---
id: ADR-ACC-BKS-015
title: Workspace row policies with explicit global vocabularies
product_area: accounting
module: books
revision: 1
status: proposed
design_intent: assumed
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Customer-owned Books and maintenance tables use workspace-scoped keys and
  forced row-level security. Global vocabularies are exceptions; schedule
  claiming uses narrow cross-workspace policies within its transaction.
constrains:
  - DOM-ACC-BKS-001
  - DOM-ACC-BKS-002
  - DOM-ACC-BKS-003
  - DOM-ACC-BKS-004
  - DOM-ACC-BKS-006
  - SVC-ACC-BKS-books
  - SVC-ACC-BKS-maintenance
origin: >-
  Platform row-level security and persistence standards (as cited in code; not
  read in this job: FND-ACC-BKS-044)
alternatives:
  - option: Rely only on service filters.
    why_not: >-
      A missing filter could expose another customer’s records without database
      protection.
  - option: Give the dispatcher a general row-security bypass.
    why_not: >-
      That proposed privilege is broader than the narrow claim transaction
      requires.
consequences:
  - >-
    Ordinary reads treat another workspace’s records as absent, and scoped
    references reject cross-workspace destinations.
  - >-
    The scoped purge tests check that another workspace’s records survive
    erasure.
supersedes: []
evidence:
  - >-
    services-accounting at f47cb263: modules/books/services/persistence/*.ts
    (headers)
  - >-
    services-accounting at f47cb263: modules/maintenance/db/schedules.table.ts
    (dispatcher policies)
---

# Workspace row policies with explicit global vocabularies

## Context

Customer accounting configuration must remain isolated. Shared currency, purpose and processor vocabularies intentionally serve all workspaces.

## Decision

Customer-owned Books and maintenance tables use workspace-scoped keys and forced row-level security. Global vocabularies are exceptions; schedule claiming uses narrow cross-workspace policies within its transaction.

## Alternatives Considered

Rely only on service filters. A missing filter could expose another customer’s records without database protection.

Give the dispatcher a general row-security bypass. That proposed privilege is broader than the narrow claim transaction requires.

## Consequences

Ordinary reads treat another workspace’s records as absent, and scoped references reject cross-workspace destinations.

The scoped purge tests check that another workspace’s records survive erasure.