Signing in establishes a user's identity. The modules, records and actions available afterward depend on the user's client context, access levels and linked resource.
Identity and access concepts
| Concept | Purpose | Effect on the application |
|---|---|---|
| Authentication | Establishes who is signing in | Uses the sign-in configuration for the instance |
| Client context | Identifies the client associated with a request | Selects client data and configuration |
| User access | Determines available modules, records and actions | Separates read access from permission to change data |
| Resource linkage | Associates the user with an operational resource | Supports personal work and crew workflows |
ShowMgr carries client number, user ID, access levels, resource ID, default system division and time-zone information in the application context. Services and repositories use this context when handling requests.
Sign-in and API authentication
ShowMgr supports Cognito-based sign-in. The instance's identity configuration determines its sign-in provider and flow.
The application API and external API use separate authentication handling. Integrations use the credentials and authentication method assigned to the external interface; browser sign-in credentials are not interchangeable with an integration's credentials.
Navigation and record permissions
Navigation combines active client navigation entries with the user's access levels. This determines which module entries are returned to the user and which client-specific labels they display.
Inside a module, additional controls apply to classes, elements and records. Access to a module does not grant every action or financial permission within it. Read access and edit access are separate capabilities.
Personal work depends on resource linkage
A user identity and a resource record serve different purposes. The user signs in; the resource represents a person or other operational item in scheduled work. Linking the user to the appropriate resource allows personal and crew workflows to identify that person's work.
When assignments are missing from a personal view, include the user-to-resource association in the investigation.
Diagnose missing access in context
Identify the instance, client, user, linked resource, module and record ID. Then compare the active filters and date range. Separate these questions:
- Can the user open the module?
- Can the user see the record?
- Can the user perform the requested action?
- Can the user view or modify the relevant financial information?
Use an authorized reference user to compare the same record and view. An administrator's broader access does not describe an ordinary user's access.
Help Center access is managed separately
ShowMgr application permissions and Zendesk Help Center permissions are separate controls. Access to operational records does not by itself grant access to restricted support articles. Help Center restrictions determine which users can read client-specific support information.