[ DEBT_CAPITAL_MARKETS ]

Multi-Organisation Bond Data Panels

2025Finance & Capital MarketsCapability

What it is

Data-entry and administration panels where each organisation only sees its own submissions.

Client work is shown without identifying imagery

[ THE_PROBLEM ]

Why this existed

Collecting structured data from dozens of competing organisations means each must see only its own submissions — and the question "why can this user see that record" has to have a fast, provable answer.

[ WHAT_WE_BUILT ]

What we built

Bond issuance and debt-market data-entry forms behind a permission system with organisations, users, roles and a super-admin tier. Route-level protection, permission guards on components, session handling and a debug view for permission resolution — because in multi-tenant data collection, "why can this user see that record" is the question that actually gets asked.

Bond issuance and debt-market data entry forms
Organisation, user and role model with a super-admin tier
Route-level protection and component-level permission guards
Session handling across the panel
Permission-resolution debug view

[ HOW_IT_IS_USED ]

How a company uses it

A market-data operator collects structured submissions from dozens of issuers and arrangers without any of them being able to see each other, and without an analyst re-keying emailed spreadsheets.

Built with

Next.jsMongoDBNextAuthRBAC

[ COMMON_QUESTIONS ]

Questions clients ask

Why build a permission debug view?

Because in any multi-tenant system the recurring support question is "why can this person see this" — or worse, "why can they not". A view that shows how a permission resolved turns a half-day investigation into a thirty-second answer. It is unglamorous and it pays for itself immediately.

How do you prevent competitors seeing each other's data?

Scoping enforced at the query layer, not the interface layer. Hidden UI is not a security control. Every read is bounded by the requesting user's organisation before it reaches the database.

Could this replace collecting data by email?

That is exactly the intended replacement. The value is not the form — it is that submissions arrive structured and validated, so nobody re-keys an emailed spreadsheet and introduces errors in the process.

[ RELATED_WORK ]