J.1 Server-side permissions & QR codes without rights

Rights cannot be bypassed by editing a URL or calling the API directly, and a lost label or a photographed QR code exposes nothing.

What it does

Every page and every action checks the permission on the server by project, department and role; hidden buttons are only a convenience of the interface.
A QR code only holds the project, type, reference and an HMAC signature – no password, token or data. Access is decided at every scan, and forged codes are rejected.
Segregation of duties: IT administrators do not get QC approval rights; whoever reports production cannot approve QC; whoever records an installation cannot accept it; weld and packing list approvals are separate rights.

Cette page vous a-t-elle été utile ?

Mis à jour le 01 Nov 2026

Nos spécialistes produit répondent dans votre langue, généralement sous 4 heures ouvrées.