Shared Core/Governance and trust

Integrations and events

Each integration declares its source of truth and flow direction, and every undelivered event is handled from its queue. 9.1 9.2 9.4 N-V8-03 INT-REQ-001 R-D2-01 INT-REQ-002 INT-BR-001 INT-REQ-026 NFR-REQ-003

HRMS · Human resources
Source of truth: people and assignments
Operational
people
Last reconciliation
Conflicts
HRMS → Core · daily + real-time termination events
Entra ID · SCIM 2.0
Source of truth: users and groups
Operational
users
Last event
Errors
IdP → Core · automated provisioning and deprovisioning
ERP · Finance
Source of truth: cost centers, currencies, fiscal periods and budgets
Lagging
cost centers
Not calculatedQueue delay
Dead-letter messages
Bidirectional · no financial logic inside the products
Microsoft 365 · Mail
Mail gateway · Graph API
Operational
Connected via Graph because EWS is retired in Exchange Online in October 2026
Business intelligence connector
Reads from the analytics warehouse
Row-level security enforced
Add connector

HRMS · ERP · IdP · Payment gateway · custom Webhook

Secret rotation runs on the server, and the request shows as pending on the account row and isn’t repeated until it’s processed. “Restrict” opens the vault controls where allowed network addresses are set
Integration accountScopesAllowed sourcesSecretLast used
svc-erp-finance-sync
Owner: Finance department
Read financial data
finance.read
Edit cost centers
org.costcenter.write
10.30.0.0/16Expires in 9 daysA minute ago
svc-hrms-sync
Owner: Human Resources
Edit people data
person.write
Edit assignments
assignment.write
10.40.2.1467 days3 minutes ago
svc-bi-reader
Owner: Data Office
Read the analytics warehouse
analytics.read
Any sourceNo network restriction41 days ago
DestinationEventsSignature24-hour success rateStatus
https://ops.alriyada.gov.sa/hooks/paseer
Period closed
period.locked
KPI published
indicator.published
HMAC-SHA256Not calculatedActive
https://erp.alriyada.gov.sa/api/events
Purchase request approval
purchase.approved
HMAC-SHA256Not calculatedRetrying
Events published in 24 hoursNot calculated
Delivery time for 95% of eventsNot calculated
In retryNot calculated
Dead-letter messages

Dead-letter queue

EventConsumerAttemptsError
Cost center changed
org.costcenter.changed
ERP8 of 8409 · Cost center closed in ERP
Purchase request approval
purchase.approved
ERP8 of 8504 · Gateway timeout
Actual value recorded
measure.actual.recorded
Performance8 of 8422 · Unsupported schema version v2

Standard event envelope

9.2
{
  "id": "evt_01J8Z6Q7…",
  "type": "purchase.approved",
  "schema_version": "3.1",
  "tenant_id": "tnt_riyada",
  "occurred_at": "2026-09-18T07:41:07Z",
  "correlation_id": "7f3a-19c2",
  "idempotency_key": "PR-0418:approve:3",
  "actor": { "type": "user", … },
  "data": { … }
}

The event time is stored in UTC and shown in your time zone:

Identity federation with the entity’s provider

INT-REQ-001
Paseer fieldProvider claimValue at last sign-in

Provisioning and deprovisioning SCIM

R-D2-01
points SCIM
Access token
TimeOperationAccountOutcome

Just-in-time provisioning at first sign-in

Account created at first single sign-on

Local password policy

Verified email domains

ScopeRecord TXTStatus
Automatic joining by email domain is not available: accounts are created by invitation from the organization, through SCIM or through just-in-time provisioning from its provider.

Identity change log

TimeofItemBeforeAfterJustification

Data warehouse connector

DatasetClassificationStatus

Read controls

  • Read-only
    Enforced
  • Row-level securityEvery row by scope permission
    Enforced

Last reconciliation results per connector

The run itself is a server job on the set schedule
Connector Frequency Last run In source In Paseer Match Differences Status

Connector differences

IDFound inReview

Off-schedule run requests

RequestConnectorTimeofStatus
ERP is the source of truth for cost centers, currencies and fiscal periods, which Paseer reads but never edits · Last import
CodeCurrencyStatus in ERP
PeriodofToStatus in ERP