One platform for payroll, billing, projects and AI-assisted development
Itqaan
A multi-tenant enterprise management platform: a FastAPI backend and React 19 workspace covering attendance, payroll, expenses, invoicing, project profitability and an AI coding-agent dashboard behind granular role-based access.
One daily workspace, with the controls behind it.
Employees start their day, take breaks and see who is online from a single home screen; finance and administration work from the same platform.
Attendance, availability and team presence at a glance.
The home screen tracks the working day, breaks and remaining availability, and shows which colleagues are currently online.
Finance and access control
Payroll, expenses, invoices and role permissions share one data model and one access system.
One platform where four tools used to be.
Itqaan brings attendance, payroll, invoicing and project profitability into a single multi-tenant system, with an AI coding-agent dashboard beside them.
Every route is guarded by the same permission engine, and money only moves through records that cannot be quietly edited afterwards.
Four systems, one source of truth.
Payroll, access control, billing and developer tooling each had rules that could not be allowed to disagree.
Payroll integrity
Salary payments must produce matching, tamper-proof expense records.
Granular access
Roles, departments and hierarchy all limit what a person can see or change.
Multi-company billing
Several companies, clients, tax rates and purchase orders in one system.
Auditable time
Attendance carries enough context to be reviewed after the fact.
Architecture
A layered FastAPI backend, a permission engine shared by every route, and a separate FastMCP service for AI tooling.
Decision 01
Access rules had to be enforced identically on every endpoint.
Register permissions using decorators on each route when the application starts. A shared dependency checks access in this order: god-mode access, registered permissions, department restrictions, and role hierarchy. Users cannot modify records owned by users with higher roles.
The React app follows the same permission rules through a centralized route-to-permission map and route guards.
Architecture Narrative
An API request is authenticated with a JWT or personal access token. A hierarchy-zero role bypasses checks. Other requests go through a permission registry lookup, then a department access check, then a hierarchy protection check.
Architecture Narrative
A draft salary slip is finalized and then paid. Payment creates a locked salary expense, which feeds both the bank statement report and the profit and loss report.
Decision 02
Payroll records and the expense ledger could not be allowed to drift apart.
Make payment the only way a salary expense can exist. Paying a slip creates the linked expense automatically, the expense is frozen against edits and deletion, and the financial reports read from the same records.
Decision 03
Developer automation had to be usable from AI editors and from the web app.
Architecture Narrative
An AI editor calls a standalone FastMCP server, and the React Jules dashboard calls the FastAPI backend directly. Both reach the Jules service, which works against connected GitHub repositories.
Run a standalone FastMCP server on its own port that exposes the Jules coding-agent operations as tools, authenticated with personal access tokens, while the React dashboard uses the same backend over JWT.
What the platform makes possible.
Salary expenses cannot be edited or deleted
Payroll-linked expense records are locked once created.
Permissions enforced on every route
Department isolation and hierarchy protection apply on top of role checks.
Attendance records client context
Punch events capture the client IP address and user agent.
Profit and loss on demand
Revenue, expenses and categorical breakdowns read from live records.
Project financials stay hidden
Budget and income figures are removed unless the requester is permitted.
AI agent control from the editor
Jules session tools are exposed through a FastMCP server.
One workspace for everyone, one console for finance.
The same platform serves the employee on a normal day and the administrator closing the month.
Daily workspace
Punch in and out, take breaks, request leave, review time summaries and see who is online.
- Timepunch clock with audit data
- Leaverequests + balances
- Projectstimesheet entries
Finance and control
Generate and pay salary slips, review expenses and reports, manage billing and assign permissions by role.
- Payrollmulti-component slips + PDF
- ReportsP&L, bank statement
- Billinginvoices, POs, payments
- Accessrole permission matrix
Mainstream tools, carefully layered.
Each layer uses well-understood technology that the team can maintain.
Backend
Layered API with migrations and document generation.
Frontend
Component-driven single-page application.
Data and state
Relational storage and server-state caching.
AI and delivery
Agent tooling, media storage and hosting.