Context

Our MPAC Portal (System Admin/Merchant Admin/PSP Admin) requires a contract-first, ID-based login system (not email-based) to provision merchant access. The platform serves multiple actor tiers — from internal operators down to store-level staff — requiring a multi-tenant identity hierarchy with scoped permissions.

Proposal

1. Account Hierarchy & ID Convention

Tier	Role	ID Format	Example	Auth Method	Scope
L0	System Operator	SYS-{4an}	SYS-A2B3	ID + pwd + MFA	Platform
L1	PSP Admin	PSP-{6an}	PSP-K3M7N2	ID + pwd + MFA	Platform
L2	Merchant Admin	MCH-{8an}	MCH-R4T7X2K9	ID + pwd + MFA	All stores under contract
L3	Area Manager	ARA-{MCH 8}-{3an}	ARA-R4T7X2K9-G3D	ID + pwd + MFA	Assigned area (store group)
L4	Store Manager	STR-{MCH 8}-{3an}	STR-R4T7X2K9-F5A	ID + pwd + MFA (recommended)	Single store
L5	Staff Leader	SLR-{STR 3}-{3an}	SLR-F5A-N2B	6-digit PIN	Single store
L6	Store Staff	STF-{STR 3}-{3an}	STF-F5A-Q7X	6-digit PIN	Single store

ID generation rules:

• {an} = alphanumeric, charset A-Z, 2-9 (excludes 0/O, 1/I/L)
• Generated server-side, cryptographically random
• Immutable once issued; deactivation only, never reuse

2. Tenant Scoping & Area Entity

Platform (L0, L1)
 └── Merchant (L2)           ← contract boundary
      └── Area (L3)          ← store-group boundary
           └── Store (L4)    ← location boundary
                └── Staff (L5, L6)

Area entity model:

• A Merchant creates named Areas (e.g. "Saigon D1", "Hanoi West")
• Each Area contains 1..N Stores
• Every Store belongs to exactly one Area
• Area Manager (L3) has full visibility/control over all Stores in their Area

Scope rules:

• L0–L1: platform-wide
• L2: all areas and stores under their contract
• L3: all stores within assigned area only
• L4–L6: single store only (cannot see sibling stores)

3. Contract-to-Credential Provisioning Flow

Merchant Request (email/sales)
  → Contract Signed
    → L0/L1 creates Merchant record → MCH-XXXXXXXX generated
      → Temp password sent (secure channel)
        → First login: forced pwd reset + MFA enrollment
          → L2 creates Area(s) via portal
            → L2 assigns Area Manager(s) → ARA-* generated
              → L2/L3 creates Store(s) → STR-* generated
                → L3/L4 creates Staff accounts → 6-digit PIN assigned

Creation permission matrix:

Creator	Can Create
L0 (Sys Operator)	L0, L1, L2
L1 (PSP Admin)	L2
L2 (Merchant Admin)	L3, L4, L5, L6 + Areas + Stores
L3 (Area Manager)	L4, L5, L6 + Stores within own area
L4 (Store Manager)	L5, L6 within own store
L5 (Staff Leader)	L6 within own store
L6 (Store Staff)	—

4. Security Requirements

• L0–L4: password min 12 chars + complexity + MFA
• L5–L6: 6-digit PIN, max 5 failed attempts → lockout (L4 resets)