# Permission

## Description

Permission defines a specific allowed action on a resource within the ERP system. Each permission uses the `resource:action` format (e.g., `orders:read`, `users:delete`) to clearly identify what resource and operation is controlled. Permissions are the atomic unit of authorization and are bundled into roles for assignment to users.

Examples: `orders:read`, `orders:write`, `users:create`, `reports:export`.

## Domain Model Definitions

### Model type

Standard

### Command Definitions

- [createPermission](../commands/CreatePermission.md)

### Query Definitions

### Models

- Permission

### Invariants

- Permission key must be unique across all permissions
- Permission key must follow `resource:action` format
- Permission key is required and cannot be empty

### Relationships

- **Referenced By RolePermission**: Permission is assigned to roles through RolePermission join records
