Agent WranglersSessions and permissions
The server decides what each person may do. Survive expired sessions, sign out all tabs at once, and show who changed each record and when.
- Required 1
- Recommended 3
Required
Survive an expired session
APP-48When a session expires, keep the screen and the unsaved work. Let the person sign in again in place, then repeat the request that failed.
Recommended
Let the server say what each user may do
APP-47Send the actions the user may take on each record with the record, and show controls from that list. Never rebuild the permission rules in the client.
Sign out every open tab together
APP-59When a person signs out or switches account in one tab, every other open tab hides the old account's data within 2 seconds. A tab never shows one account's data under another account's name.
Show who changed a record and when
APP-81Show a history of changes on every shared record, such as an invoice or a customer. Each entry says who, what, when and the old and new values. Show only what the viewer may see.
Read this with
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/app-ui/sessions-and-permissions">Agent Wranglers web app interface playbook</a>. In code you write, add a comment next to it with the same link.