75+ granular permissions in the admin panel — without the “let’s give everyone admin access and pray” approach
At PDP Mobile, we built a system of 75+ fine-grained permissions for the property management company admin panel. Real-world roles, two-layer protection, and a multi-company architecture for multiple management companies.
At PDP Mobile, we built a system of 75+ fine-grained permissions for the property management company admin panel. Not abstract RBAC on paper, but real-world roles: a bookkeeper only sees meters and payments, a dispatcher sees requests and access passes, and a concierge sees access passes and cameras.
To make sure no one could “poke around where they shouldn’t,” we added protection in 2 layers:
- at the route level — we block access to sections,
- at the component level — even if UI is reused, we still won’t show anything extra.
On top of that, we have a multi-company architecture: one installation serves several management companies at once. In an era when everyone is moving toward platform thinking and multi-tenant systems, this is no longer a nice-to-have, but a baseline.
In short, the admin panel is no longer a quest to answer “why can the concierge see financial data?” — it’s now a proper, secure system. And yes, we sleep a little better ☕️