---
id: ADR-ACC-REC-015
title: Permissions Are Workspace-Wide in the First Release
product_area: accounting
module: reconciliation
revision: 2
status: proposed
design_intent: confirmed
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Grant the first release’s reconciliation authority across the workspace while
  retaining each record’s business unit.
constrains:
  - SVC-ACC-REC-reconciliation
  - RESP-ACC
  - DOM-ACC-REC-001
  - DOM-ACC-REC-003
origin: 'ACCT-M8 plan D5, approved by Andrew 2026-10-22'
alternatives:
  - option: Ship per-unit permissions immediately.
    why_not: The recorded first-release decision defers that authority boundary.
consequences:
  - A qualifying workspace grant applies across units.
  - >-
    Approval, reversal, settlement resolution and policy acceptance use
    sensitive grants.
  - >-
    Selecting a unit scopes the screen’s work rather than the caller’s
    authority.
supersedes: []
evidence:
  - >-
    services-accounting at f47cb263: aws/accounting.service.ts (reconciliation
    permission groups and built-in policies);
    docs/milestones/plans/ACCT-M8-plan.md D5;
    docs/reconciliation/architecture.md §18.1.
---
# Permissions Are Workspace-Wide in the First Release

## Context

Recorded release scope separates activities but does not authorize independently by business unit.

## Decision

Grant the first release’s reconciliation authority across the workspace while retaining each record’s business unit.

## Alternatives Considered

Ship per-unit permissions immediately. The recorded first-release decision defers that authority boundary.

## Consequences

A qualifying workspace grant applies across units. Approval, reversal, settlement resolution and policy acceptance use sensitive grants. Selecting a unit scopes the screen’s work rather than the caller’s authority.