Controls that exist today, described plainly

Organizations and clubs scope users, matches, athletes, entries, and certificates. A request for another organization's record returns 403, not an empty result — the difference matters when you are sharing a platform with a rival federation.

Enforced at the API layer, not the UI

Fourteen roles with defined capabilities, plus per-organization overrides so a federation can tighten or loosen one role without a code change. Master admin is the only role that can mint another master.

roles.js capabilities + org overrides

Being able to open a pad is not permission to score. Corner scoring is authorised against the current assignment every time an official joins, and the socket layer fails closed if it cannot verify.

authorize-scoring on every join

Suspended and expired plans block login and authenticated APIs for that organization. If the gate check itself errors, access is denied rather than assumed.

Deny on error, not allow

Sensitive operations — official assignments, user changes, offline payment marking — are written to an organization-scoped audit log that admins and auditors can read.

Org-scoped, readable by auditor role

Entry, payment, and bout events post to your endpoint with a signed payload and timing-safe verification, so you can trust what you receive and dry-run before going live.

HMAC with timing-safe compare

JWT in an HTTP-only cookie, tenant login at your own URL, invite-based password setting, and email-based password help where SMTP is configured.

HTTP-only cookie sessions

Registration, athlete lookup, support intake, and public boards are rate limited so a published link cannot be used to enumerate your roster or spam your inbox.

Applied to unauthenticated routes