Auth & tenancy

The DMS handles sign-in and builds a permission tree from your pages, components, and actions. Roles grant access to that tree. Tenant-scoped models keep each workspace's records separate; global records, such as user accounts, are shared across the instance.

Keep these three questions separate:

Question	What to use
Who is making the request?	Authentication: verify the session and resolve the user.
May this user perform the operation?	Permissions and tenant membership checks on the backend.
Which workspace's records should the operation use?	A model bound to the authenticated request's tenant.

Start with the built-in sign-in flow, then protect your routes, then scope your data. Hiding a button does not protect a route, and a permission grant does not scope a database query.

Authentication

Sessions, invitations, two-factor and recovery, built in.

Auth & permissions

Gate routes and pages; how page, block and action permissions are derived.

Multi-tenant

Scope models to a tenant and manage memberships.

SaaS mode

Plans, billing and public registration with dms-saas.

Describe pages as many small blocks: each one becomes a line of the roles editor you can grant on its own (Best practices).

Overview

Auth & tenancy