User Flows

End-to-end walkthroughs of the processes the NKO ERP runs: who acts, which screen they are on, which code path executes, what it writes, and where the request goes next. Each page follows the same shape — actors, preconditions, a sequence diagram, a step-by-step table, and the edge cases.

These pages describe behaviour. For the screens themselves see Modules; for the individual endpoints see API; for the underlying tables see Database.

Flow	Covers
Authentication	Sign-in, the permission gate, forced password change, two-factor, the navigation shell, sign-out.
Permissions	Groups and permission keys, how a key is resolved on every request, data scoping (All / Location / Custom / Default) and the manager → staff hierarchy.
HR Onboarding	Creating an employee from scratch or from a recruited applicant — the draft record, contract, position, login and initial password.
Procurement Cycle	Purchase Request → RFQ and CBA supplier analysis → Purchase Order → Goods Received Note → Payment Order.
Payroll	The monthly pay run: generation, allocation across budget lines, the approval chain and export.
Leave Management	Requesting leave, balance calculation, the substitute, the approval chain and the e-signature PIN.

What every flow has in common

• One approval engine. Each multi-step document carries a StatusId and a NextUserId, and exposes a single ContextActions POST that drives every transition. See API Overview.
• E-signature gating. BSign.HasSign(userId) is checked before any transition; without an approved signature the action is refused.
• Failures are redirects, not status codes. A refused transition comes back as a redirect carrying errorMsg, rendered as a banner — see Request Pipeline.