Customer Hierarchies & Permissions

Large B2B buyers rarely operate as a single account. A team member might purchase for multiple locations, divisions, or subsidiaries, each with its own negotiated contract, pricing, catalog availability, and payment terms. Forcing them into separate logins per account is friction that costs orders.

One user can belong to multiple business accounts and switch between them in seconds. Each account loads its own negotiated pricing, product catalog, order history, payment methods, and shipping addresses. Admin and User roles separate ordering from account management: admins control payment, addresses, and team membership, while users browse and order using the configurations already on file.

When multiple brands share a commerce platform but operate on separate domains, authentication has to work across all of them without forcing customers to log in again on each site. At the same time, not every account should have access to every brand.

Three storefronts on separate domains share a single authentication layer. A cross-domain session cookie is recognized by all three instantly. Each account carries independent permission flags per brand, allowing storefront access to be gated at the account level. One brand may be open to all registered users while another is restricted to verified trade dealers.

Some commerce environments need more than 'is this customer logged in?' before allowing a purchase or registration. Education, training, certification-driven, and regulated industries require that customers meet specific prerequisites: classes attended, products previously purchased, certifications held, license entitlements active.

A configurable prerequisites engine evaluates customer eligibility in real time against rules authored by business users. Rules combine conditions using ANY/ALL nested groups with time windows, recency constraints, and minimum count thresholds. The same engine guards three checkpoints: shop purchase, class registration, and account refresh.

Wholesale isn't open commerce. Every product impression has to respect brand exclusivity, regional licensing, and account-level entitlements. A false-allow is a contract risk; a false-restrict is a lost order. Both have weight, and the system has to get it right on every request.

A deterministic decision engine runs on every search and browse request, evaluating each product through four sequential phases: Pre-Flight handles anonymous users safely, Fast-Track exits early for explicitly approved customers, Group Checks apply group-level allow and block lists, Country Checks apply country-level rules and customer overrides. The whole flow runs as a search filter inside Elasticsearch, fast for the buyer, defensive for the brand.

Some B2B organizations operate multiple physical locations that all roll up to a single billing relationship, but each location needs to order independently. Forcing every location to share a single B2B account creates ordering bottlenecks. Splitting them into separate B2B accounts breaks the consolidated billing relationship.

Each location operates as a B2C-style ordering experience with its own product browsing, cart, and checkout. Orders inherit the parent account ID and carry their own location ID. Microsoft Dynamics 365 receives the orders with location identifiers preserved, enabling fulfillment and billing at the location level while reporting stays consolidated at the parent.