MailGen authorization
MailGen checks the tenant, signed-in actor, verified provider identity, and resource ownership. Operations need their current permissions and, where enforced, a product license. Read key concepts and account login setup first.
Trust boundaries
| Boundary | Required protection |
|---|---|
| BFF REST, server action, ZilaWS | Authenticated actor, deployment authority, and resource permission. Mailbox actions also require their verified mailbox binding and visibility |
| TypeScript/Bun HTTP | Signed service request bound to target and explicit route policy |
| C# search/PST HTTP | Service-request proof and permission contract |
| Kafka, scheduler, C# workers | Stored admission proof bound to exact action and resource |
| Graph webhook/background sync | Separate service identity and Graph validation |
| AdminService | Tenant boundary, admin permission, entitlement refresh, rank protection, audit |
| Storage admin view | Aggregate sizes. No credentials, object browser, or content reads |
Permission decisions
Group permissions combine, but permission dependencies must hold within a group. Model grants preserve complete model/reasoning/context tuples.
Current administration authority belongs to the application actor within the deployment tenant. The resolver combines direct actor memberships with usable entitlement evidence from all verified linked Microsoft subjects in that deployment. Usable linked Global Administrator evidence can establish actor root. An authorized system-group membership can also establish root through its supported path. Ordinary Google login alone grants neither membership nor root.
Mailbox selection does not reduce the actor's administration rights. Each mailbox still requires its own visibility, verified account binding, active credential source, and provider capability. Actor rights do not grant access to every mailbox. The older selected-subject resolver remains a legacy authorization path, separate from current actor-based administration.
External entitlement refresh runs every ten minutes. Administrator requests trigger fresh checks. A source outage can retain successful evidence for at most 24 hours. Proven invalidity revokes immediately. Source failure does not prove lost membership.
Accepted work can execute after a later group change or app restriction if its original admission remains valid. New requests and result reads use current access. The server rejects invalid, revoked, or mismatched admission.
Product licenses and storage
Microsoft licenses can supply membership entitlements. MailGen product licenses are a separate enforcement layer. With enforcement enabled for a covered permission, the actor needs a valid assignment. Malformed license data or invalid product scope fails closed. When no relevant license enforces that permission, permission checks still apply. This does not imply a billing or SaaS quota service.
The storage page shows current tenant-owned object sizes, total and per user, with a measurement time. It does not show physical capacity or historical versions. Administrators and EcasRoot cannot read storage credentials, browse objects, or open their contents.