SiteUser Federation & Personas
GN-Apex maintains an unbreachable security boundary between your internal workspace operators and public project end-users. A single human identity can hold multiple vertical personas (Student, Donor, Shopper, Volunteer) across different websites without ever gaining access to your internal management dashboard.
“A customer buying from your retail store or a parent checking report cards authenticates against an isolated project registry with zero risk to your corporate backend.”
The 2-Tier Identity Separation
Unlike monolithic systems where all users share the same database table and permission checks, GN-Apex enforces structural database-level identity isolation:
| Parameter | Type | Requirement | Description |
|---|---|---|---|
| OrganizationMember (Dashboard Staff) | Internal Operator | Optional | Authenticated corporate personnel (Founders, Admins, Editors, Billing Managers) who access the management console to deploy edge workers, edit content, and view financial ledgers. |
| SiteUser (Public Community) | Federated End-User | Optional | External visitors who register on your public storefronts, student portals, or charity campaign pages. SiteUsers authenticate via scoped tokens and are bound to specific project IDs. |
The 4-Pillar Persona Engine
When a public visitor creates an account on a project, their SiteUserrecord automatically expands into a specialized persona based on that project's WorkspaceMode:
Student & Parent Nodes
Holds admission numbers, class enrollments, term fee balances, attendance records, exam results, and digital permission slips.
Donor & Volunteer Nodes
Maintains donation histories, recurring giving subscriptions, annual tax certificates, assigned volunteer tasks, and logged service hours.
Customer & Shopper Nodes
Stores physical delivery addresses, order histories, VAT fiscal receipts, saved payment tokens, and shopping carts.
Subscriber & Member Nodes
Powers gated article paywalls, discussion commenting, newsletter preferences, and digital membership tiers.
The Cross-Project Identity Bridge
When a user logs into their personal account on the main GN-Apex platform, the Identity Bridge scans the cluster for any SiteUser records associated with their email address.
- “Student at Kipazi Academy (Adm: ADM-2026-0042)”
- “Monthly Donor at Tanzania Wildlife Trust ($50/mo)”
- “VIP Customer at Safari Gear Store (12 Orders)”
Project-Scoped Session Tokens
To maintain strict privacy compliance, public session tokens (nx_session_[projectId]) are cryptographically isolated:
- Domain Scoping: A session token issued on School A is completely invalid on Store B, even if both projects are owned by the same organization.
- Single Sign-On (SSO): Projects can optionally enable Cross-Subdomain SSO (e.g.,
portal.yourbrand.comandstore.yourbrand.com) through parent organization configuration.