Document Delivery Platform.

Own two pieces of the platform. First, a multi-tenant authentication and permissions system built on top of AWS Cognito: tenant provisioning, the full user lifecycle, a machine-to-machine OAuth2 flow for backend integrations, and role-based permissions enforced identically on frontend and API, with real access tokens kept out of the browser entirely. Second, two of the platform's delivery-channel integrations, each following its own external protocol.

• Token-Embedded Roles: User roles baked directly into the Cognito ID token at sign-in, via a custom Pre Token Generation Lambda trigger that reads each user's roles per tenant from the database and injects them as a claim, so the API authorizes a request from the token alone, with no database round-trip per call. The backend stays the single source of truth for those roles: the frontend only ever reflects what the API already decided, it never computes access on its own.

• Immediate Sign-Out on Change: That speed has a cost, a permission change doesn't take effect until the token refreshes. Closed the gap by forcing an immediate sign-out whenever someone's access changes, rather than letting them operate on stale permissions until the token happened to expire on its own.

• Server-Side Token Storage: The browser never holds the real Cognito tokens: an opaque, short-lived session id maps to the actual tokens stored server-side in Redis. A deliberate trade-off: more moving parts on the backend, in exchange for tokens that can't be read or replayed from the client.

• Per-Tenant OAuth2 Credentials: Each tenant gets its own rotatable OAuth2 client id/secret for machine-to-machine integrations via Cognito's client-credentials grant, instead of one shared key across every integration.

• QR Code & SOAP/XML Integrations: Two more of the platform's delivery-channel integrations: a QR-code payment-link generator worker for one channel, and the SOAP/XML integration behind the Doccle delivery channel. Both plug into the same async worker architecture as the rest of the platform rather than being bolted on separately.

Both the authentication and permissions layer and the two delivery-channel integrations are running in production, handling every new enterprise tenant that joins the platform.