The shape of the platform
Core Platform (tenants, users, roles & permissions, settings, subscriptions, notifications, activity log) sits underneath every module. WFH Employee Tracking is the first module built on it; every future module (Field Tracking, HRMS, CRM, ...) plugs into the exact same foundation via a module registry — it registers its own permissions and pricing without core code needing to know it exists by name.
Key architectural decisions
Single database, not database-per-tenant
Every tenant-scoped table carries a tenant_id with a composite index, filtered automatically by a global query scope. Cheaper to operate, with an explicit, audit-logged bypass for platform administration.
Module registry pattern
Each module registers its own permissions and notification events from its own service provider — core code (tenant provisioning, the permission picker) never hardcodes a module list.
Permission delegation, not just RBAC
A role can never be granted a permission its creator doesn't already hold — enforced in the same service every role-creation path goes through, not just hidden in a UI.
Settings as data, not config files
Branding, URLs, email/SMS, subscription rules — all rows in a settings table with a global default and optional per-tenant override, Redis-cached and invalidated on write.