Approval workflow
Reward requests move through pending, approved, rejected, flagged, processing, and completed states.
Current model
Guardrails already represented in the product.
These controls define how merchant work should move through production approval workflows.
Role-aware portal
Owner, operator, reviewer, support, and admin roles are modelled for production RBAC.
Treasury guardrails
No frontend-only fund movement. Token and settlement actions remain backend-approved.
Audit-ready data
Status transitions, support tickets, and admin decisions are prepared for audit logging.
Access and governance
Controls applied across the merchant lifecycle.
Security combines authenticated sessions, merchant scoping, role permissions and auditable backend actions.
Server-side sessions
Credentials are verified on the server, passwords use PBKDF2 hashing, and revocable sessions are stored outside the browser.
RBAC enforcement
Owner, operator, reviewer, support, and administrator permissions protect merchant-scoped API actions.
Audit logs
Resource creation and status transitions retain actor, resource and request context for review.
Treasury separation
Portal workflows record intent and approval state; they do not expose direct token or payout execution.