or OFF for custom objects?
3. **RLS strategy for SOQL** — reuse SQL AST injection, or post-fetch filter?
4. **Permission cache TTL** — 5min acceptable, or need event-driven invalidation?
5. **Implicit Sharing** — implement for Account↔Contact/Opportunity/Case, or defer?
6. **Record Type access** — implement per-Profile, or per-PermSet (modern SF direction)?

---

## 8. Source References

### SF Official Documentation
- [Salesforce Data Security Model — Explained Visually](https://developer.salesforce.com/blogs/developer-relations/2017/04/salesforce-data-security-model-explained-visually)
- [Platform Sharing Architecture](https://architect.salesforce.com/fundamentals/platform-sharing-architecture)
- [Record Access Under the Hood](https://developer.salesforce.com/docs/atlas.en-us.salesforce_record_access_under_the_hood.meta/salesforce_record_access_under_the_hood/uth_entity.htm)
- [Security Implementation Guide](https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/)
- [Permission Set Groups](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups.htm)
- [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_muting.htm)
- [OWD Settings](https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm)
- [Role Hierarchy](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm)
- [Sharing Rules](https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm)
- [Setup Audit Trail](https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/admin_monitorsetup.htm)
- [Login History](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_loginhistory.htm)
- [Session-Based Permission Sets](https://trailhead.salesforce.com/content/learn/modules/session_based_perms/session_based_overview)
- [User Access Policies](https://help.salesforce.com/s/articleView?id=platform.perm_user_access_policies.htm)

### NexusCRM Key Files
- `backend/internal/features/permissions/service.go` — Permission service core
- `backend/internal/features/permissions/record_access.go` — 5-layer record access
- `backend/internal/features/permissions/role_hierarchy.go` — Role hierarchy cache
- `backend/internal/features/permissions/sharing_rules.go` — Sharing rule evaluation
- `backend/internal/features/analytics/security_validator.go` — SQL RLS (applyRLS)
- `backend/internal/interfaces/middleware/permission_loader.go` — Permission cache + guards
- `backend/internal/infrastructure/persistence/perm_system.go` — System perm resolution
- `backend/internal/infrastructure/persistence/perm_object_field.go` — Object/field perm queries
- `backend/internal/features/auth/auth_service.go` — Login, session, OAuth
- `backend/internal/features/auth/auth_user_mgmt.go` — User CRUD
- `backend/cmd/server/routes.go` — Route definitions + guards
- `shared/pkg/constants/permissions.go` — 60+ permission constants
- `shared/pkg/constants/enums.go:84-91` — SharingModel enum (Private/PublicRead/PublicReadWrite)
- `frontend/src/registries/SetupRegistry.ts` — Setup page definitions
- `frontend/src/pages/PermissionAnalyzer.tsx` — Permission comparison tool