Question

I'm learning DDD in a puristic way and I’m building a Project Management app.

• Aggregate root: Project
• Project has a manager (Employee) and a list of tasks.
• Each task is assigned to an employee.
• Business rule: Only the project manager or the employee assigned to a task can mark it complete.

I’m trying to decide where to implement this rule. My current design is:

class Employee {}

class Task {
    private Employee assignee;
    
    public boolean isAssignedTo(Employee employee) {
        return assignee.equals(employee);
    }
    
    public void complete(Employee employee) {
        // mark task as completed
    }
}

class Project {
    private Employee manager;
    private List tasks;

    public boolean isManagedBy(Employee employee) {
        return manager.equals(employee);
    }

    public Task getTask(UUID taskId) {
        // fetch task by ID
    }

    public void completeTask(UUID taskId, Employee employee) {
        Task task = getTask(taskId);
        
        if (!isManagedBy(employee) && !task.isAssignedTo(employee)) {
            throw new AuthorizationException("Only manager or assignee can complete the task");
        }

        task.complete(employee);
    }
}

Is that ok? Should i move authorization to service layer ?