Data flows
This page sketches typical paths for authenticated use. It is not an exhaustive API catalog (that belongs in technical documentation).
Staff action in the ERP (illustrative)
Customer portal (illustrative)
Principles
- No direct DB access from frontends.
- Auth is enforced on the API; the browser holds only what it needs for the session (cookies/tokens per your implementation).
TBD
- Detailed sequence diagrams per feature (investments, finance posting, onboarding approval).