Identity, permissions, and access
Control who can read or change records. Give each person access for the work and dates they need.
Sign in through an approved provider
Before DART can allow an action, it needs to know who is asking. Federated sign-in lets a person use an approved identity provider. DART supports OpenID Connect for this exchange. The provider proves the identity, then DART checks the mapped person.
The sign-in flow checks state and uses PKCE to protect the exchange. Sessions are held on the server and expire. Logout and identity suspension end access.
The agency chooses its authentication rules. These may include a PIV or CAC card and multi-factor authentication. Changing a contact email does not transfer the sign-in identity.
Permissions with dates and scope
Knowing who someone is does not tell the system everything they may do. A permission set states what a person may do. An administrator can assign it with dates and scope. Assignments can be changed or revoked.
Scope limits where the permission applies. It may cover an organization or a single incident. Some readiness roles can be limited to a person or qualification.
Roles remain separate. A task evaluator is not automatically a certifier. An equipment manager is not automatically a loss reviewer.
Access requests and assignment review
A person’s responsibilities can change while they are using the system. Staff can request access for review. An authorized person decides the request. The decision and later changes remain in history.
A job title alone does not grant access. DART checks the current permission and the record’s protection rules.
Independent approval where the decision requires it
Some decisions need a second person to check the work before it takes effect. Some actions need a different reviewer. An order author cannot approve that order. A person holding missing equipment cannot approve their own loss.
Reviews apply to the exact saved request. If the request changes, it may need another review. Approval does not start a paused connection or accept an order for someone else.
Access is checked again later
Access can change between a request being made and the work actually running. DART checks access again when delayed work runs. That includes report builds and source imports. File downloads also check current rights.
Revoking a permission can stop a job that was requested earlier. Database setup uses a separate account from the running application.