NanaadeNanaade Developers
Browse documentation
Authorization

Modules, add-ons, and authorization

Tenants license capabilities independently. Nanaade computes effective feature codes from the tenant's bundle and approved overrides, then applies membership permissions on top.

Feature types

| Type | Example | Behavior | |---|---|---| | Shell | portal.notifications | Controls shared portal interface. | | Module | resume-builder | Grants a primary product area. | | Add-on | career-pathway.skill-gap-analysis | Grants an optional capability beneath its parent. |

Every add-on requires its parent module. Other dependencies can require all or any of several features. Disabled or preview-only catalog entries cannot be granted through normal administration.

Example university grant

[
  "portal.dashboard",
  "cohort-management",
  "cohort-management.csv-import",
  "institution-analytics",
  "resume-builder",
  "career-pathway",
  "career-pathway.skill-gap-analysis",
  "learning-resources"
]

Granting career-pathway.skill-gap-analysis without career-pathway is invalid. institution-analytics also depends on cohort data and therefore requires cohort-management.

Four enforcement layers

  1. Sidebar links and dashboard cards are omitted.
  2. Direct frontend route access renders a branded Feature Unavailable page.
  3. Buttons, tabs, and expensive operations check the specific add-on.
  4. Backend routes/services reject unauthorized operations.

Client-side hiding is a usability feature, never the security boundary. A user who manually constructs a URL or HTTP request must get the same decision from the backend.

API denial

HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "success": false,
  "code": "FEATURE_NOT_LICENSED",
  "feature": "career-pathway.skill-gap-analysis"
}

Your external portal should not attempt to duplicate Nanaade's dependency graph. Treat Nanaade as authoritative and show only launch-level messaging such as “Career workspace available.” Nanaade renders the precise licensed navigation after entry.

Changes during a session

Administrators can grant or revoke modules without deploying the tenant portal. Nanaade increments configVersion, invalidates cached tenant configuration, and applies the new result on subsequent protected requests. Design users' workflows so a mid-session revocation produces a clear unavailable response rather than losing entered data silently.