Bootstrap
Creates the first standalone HR admin, primary company, membership, assignment, and company-level grant.
HR-P1 Standalone Admin
Standalone login, access, seed, and import controls
Production can run before Account/ERP by using standalone HR identity, company memberships, role grants, audited seed batches, and employee imports.
RuntimePostgres requiredFixture endpoints stay unavailable in production; admin actions operate only through database-backed sessions.
Company access
Displays grants, memberships, assignment IDs, sensitivity ceiling, export permission, and consolidation rights.
Baseline seed
Seeds companies, employees, standalone users, role grants, and workflow records from the HR-P1 baseline contract.
Employee import
Imports employee master rows with row-level errors, checksum, batch record, and production audit event.
API surface
Admin endpoints
| Method | Path | Guard |
|---|---|---|
| POST | /people/v1/admin/bootstrap | x-people-bootstrap-token |
| GET | /people/v1/admin/company-access | Bearer people session |
| POST | /people/v1/admin/seed/baseline | hr_admin grant |
| POST | /people/v1/admin/import/employees | hr_admin grant + company scope |
Access pattern
Company-level rights
| Role | Scope | Ceiling | Export | Consolidation |
|---|---|---|---|---|
| hr_admin | company | S4 | Allowed | No |
| employee | self | S3 | No | No |
| auditor | cross_company | S2 | Masked | Allowed |