Permission Boundaries
& Login Behavior

SIMINEO handles permissions differently and does not simply follow the pattern of modern web platforms.

One of the system’s core principles from the beginning was that important login and permission states should remain clearly separated and predictable.

The browser-side operation does not receive direct access to login data. A significant part of authentication and permission flows remains under server-side control.

At first glance, this can seem less flexible, but it reduces the risk of certain state inconsistencies and client-side security problems.

The system separates normal user behavior, administrative actions and higher-permission processes.

The administrative layer is not built on simple permission checks alone. In several places, it treats the admin area as a separated operational zone, with its own authentication logic and stricter traceability rules.

This matters because an incorrect or partially damaged user state does not automatically mean access to higher permission levels.

Because of automatic invalidation rules, permission changes, status changes or certain security events can automatically close some login states.