Scaling a B2B Procurement Engine from Zero to ₹3Cr+ GMV in 120 Days
Architectural decisions behind automated RFQs, ERP VPN tunnels, and multi-tenant ledger entitlements built for Godown Sourcing Engine.
Engineered from scratch for Godown (Manufacturing & Distribution Procurement Platform).
Company Ceiling
Maximum functionality enabled per tenant. If a company turns off an action, it is strictly denied for every user and role.
Role Grants
Normal functional access inherited by users: Admin, Purchase Manager, Plant Head, Store Manager, Engineer, and SAP Operator.
User Override
Granular per-person exceptions: DENY to restrict a specific action or ALLOW for rare exemptions.
The Problem: Multi-Plant Industrial Procurement Friction
Industrial manufacturing companies have complex organizational hierarchies: plant heads, purchase managers, maintenance engineers, and SAP operators. Giving broad administrative permissions leads to rogue purchasing, while rigid single-tier permissions cause operational paralysis. The system required granular, company-wide hierarchical feature control combined with real-time enterprise ERP integration.
Three-Tier RBAC & Enterprise SAP Tunneling
The architecture is engineered around strict data isolation, modular feature controls, and automated back-office sync:
- ›Three-Tier Entitlement Engine: Company features define the global ceiling, Roles define default grants, and User records define granular Allow/Deny overrides.
- ›Secure IPSec/WireGuard VPN tunneling connecting AWS VPC instances directly to on-premises SAP ERP databases for master data queues.
- ›Automated vendor KYC document verification pipeline that ingests GST certificates and company registration documents via OCR.
- ›Semantic Catalog Taxonomy Engine (JSON-backed) unifying thousands of disparate industrial items into searchable, structured procurement clusters.
def resolve_user_permission(company_id: str, user, action_code: str) -> bool:
"""
Three-Tier Hierarchical Entitlement Resolution
Company Ceiling -> Role Grant -> User Override (Deny / Allow)
"""
# 1. Company Ceiling: If company disables action, it is denied for ALL
if not is_feature_enabled_for_company(company_id, action_code):
return False
# 2. User Specific Override
user_override = get_user_feature_override(user.id, action_code)
if user_override == "DENY":
return False
if user_override == "ALLOW":
return True
# 3. Inherit from Role
user_role = get_user_role(user.id)
return is_action_granted_to_role(user_role.id, action_code)Key Takeaways & Architectural Insights
- 01In B2B enterprise SaaS, authorization is not a binary toggle; it must reflect hierarchical organizational authority.
- 02ERP integration cannot be an afterthought; designing bidirectional SAP queues from Day 1 enabled rapid enterprise buy-in.
- 03Automating document verification at the ingestion layer unlocks frictionless vendor onboarding and accelerated GMV velocity.
Architect High-Velocity B2B Systems
Consult with Aabhas on enterprise ERP integration, complex RBAC, and venture infrastructure.