WORKFORCE OPERATING SYSTEM — NIGERIA FIRST
People operations,
engineered like infrastructure.
KHR is a multi-tenant HR platform built to defense-grade standards: hard tenant isolation, enforced multi-factor access, auditable by default. Employees, org graph, leave and attendance — one command surface.
/ 01 — CAPABILITIES
Every module, mission-ready.
Tenant Isolation
Four independent enforcement layers — per-request membership checks, scoped context, a tenant-bound data client, and Postgres row-level security. Verified by automated cross-tenant attack tests.
Access Control
Seven-role RBAC matrix enforced server-side. Mandatory TOTP multi-factor for privileged operators. Hashed, revocable sessions. No client-side trust, anywhere.
Workforce Records
Complete employee lifecycle with field-level clearance: salary, BVN and bank data visible only to the subject and explicitly authorized roles.
Org Graph
Live reporting structure with cycle-proof department trees and manager chains. The graph is validated on every mutation — bad topology cannot be committed.
Leave Operations
Policy-driven entitlements, working-day computation against company calendars and public holidays, balance enforcement and a full approval trail.
Attendance Telemetry
Server-timestamped clock events stored in UTC. Duplicate-proof by design. Corrections flow through review — history is never silently rewritten.
/ 02 — SECURITY POSTURE
Zero trust between tenants. Zero exceptions.
- Membership re-verified on every request — revoked access fails closed, instantly.
- Postgres row-level security backs the application layer: even raw SQL cannot cross a tenant boundary.
- Argon2id credentials, hashed opaque sessions, enumeration-resistant auth flows.
- TOTP multi-factor is mandatory for privileged operators, with hashed recovery codes.
- Compensation, BVN and bank data are field-level restricted to the subject and cleared roles.
02:14:07Z auth.login mfa=totp ok
02:14:22Z employee.updated fields=[jobTitle]
02:15:01Z leave.approved days=5 policy=annual
02:15:38Z cross-tenant read → DENIED 404
02:16:10Z attendance.clock_in utc server-ts
02:16:44Z member.invited role=HR_MANAGER
02:17:03Z onboarding.approved terms=accepted