How can commission data be restricted to authorized accounts?
Do not protect commission figures by hiding them in the interface. The server must independently decide whose records a user may see, which fields it may return, what actions are permitted, and whether export is allowed. Each settlement also fixes the rule version and source-data snapshot used for calculation. An unauthorized API request must fail before data is returned.
Commission records can reveal personal income, team performance, customer payments, and company incentive rules, making them more sensitive than an ordinary sales report. Removing an amount column only changes the screen: network responses, export endpoints, or guessed record identifiers may still disclose it. Wavesteam first models the relationship among people, roles, and records, then implements it in a common authorization layer rather than scattered page conditions.
When agreeing deliverables, handover, and ownership boundaries, also compare Why should the main business system and commission ledger avoid unrestricted two-way synchronization? and How can a client reduce the risk of an unfinished software project?; the linked guidance adds context that should be considered in the same decision.
Example acceptance matrix
| Account | Record scope | Visible fields | Actions | Default export |
|---|---|---|---|---|
| Salesperson | Their own published settlements | Basis, rate, personal amount, state | View and raise a query | None |
| Team manager | Authorized team during the valid management period | Member detail and team total, no unrelated teams | View and review | Temporary approval only |
| Finance settlement | Open batches and historical finance records | Gross/net, payment state, adjustments | Lock, record payment, reverse | Allowed with watermark and audit |
| System administrator | Account and permission configuration | Income data masked by default | Grant, disable, configure audit | None |
Combine roles with attributes. A role defines what sales, management, and finance may do; attributes further test record owner, department, region, employment period, settlement state, and environment. NIST SP 800-162 describes authorization using subject, object, action, and environmental attributes. Whether the implementation uses RBAC, ABAC, or both, trusted server logic must filter list, detail, aggregate, and download consistently.
Row-level control selects records, while field-level control limits values within them. A salesperson requesting a colleague's record should receive a denial, not full data for the browser to mask. Phone, bank, and tax identifiers need further masking or omission based on necessity. Export, print, and bulk access are separate high-risk permissions with shorter validity, bounded range, approval reason, and account/time watermark. The purpose-limitation and necessity principles in China's Personal Information Protection Law do not support unlimited access merely because a manager might find it useful.
Make the calculation traceable
Every rule change creates a version with effective period, applicable people, formula, and approver. A settlement saves the source order slice, rule version, detailed result, and manual adjustments. A newer rule never overwrites historical settlements. Refunds, price changes, and discretionary rewards create a reversal or adjustment record rather than editing the original ledger. Finance can then explain a past amount and reconcile commission with the main ledger.
Audit records include account, time, target scope, action, authorization result, export criteria, and file identifier, and ordinary administrators cannot alter them. Logging should not duplicate the sensitive payload. Monitoring can identify rapid pagination, repeated cross-team denials, bulk exports outside working periods, or an immediate download after privilege elevation.
Tests need both permitted and denied cases: changing a URL to another ID, accessing old department data after transfer, requests from departed staff, reuse of tokens after revocation, direct export calls, and aggregates leaking totals. OWASP ASVS provides relevant access-control verification areas. Use dedicated test identities rather than real executive accounts.
Wavesteam treats the permission matrix, rule versions, settlement snapshots, and denied-access test report as one acceptance package. Passing means unauthorized identities receive no data through any route, permission changes take effect promptly, historical amounts can be reproduced, and exports remain attributable.