Human Resource Information System

Philtough Cargo Care Inc. (PCCI) encountered severe administrative and security vulnerabilities within its legacy human resources information system. The primary bottleneck stemmed from an outdated, hardcoded Role-Based Access Control (RBAC) architecture that was failing to secure sensitive company and employee data effectively.

Because permissions were static and buried directly inside the core codebase, lower-level user roles were inadvertently gaining access to high-privileged administrative pages. This flaw exposed confidential personnel files, payroll records, and internal communications to unauthorized staff, posing a significant data privacy and operational risk.

Every attempt by internal developers to adjust access permissions turned into a high-risk endeavor. Modifying a single user role frequently broke related site features or required rebuilding massive sections of the human resources information system. The lack of flexible permission based access control severely constrained PCCI's HR department, preventing administrators from customizing role permissions as the company expanded. Recognizing that patching the existing structure would require an entire system rebuild, project leadership brought me on board via direct peer recommendation to re-architect their access control infrastructure from the ground up.

Upon taking over the project, I conducted an in-depth audit of PCCI's existing system structure. As warned by my peers, the primary obstacle was an unorganized, tightly coupled legacy codebase that made immediate feature integration nearly impossible. To build a resilient permission based access control layer, I first had to establish clean architectural boundaries across the application.

Rather than applying a temporary patch, I executed a complete code refactoring strategy. I systematic fragmented and reorganized the application’s core layers:

• Route Architecture: Cleaned, grouped, and protected endpoints to enforce strict middleware-level validation.
• Controller Layer: Decoupled business logic into lean, single-responsibility controllers.
• Views & UI Structure: Modularized front-end components for better readability, maintainability, and user experience.

Once a clean structure was established, I designed and implemented a fully dynamic permission based access control engine integrated directly into the human resources information system.

Key System Highlights:

• Dynamic Role Creation: Super-administrators can create, rename, or deactivate custom role names on the fly without touching a single line of code.
• Page-Level & Granular Function Permissions: Assigned granular access privileges per page, restricted by essential CRUD & Export operations:
  • Create: Restricts authorization to generate new employee files or records.
  • Read: Controls page-level visibility and data viewing rights.
  • Update: Authorizes specific users to edit existing organizational data.
  • Delete: Locks down permanent data removal actions to top-level executives.
  • Export: Secures sensitive CSV/PDF report downloads against unauthorized extraction.

The deployment of the dynamic permission based access control system was an outstanding success, transforming PCCI's human resources information system into a secure, scalable, and modern corporate tool.

By transitioning PCCI from a fragile hardcoded setup to granular permission based access control, the company achieved absolute data isolation. High-level administrative views and data export functions are now fully secured, completely eliminating unauthorized access across all departments.

Measurable Project Outcomes:

• Zero Privilege Escalation: Successfully eliminated security loopholes where inferior roles could access high-level administrative pages.
• Turnkey Role Management: HR managers can instantly configure custom roles and assign page-level CRUD permissions in seconds via a user-friendly UI.
• Developer-Friendly Codebase: Streamlined the entire application architecture (UI, routes, controllers, and views), drastically reducing future technical debt.
• Future-Proof Scalability: Created comprehensive structural readability so internal PCCI developers can easily maintain, update, and scale the HRIS for years to come.

The project earned high praise from PCCI’s IT department and stakeholders. By combining essential security overhauls with full-stack structural refactoring, the upgraded human resources information system now serves as a reliable, high-performance foundation for Philtough Cargo Care Inc.'s ongoing operational growth.