Explain the internal working of the OFBiz security/permission checking framework?

Every protected action - a service call, a screen view, a specific button - can declare the permission it requires. At request or service-invocation time, the framework checks whether the current UserLogin has that permission through its group memberships.

flowchart TD
    A[UserLogin attempts action] --> B[UserLoginSecurityGroup lookup]
    B --> C[SecurityGroupPermission lookup]
    C --> D{Has required permission?}
    D -->|Yes| E[Action allowed]
    D -->|No| F[Access denied]

Permissions often follow an ENTITY_OPERATION naming convention - ORDERMGR_CREATE, for example - and many checks additionally distinguish "admin" scope (any record) from an owner-based scope (only records tied to the current party), implemented through extra Java-level checks such as hasEntityPermission rather than the group lookup alone.

Because the whole chain runs through a shared Security interface implementation, swapping in a custom authentication/authorization provider is possible by implementing that interface, without touching every screen and service that calls it.