---
id: AUTH-COM
title: Commerce Authorization Model
product_area: commerce
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
source_sha:
  rhythm-v2-docs: 544f9999b78ad4b6f1abbbaf59c4320dc015df3c
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
scopes:
  - name: workspace
    meaning: Customer grants authorize Commerce in a workspace; records and requests retain that context.
  - name: record
    meaning: Portal access is further limited by the linked contact and the purchasing or grant record.
  - name: platform
    meaning: Application callbacks require a platform-scoped service grant unavailable to workspace roles.
roles:
  - id: ROLE-COM-001
    name: Commerce Read Only
    who: A caller whose workspace role includes the generated Commerce read policy.
    grants:
      - commerce.adjustments.read
      - commerce.amendments.read
      - commerce.application.access
      - commerce.cancellations.read
      - commerce.carrier-accounts.read
      - commerce.checkouts.read
      - commerce.downloads.read
      - commerce.enforcements.read
      - commerce.entitlements.read
      - commerce.exceptions.read
      - commerce.fulfillment-policies.read
      - commerce.inventory-costing.read
      - commerce.inventory.read
      - commerce.merchandise.read
      - commerce.obligations.read
      - commerce.offers.read
      - commerce.ordering-profiles.read
      - commerce.orders.read
      - commerce.pick-lists.read
      - commerce.price-quotes.read
      - commerce.pricing-audiences.read
      - commerce.pricing-schedules.read
      - commerce.product-categories.read
      - commerce.product-extensions.read
      - commerce.product-listings.read
      - commerce.product-purchasing-settings.read
      - commerce.promotions.read
      - commerce.purchasing.read
      - commerce.recommendation-journeys.read
      - commerce.recommendation-placements.read
      - commerce.recommendation-rules.read
      - commerce.return-policies.read
      - commerce.return-receipts.read
      - commerce.returns.read
      - commerce.shipments.read
      - commerce.shipping-strategies.read
      - commerce.shipping-zones.read
      - commerce.storefront.read
      - commerce.stores.read
      - commerce.tax-zones.read
    provenance: inferred
    source: >-
      rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-02
    note: 'This is an entitlement grouping, not a separately shipped Commerce role definition.'
  - id: ROLE-COM-002
    name: Commerce User
    who: A caller whose workspace role includes the generated Commerce user policy.
    grants:
      - commerce.adjustments.read
      - commerce.amendments.create
      - commerce.amendments.read
      - commerce.amendments.update
      - commerce.application.access
      - commerce.cancellations.create
      - commerce.cancellations.read
      - commerce.cancellations.update
      - commerce.carrier-accounts.read
      - commerce.checkouts.create
      - commerce.checkouts.delete
      - commerce.checkouts.read
      - commerce.checkouts.update
      - commerce.downloads.read
      - commerce.enforcements.read
      - commerce.entitlements.read
      - commerce.exceptions.read
      - commerce.fulfillment-policies.read
      - commerce.inventory-costing.read
      - commerce.inventory.read
      - commerce.merchandise.read
      - commerce.obligations.read
      - commerce.offers.read
      - commerce.offers.respond
      - commerce.ordering-profiles.read
      - commerce.orders.create
      - commerce.orders.delete
      - commerce.orders.read
      - commerce.orders.tender
      - commerce.orders.update
      - commerce.pick-lists.create
      - commerce.pick-lists.read
      - commerce.pick-lists.update
      - commerce.price-quotes.read
      - commerce.pricing-audiences.read
      - commerce.pricing-schedules.read
      - commerce.product-categories.read
      - commerce.product-extensions.read
      - commerce.product-listings.read
      - commerce.product-purchasing-settings.read
      - commerce.promotions.manage
      - commerce.promotions.read
      - commerce.purchasing.read
      - commerce.recommendation-journeys.read
      - commerce.recommendation-placements.read
      - commerce.recommendation-rules.read
      - commerce.return-policies.read
      - commerce.return-receipts.create
      - commerce.return-receipts.read
      - commerce.return-receipts.update
      - commerce.returns.create
      - commerce.returns.read
      - commerce.returns.update
      - commerce.shipments.create
      - commerce.shipments.handoff
      - commerce.shipments.read
      - commerce.shipments.update
      - commerce.shipping-strategies.read
      - commerce.shipping-zones.read
      - commerce.storefront.read
      - commerce.stores.read
      - commerce.tax-zones.read
    provenance: inferred
    source: >-
      rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-02
    note: 'This is an entitlement grouping, not a separately shipped Commerce role definition.'
  - id: ROLE-COM-003
    name: Commerce Administrator
    who: A caller whose workspace role includes the generated Commerce administrator policy.
    grants:
      - commerce.adjustments.read
      - commerce.adjustments.resolve
      - commerce.adjustments.retry
      - commerce.amendments.apply-promotion
      - commerce.amendments.approve
      - commerce.amendments.create
      - commerce.amendments.override
      - commerce.amendments.read
      - commerce.amendments.update
      - commerce.application.access
      - commerce.cancellations.approve
      - commerce.cancellations.create
      - commerce.cancellations.override
      - commerce.cancellations.read
      - commerce.cancellations.update
      - commerce.carrier-accounts.create
      - commerce.carrier-accounts.delete
      - commerce.carrier-accounts.read
      - commerce.carrier-accounts.update
      - commerce.checkouts.bulk
      - commerce.checkouts.create
      - commerce.checkouts.delete
      - commerce.checkouts.read
      - commerce.checkouts.update
      - commerce.downloads.read
      - commerce.enforcements.read
      - commerce.enforcements.resolve
      - commerce.entitlements.grant
      - commerce.entitlements.read
      - commerce.entitlements.restore
      - commerce.entitlements.revoke
      - commerce.exceptions.acknowledge
      - commerce.exceptions.read
      - commerce.exceptions.resolve
      - commerce.fulfillment-policies.apply
      - commerce.fulfillment-policies.create
      - commerce.fulfillment-policies.delete
      - commerce.fulfillment-policies.read
      - commerce.fulfillment-policies.update
      - commerce.inventory-costing.bulk
      - commerce.inventory-costing.create
      - commerce.inventory-costing.delete
      - commerce.inventory-costing.read
      - commerce.inventory-costing.update
      - commerce.inventory.bulk
      - commerce.inventory.create
      - commerce.inventory.delete
      - commerce.inventory.read
      - commerce.inventory.update
      - commerce.merchandise.bulk
      - commerce.merchandise.create
      - commerce.merchandise.delete
      - commerce.merchandise.read
      - commerce.merchandise.update
      - commerce.obligations.approve
      - commerce.obligations.complete-manually
      - commerce.obligations.hold
      - commerce.obligations.override
      - commerce.obligations.read
      - commerce.obligations.reauthorize
      - commerce.obligations.resolve
      - commerce.offers.read
      - commerce.offers.respond
      - commerce.ordering-profiles.bulk
      - commerce.ordering-profiles.create
      - commerce.ordering-profiles.delete
      - commerce.ordering-profiles.read
      - commerce.ordering-profiles.update
      - commerce.orders.bulk
      - commerce.orders.create
      - commerce.orders.delete
      - commerce.orders.read
      - commerce.orders.tender
      - commerce.orders.update
      - commerce.orders.void
      - commerce.pick-lists.create
      - commerce.pick-lists.read
      - commerce.pick-lists.update
      - commerce.price-quotes.read
      - commerce.pricing-audiences.bulk
      - commerce.pricing-audiences.create
      - commerce.pricing-audiences.delete
      - commerce.pricing-audiences.read
      - commerce.pricing-audiences.update
      - commerce.pricing-schedules.bulk
      - commerce.pricing-schedules.create
      - commerce.pricing-schedules.delete
      - commerce.pricing-schedules.read
      - commerce.pricing-schedules.update
      - commerce.product-categories.bulk
      - commerce.product-categories.create
      - commerce.product-categories.delete
      - commerce.product-categories.read
      - commerce.product-categories.update
      - commerce.product-extensions.bulk
      - commerce.product-extensions.create
      - commerce.product-extensions.delete
      - commerce.product-extensions.read
      - commerce.product-extensions.update
      - commerce.product-listings.bulk
      - commerce.product-listings.create
      - commerce.product-listings.delete
      - commerce.product-listings.read
      - commerce.product-listings.update
      - commerce.product-purchasing-settings.bulk
      - commerce.product-purchasing-settings.create
      - commerce.product-purchasing-settings.delete
      - commerce.product-purchasing-settings.read
      - commerce.product-purchasing-settings.update
      - commerce.promotions.activate
      - commerce.promotions.manage
      - commerce.promotions.override
      - commerce.promotions.read
      - commerce.purchasing.bulk
      - commerce.purchasing.create
      - commerce.purchasing.delete
      - commerce.purchasing.read
      - commerce.purchasing.update
      - commerce.recommendation-journeys.bulk
      - commerce.recommendation-journeys.create
      - commerce.recommendation-journeys.delete
      - commerce.recommendation-journeys.read
      - commerce.recommendation-journeys.update
      - commerce.recommendation-placements.read
      - commerce.recommendation-rules.activate
      - commerce.recommendation-rules.bulk
      - commerce.recommendation-rules.create
      - commerce.recommendation-rules.delete
      - commerce.recommendation-rules.read
      - commerce.recommendation-rules.update
      - commerce.return-policies.bulk
      - commerce.return-policies.create
      - commerce.return-policies.delete
      - commerce.return-policies.read
      - commerce.return-policies.update
      - commerce.return-receipts.create
      - commerce.return-receipts.read
      - commerce.return-receipts.update
      - commerce.returns.approve
      - commerce.returns.create
      - commerce.returns.override
      - commerce.returns.read
      - commerce.returns.update
      - commerce.shipments.cancel
      - commerce.shipments.create
      - commerce.shipments.handoff
      - commerce.shipments.handover
      - commerce.shipments.read
      - commerce.shipments.update
      - commerce.shipping-strategies.create
      - commerce.shipping-strategies.delete
      - commerce.shipping-strategies.read
      - commerce.shipping-strategies.update
      - commerce.shipping-zones.create
      - commerce.shipping-zones.delete
      - commerce.shipping-zones.read
      - commerce.shipping-zones.update
      - commerce.storefront.read
      - commerce.stores.bulk
      - commerce.stores.create
      - commerce.stores.delete
      - commerce.stores.read
      - commerce.stores.update
      - commerce.tax-zones.bulk
      - commerce.tax-zones.create
      - commerce.tax-zones.delete
      - commerce.tax-zones.read
      - commerce.tax-zones.update
    provenance: inferred
    source: >-
      rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-02
    note: 'This is an entitlement grouping, not a separately shipped Commerce role definition.'
  - id: ROLE-COM-004
    name: Delivering application
    who: An application service identity holding the callback grant at platform scope.
    grants:
      - commerce.obligations.callback
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts#ObligationPermissions'
    note: 'This is an entitlement grouping, not a separately shipped Commerce role definition.'
permissions:
  - key: commerce.adjustments.read
    intent: Inspect adjustments.
    operations:
      - getFinancialAdjustment
      - listFinancialAdjustments
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#getFinancialAdjustment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#listFinancialAdjustments
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-007-finish-the-money-side-of-a-post-sale-change-step-by-step.md
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#listFinancialAdjustments'
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#getFinancialAdjustment'
  - key: commerce.adjustments.resolve
    intent: Resolve failed work for adjustments.
    operations:
      - resolveFinancialAdjustment
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#resolveFinancialAdjustment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-007-finish-the-money-side-of-a-post-sale-change-step-by-step.md
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#resolveFinancialAdjustment'
  - key: commerce.adjustments.retry
    intent: Retry failed work for adjustments.
    operations:
      - retryFinancialAdjustment
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#retryFinancialAdjustment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-007-finish-the-money-side-of-a-post-sale-change-step-by-step.md
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#retryFinancialAdjustment'
  - key: commerce.amendments.apply-promotion
    intent: Apply a promotion after placement to amendments.
    operations:
      - applyPromotionToOrder
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-015-05
      - BR-CAP-COM-ORD-015-06
      - BR-CAP-COM-ORD-015-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#applyPromotionToOrder
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-015-change-a-purchase-after-the-sale.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#applyPromotionToOrder'
  - key: commerce.amendments.approve
    intent: Approve amendments.
    operations:
      - approveAmendment
      - rejectAmendment
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-015-05
      - BR-CAP-COM-ORD-015-06
      - BR-CAP-COM-ORD-015-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#approveAmendment'
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#rejectAmendment'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-015-change-a-purchase-after-the-sale.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#approveAmendment'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#rejectAmendment'
  - key: commerce.amendments.create
    intent: Create amendments.
    operations:
      - executeAmendment
      - requestAmendment
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-015-05
      - BR-CAP-COM-ORD-015-06
      - BR-CAP-COM-ORD-015-07
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#executeAmendment'
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestAmendment'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-015-change-a-purchase-after-the-sale.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#requestAmendment'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#executeAmendment'
  - key: commerce.amendments.override
    intent: Perform a reasoned override for amendments.
    operations:
      - requestAmendment
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-015-05
      - BR-CAP-COM-ORD-015-06
      - BR-CAP-COM-ORD-015-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestAmendment'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-015-change-a-purchase-after-the-sale.md
  - key: commerce.amendments.read
    intent: Inspect amendments.
    operations:
      - getAmendment
      - listAmendments
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-015-05
      - BR-CAP-COM-ORD-015-06
      - BR-CAP-COM-ORD-015-07
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#getAmendment'
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#listAmendments'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-015-change-a-purchase-after-the-sale.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#listAmendments'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#getAmendment'
  - key: commerce.amendments.update
    intent: Change amendments.
    operations:
      - withdrawAmendment
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-015-05
      - BR-CAP-COM-ORD-015-06
      - BR-CAP-COM-ORD-015-07
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#withdrawAmendment
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-015-change-a-purchase-after-the-sale.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#withdrawAmendment'
  - key: commerce.application.access
    intent: Open Commerce.
    operations: []
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
  - key: commerce.cancellations.approve
    intent: Approve cancellations.
    operations:
      - approveCancellation
      - rejectCancellation
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-014-01
      - BR-CAP-COM-ORD-014-07
      - BR-CAP-COM-ORD-014-08
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#approveCancellation
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#rejectCancellation
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-014-cancel-lines-of-an-accepted-order-with-the-right-fee-and.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#approveCancellation'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#rejectCancellation'
  - key: commerce.cancellations.create
    intent: Create cancellations.
    operations:
      - executeCancellation
      - requestCancellation
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-014-01
      - BR-CAP-COM-ORD-014-07
      - BR-CAP-COM-ORD-014-08
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#executeCancellation
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestCancellation
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-014-cancel-lines-of-an-accepted-order-with-the-right-fee-and.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#requestCancellation'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#executeCancellation'
  - key: commerce.cancellations.override
    intent: Perform a reasoned override for cancellations.
    operations:
      - requestCancellation
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-014-01
      - BR-CAP-COM-ORD-014-07
      - BR-CAP-COM-ORD-014-08
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestCancellation
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-014-cancel-lines-of-an-accepted-order-with-the-right-fee-and.md
  - key: commerce.cancellations.read
    intent: Inspect cancellations.
    operations:
      - getCancellation
      - listCancellations
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-014-01
      - BR-CAP-COM-ORD-014-07
      - BR-CAP-COM-ORD-014-08
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#getCancellation'
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#listCancellations
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-014-cancel-lines-of-an-accepted-order-with-the-right-fee-and.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#listCancellations'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#getCancellation'
  - key: commerce.cancellations.update
    intent: Change cancellations.
    operations:
      - withdrawCancellation
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-014-01
      - BR-CAP-COM-ORD-014-07
      - BR-CAP-COM-ORD-014-08
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#withdrawCancellation
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-014-cancel-lines-of-an-accepted-order-with-the-right-fee-and.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#withdrawCancellation'
  - key: commerce.carrier-accounts.create
    intent: Create carrier accounts.
    operations:
      - createCarrierAccount
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#createCarrierAccount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.carrier-accounts.delete
    intent: Remove carrier accounts.
    operations:
      - deleteCarrierAccount
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#deleteCarrierAccount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.carrier-accounts.read
    intent: Inspect carrier accounts.
    operations:
      - getCarrierAccount
      - listCarrierAccounts
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#getCarrierAccount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listCarrierAccounts
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.carrier-accounts.update
    intent: Change carrier accounts.
    operations:
      - updateCarrierAccount
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#updateCarrierAccount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.checkouts.bulk
    intent: Load records in bulk for checkouts.
    operations: []
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
  - key: commerce.checkouts.create
    intent: Create checkouts.
    operations:
      - createCheckout
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-001-01
      - BR-CAP-COM-ORD-001-04
      - BR-CAP-COM-ORD-001-05
      - BR-CAP-COM-ORD-002-04
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#createCheckout'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-001-open-a-cart-for-a-buyer-and-fill-it-with-what-they-want.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-002-decide-which-checkout-policy-governs-a-cart-and-keep-it-on.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#createCheckout'
  - key: commerce.checkouts.delete
    intent: Remove checkouts.
    operations: []
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
  - key: commerce.checkouts.read
    intent: Inspect checkouts.
    operations:
      - getCheckout
      - listCatalogProductTypes
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-001-01
      - BR-CAP-COM-ORD-001-04
      - BR-CAP-COM-ORD-001-05
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#getCheckout'
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#listCatalogProductTypes
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-001-open-a-cart-for-a-buyer-and-fill-it-with-what-they-want.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-012-let-selling-applications-declare-prepare-and-deliver-what-an.md
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#getCheckout'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#listCatalogProductTypes'
  - key: commerce.checkouts.update
    intent: Change checkouts.
    operations:
      - abandonCheckout
      - addCheckoutItem
      - applyCheckoutPromotionCode
      - changeCheckoutItem
      - changeCheckoutOrderingProfile
      - chooseCheckoutInstallmentPlan
      - chooseCheckoutShipping
      - extendCheckoutItemHold
      - previewCheckout
      - removeCheckoutItem
      - removeCheckoutPromotionCode
      - requestCheckoutItemHold
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-001-01
      - BR-CAP-COM-ORD-001-04
      - BR-CAP-COM-ORD-001-05
      - BR-CAP-COM-ORD-002-04
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-016-apply-the-lowest-valid-discount-at-checkout.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#abandonCheckout
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#addCheckoutItem
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#applyCheckoutPromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#changeCheckoutItem
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#changeCheckoutOrderingProfile
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#chooseCheckoutInstallmentPlan
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#chooseCheckoutShipping
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#extendCheckoutItemHold
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#previewCheckout
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#removeCheckoutItem
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#removeCheckoutPromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#requestCheckoutItemHold
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-001-open-a-cart-for-a-buyer-and-fill-it-with-what-they-want.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-002-decide-which-checkout-policy-governs-a-cart-and-keep-it-on.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-003-see-the-priced-order-and-everything-that-would-stop-it.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-004-redeem-promotion-codes-on-a-cart.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-009-spread-a-purchase-over-a-deposit-and-installments.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#addCheckoutItem'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#changeCheckoutItem'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#removeCheckoutItem'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#previewCheckout'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#applyCheckoutPromotionCode'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#removeCheckoutPromotionCode'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#abandonCheckout'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#requestCheckoutItemHold'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#extendCheckoutItemHold'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#changeCheckoutOrderingProfile'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#chooseCheckoutShipping'
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#chooseCheckoutInstallmentPlan'
  - key: commerce.downloads.read
    intent: Inspect downloads.
    operations:
      - downloadEntitledFile
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-CAT-009-01
      - BR-CAP-COM-CAT-009-05
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#downloadEntitledFile
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-009-deliver-the-files-a-buyer-is-entitled-to.md
      - 'services-commerce:modules/catalog/aws/api/storefront.routes.ts#downloadEntitledFile'
  - key: commerce.enforcements.read
    intent: Inspect enforcements.
    operations:
      - getEnforcement
      - listEnforcements
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#getEnforcement
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#listEnforcements
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-006-respond-to-reversed-money-on-delivered-lines.md
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#listEnforcements'
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#getEnforcement'
  - key: commerce.enforcements.resolve
    intent: Resolve failed work for enforcements.
    operations:
      - resolveEnforcement
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#resolveEnforcement
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-006-respond-to-reversed-money-on-delivered-lines.md
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#resolveEnforcement'
  - key: commerce.entitlements.grant
    intent: Issue entitlements.
    operations:
      - grantEntitlement
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-013-06
      - BR-CAP-COM-ORD-013-07
      - BR-CAP-COM-ORD-013-10
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md#grantEntitlement
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-013-grant-the-rights-a-purchase-carries-and-track-their-use.md
      - 'services-commerce:modules/entitlements/aws/api/entitlements.routes.ts#grantEntitlement'
  - key: commerce.entitlements.read
    intent: Inspect entitlements.
    operations:
      - getEntitlement
      - listEntitlements
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-013-06
      - BR-CAP-COM-ORD-013-07
      - BR-CAP-COM-ORD-013-10
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md#getEntitlement
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md#listEntitlements
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-013-grant-the-rights-a-purchase-carries-and-track-their-use.md
      - 'services-commerce:modules/entitlements/aws/api/entitlements.routes.ts#listEntitlements'
      - 'services-commerce:modules/entitlements/aws/api/entitlements.routes.ts#getEntitlement'
  - key: commerce.entitlements.restore
    intent: Restore use of entitlements.
    operations:
      - restoreEntitlementUse
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-013-06
      - BR-CAP-COM-ORD-013-07
      - BR-CAP-COM-ORD-013-10
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md#restoreEntitlementUse
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-013-grant-the-rights-a-purchase-carries-and-track-their-use.md
      - 'services-commerce:modules/entitlements/aws/api/entitlements.routes.ts#restoreEntitlementUse'
  - key: commerce.entitlements.revoke
    intent: Revoke entitlements.
    operations:
      - revokeEntitlement
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-013-06
      - BR-CAP-COM-ORD-013-07
      - BR-CAP-COM-ORD-013-10
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md#revokeEntitlement
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-013-grant-the-rights-a-purchase-carries-and-track-their-use.md
      - 'services-commerce:modules/entitlements/aws/api/entitlements.routes.ts#revokeEntitlement'
  - key: commerce.exceptions.acknowledge
    intent: Acknowledge exceptions.
    operations:
      - acknowledgeOperationalException
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#acknowledgeOperationalException
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-008-work-the-operations-queue.md
      - >-
        services-commerce:modules/operations/aws/api/operations.routes.ts#acknowledgeOperationalException
  - key: commerce.exceptions.read
    intent: Inspect exceptions.
    operations:
      - getOperationalException
      - listOperationalExceptions
      - summarizeOperationalExceptions
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#getOperationalException
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#listOperationalExceptions
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#summarizeOperationalExceptions
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-008-work-the-operations-queue.md
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#listOperationalExceptions'
      - >-
        services-commerce:modules/operations/aws/api/operations.routes.ts#summarizeOperationalExceptions
      - 'services-commerce:modules/operations/aws/api/operations.routes.ts#getOperationalException'
  - key: commerce.exceptions.resolve
    intent: Resolve failed work for exceptions.
    operations:
      - resolveOperationalException
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#resolveOperationalException
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-008-work-the-operations-queue.md
      - >-
        services-commerce:modules/operations/aws/api/operations.routes.ts#resolveOperationalException
  - key: commerce.fulfillment-policies.apply
    intent: Apply a policy retroactively to fulfillment policies.
    operations:
      - applyFulfillmentPolicy
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-001-07
      - BR-CAP-COM-FUL-001-08
      - BR-CAP-COM-FUL-001-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#applyFulfillmentPolicy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-001-decide-when-each-sold-line-may-be-delivered.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#applyFulfillmentPolicy'
  - key: commerce.fulfillment-policies.create
    intent: Create fulfillment policies.
    operations:
      - createFulfillmentPolicy
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-001-07
      - BR-CAP-COM-FUL-001-08
      - BR-CAP-COM-FUL-001-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#createFulfillmentPolicy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-001-decide-when-each-sold-line-may-be-delivered.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#createFulfillmentPolicy'
  - key: commerce.fulfillment-policies.delete
    intent: Remove fulfillment policies.
    operations:
      - deleteFulfillmentPolicy
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-001-07
      - BR-CAP-COM-FUL-001-08
      - BR-CAP-COM-FUL-001-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#deleteFulfillmentPolicy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-001-decide-when-each-sold-line-may-be-delivered.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#deleteFulfillmentPolicy'
  - key: commerce.fulfillment-policies.read
    intent: Inspect fulfillment policies.
    operations:
      - getEffectiveFulfillmentPolicy
      - getFulfillmentPolicy
      - listFulfillmentPolicies
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-001-07
      - BR-CAP-COM-FUL-001-08
      - BR-CAP-COM-FUL-001-09
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#getEffectiveFulfillmentPolicy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#getFulfillmentPolicy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#listFulfillmentPolicies
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-001-decide-when-each-sold-line-may-be-delivered.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#listFulfillmentPolicies'
      - >-
        services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#getEffectiveFulfillmentPolicy
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#getFulfillmentPolicy'
  - key: commerce.fulfillment-policies.update
    intent: Change fulfillment policies.
    operations:
      - updateFulfillmentPolicy
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-001-07
      - BR-CAP-COM-FUL-001-08
      - BR-CAP-COM-FUL-001-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#updateFulfillmentPolicy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-001-decide-when-each-sold-line-may-be-delivered.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#updateFulfillmentPolicy'
  - key: commerce.inventory-costing.bulk
    intent: Load records in bulk for inventory costing.
    operations: []
    surfaces:
      - api
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-018-receive-stock-and-keep-what-it-cost.md
  - key: commerce.inventory-costing.create
    intent: Create inventory costing.
    operations: []
    surfaces:
      - api
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-018-receive-stock-and-keep-what-it-cost.md
  - key: commerce.inventory-costing.delete
    intent: Remove inventory costing.
    operations: []
    surfaces:
      - api
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-018-receive-stock-and-keep-what-it-cost.md
  - key: commerce.inventory-costing.read
    intent: Inspect inventory costing.
    operations:
      - getBusinessUnitSettings
      - getCostRelief
      - getInventoryCostLayer
      - getInventoryPosting
      - listCostRelief
      - listInventoryCostLayers
      - listInventoryPostings
      - readInventoryValuation
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getBusinessUnitSettings
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getCostRelief
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getInventoryCostLayer
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getInventoryPosting
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#listCostRelief
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#listInventoryCostLayers
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#listInventoryPostings
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#readInventoryValuation
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-018-receive-stock-and-keep-what-it-cost.md
  - key: commerce.inventory-costing.update
    intent: Change inventory costing.
    operations:
      - correctInventoryCostLayer
      - putBusinessUnitSettings
      - stampInventoryPostingsPosted
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#correctInventoryCostLayer
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#putBusinessUnitSettings
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#stampInventoryPostingsPosted
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-018-receive-stock-and-keep-what-it-cost.md
  - key: commerce.inventory.bulk
    intent: Load records in bulk for inventory.
    operations:
      - applyInventoryItemDataJob
      - applyInventoryLocationDataJob
      - applyWarehouseDataJob
      - cancelInventoryItemDataJob
      - cancelInventoryLocationDataJob
      - cancelWarehouseDataJob
      - getInventoryItemDataJob
      - getInventoryLocationDataJob
      - getWarehouseDataJob
      - listInventoryItemDataJobRejections
      - listInventoryItemDataJobResults
      - listInventoryItemDataJobs
      - listInventoryLocationDataJobRejections
      - listInventoryLocationDataJobResults
      - listInventoryLocationDataJobs
      - listWarehouseDataJobRejections
      - listWarehouseDataJobResults
      - listWarehouseDataJobs
      - pauseInventoryItemDataJob
      - pauseInventoryLocationDataJob
      - pauseWarehouseDataJob
      - readInventoryItemsBySourceKey
      - readInventoryLocationsBySourceKey
      - readWarehousesBySourceKey
      - resumeInventoryItemDataJob
      - resumeInventoryLocationDataJob
      - resumeWarehouseDataJob
      - retryInventoryItemDataJob
      - retryInventoryLocationDataJob
      - retryWarehouseDataJob
      - submitInventoryItemDataJob
      - submitInventoryLocationDataJob
      - submitWarehouseDataJob
    surfaces:
      - api
      - console
      - job
    guarded_by:
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readInventoryItemsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readInventoryLocationsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readWarehousesBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-020-load-a-workspace-s-rhythm-1-0-commerce-records-and-check.md
  - key: commerce.inventory.create
    intent: Create inventory.
    operations:
      - createInventoryLocation
      - createWarehouse
      - openInventoryCount
      - recordInventoryMovement
      - transferInventory
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#createInventoryLocation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#createWarehouse
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#openInventoryCount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#recordInventoryMovement
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#transferInventory
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-016-keep-warehouses-and-stock-locations.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-017-record-stock-that-comes-in-moves-and-goes-out.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-019-count-shelves-and-investigate-stock-findings.md
  - key: commerce.inventory.delete
    intent: Remove inventory.
    operations:
      - deleteInventoryLocation
      - deleteWarehouse
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#deleteInventoryLocation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#deleteWarehouse
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-016-keep-warehouses-and-stock-locations.md
  - key: commerce.inventory.read
    intent: Inspect inventory.
    operations:
      - getInventoryAllocation
      - getInventoryCount
      - getInventoryException
      - getInventoryItem
      - getInventoryLocation
      - getInventoryMovement
      - getWarehouse
      - listInventoryAllocations
      - listInventoryCounts
      - listInventoryExceptions
      - listInventoryItems
      - listInventoryLocations
      - listInventoryMovements
      - listInventoryTransfers
      - listWarehouses
      - readSkuAvailability
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getInventoryAllocation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getInventoryCount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getInventoryException
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getInventoryItem
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getInventoryLocation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getInventoryMovement
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getWarehouse
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listInventoryAllocations
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listInventoryCounts
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listInventoryExceptions
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listInventoryItems
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listInventoryLocations
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listInventoryMovements
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listInventoryTransfers
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#listWarehouses
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#readSkuAvailability
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-016-keep-warehouses-and-stock-locations.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-017-record-stock-that-comes-in-moves-and-goes-out.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-018-reserve-and-commit-stock-for-buyers-and-say-what-is.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-019-count-shelves-and-investigate-stock-findings.md
  - key: commerce.inventory.update
    intent: Change inventory.
    operations:
      - acknowledgeInventoryException
      - applyInventoryItemDataJob
      - applyInventoryLocationDataJob
      - applyWarehouseDataJob
      - cancelInventoryCount
      - cancelInventoryItemDataJob
      - cancelInventoryLocationDataJob
      - cancelWarehouseDataJob
      - completeInventoryCount
      - getInventoryItemDataJob
      - getInventoryLocationDataJob
      - getWarehouseDataJob
      - listInventoryItemDataJobRejections
      - listInventoryItemDataJobResults
      - listInventoryItemDataJobs
      - listInventoryLocationDataJobRejections
      - listInventoryLocationDataJobResults
      - listInventoryLocationDataJobs
      - listWarehouseDataJobRejections
      - listWarehouseDataJobResults
      - listWarehouseDataJobs
      - pauseInventoryItemDataJob
      - pauseInventoryLocationDataJob
      - pauseWarehouseDataJob
      - readInventoryItemsBySourceKey
      - readInventoryLocationsBySourceKey
      - readWarehousesBySourceKey
      - recordInventoryCountLines
      - resolveInventoryException
      - resumeInventoryItemDataJob
      - resumeInventoryLocationDataJob
      - resumeWarehouseDataJob
      - retryInventoryItemDataJob
      - retryInventoryLocationDataJob
      - retryWarehouseDataJob
      - submitInventoryItemDataJob
      - submitInventoryLocationDataJob
      - submitWarehouseDataJob
      - updateInventoryItemSettings
      - updateInventoryLocation
      - updateWarehouse
    surfaces:
      - api
      - console
      - job
    guarded_by:
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readInventoryItemsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readInventoryLocationsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readWarehousesBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitInventoryItemDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitInventoryLocationDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitWarehouseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#acknowledgeInventoryException
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#cancelInventoryCount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#completeInventoryCount
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#recordInventoryCountLines
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#resolveInventoryException
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#updateInventoryItemSettings
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#updateInventoryLocation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#updateWarehouse
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-016-keep-warehouses-and-stock-locations.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-017-record-stock-that-comes-in-moves-and-goes-out.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-019-count-shelves-and-investigate-stock-findings.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-020-load-a-workspace-s-rhythm-1-0-commerce-records-and-check.md
  - key: commerce.merchandise.bulk
    intent: Load records in bulk for merchandise.
    operations:
      - applyMerchandiseDataJob
      - applyMerchandiseOptionSetDataJob
      - cancelMerchandiseDataJob
      - cancelMerchandiseOptionSetDataJob
      - getMerchandiseDataJob
      - getMerchandiseOptionSetDataJob
      - listMerchandiseDataJobRejections
      - listMerchandiseDataJobResults
      - listMerchandiseDataJobs
      - listMerchandiseOptionSetDataJobRejections
      - listMerchandiseOptionSetDataJobResults
      - listMerchandiseOptionSetDataJobs
      - pauseMerchandiseDataJob
      - pauseMerchandiseOptionSetDataJob
      - readMerchandiseOptionSetsBySourceKey
      - readMerchandisesBySourceKey
      - resumeMerchandiseDataJob
      - resumeMerchandiseOptionSetDataJob
      - retryMerchandiseDataJob
      - retryMerchandiseOptionSetDataJob
      - submitMerchandiseDataJob
      - submitMerchandiseOptionSetDataJob
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-007-14
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-007-describe-merchandise-its-variants-and-whether-it-can-be-sold.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readMerchandiseOptionSetsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readMerchandisesBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitMerchandiseOptionSetDataJob
  - key: commerce.merchandise.create
    intent: Create merchandise.
    operations:
      - createMerchandise
      - createMerchandiseOptionSet
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-007-14
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#createMerchandise
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#createMerchandiseOptionSet
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-007-describe-merchandise-its-variants-and-whether-it-can-be-sold.md
      - 'services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#createMerchandise'
      - >-
        services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#createMerchandiseOptionSet
  - key: commerce.merchandise.delete
    intent: Remove merchandise.
    operations:
      - deleteMerchandise
      - deleteMerchandiseOptionSet
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-007-14
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#deleteMerchandise
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#deleteMerchandiseOptionSet
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-007-describe-merchandise-its-variants-and-whether-it-can-be-sold.md
      - 'services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#deleteMerchandise'
      - >-
        services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#deleteMerchandiseOptionSet
  - key: commerce.merchandise.read
    intent: Inspect merchandise.
    operations:
      - getMerchandise
      - getMerchandiseOptionSet
      - listMerchandise
      - listMerchandiseOptionSets
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-007-14
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#getMerchandise
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#getMerchandiseOptionSet
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#listMerchandise
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#listMerchandiseOptionSets
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-007-describe-merchandise-its-variants-and-whether-it-can-be-sold.md
      - 'services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#listMerchandise'
      - 'services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#getMerchandise'
      - >-
        services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#listMerchandiseOptionSets
      - 'services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#getMerchandiseOptionSet'
  - key: commerce.merchandise.update
    intent: Change merchandise.
    operations:
      - applyMerchandiseDataJob
      - applyMerchandiseOptionSetDataJob
      - cancelMerchandiseDataJob
      - cancelMerchandiseOptionSetDataJob
      - getMerchandiseDataJob
      - getMerchandiseOptionSetDataJob
      - listMerchandiseDataJobRejections
      - listMerchandiseDataJobResults
      - listMerchandiseDataJobs
      - listMerchandiseOptionSetDataJobRejections
      - listMerchandiseOptionSetDataJobResults
      - listMerchandiseOptionSetDataJobs
      - pauseMerchandiseDataJob
      - pauseMerchandiseOptionSetDataJob
      - readMerchandiseOptionSetsBySourceKey
      - readMerchandisesBySourceKey
      - resumeMerchandiseDataJob
      - resumeMerchandiseOptionSetDataJob
      - retireMerchandise
      - retryMerchandiseDataJob
      - retryMerchandiseOptionSetDataJob
      - submitMerchandiseDataJob
      - submitMerchandiseOptionSetDataJob
      - updateMerchandise
      - updateMerchandiseOptionSet
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-007-14
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#retireMerchandise
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#updateMerchandise
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#updateMerchandiseOptionSet
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-007-describe-merchandise-its-variants-and-whether-it-can-be-sold.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readMerchandiseOptionSetsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readMerchandisesBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryMerchandiseOptionSetDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitMerchandiseDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitMerchandiseOptionSetDataJob
      - 'services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#updateMerchandise'
      - 'services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#retireMerchandise'
      - >-
        services-commerce:modules/merchandise/aws/api/merchandise.routes.ts#updateMerchandiseOptionSet
  - key: commerce.obligations.approve
    intent: Approve obligations.
    operations:
      - approveObligation
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-005-02
      - BR-CAP-COM-FUL-005-03
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#approveObligation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#approveObligation'
  - key: commerce.obligations.callback
    intent: Report application delivery outcomes for obligations.
    operations:
      - completeObligation
      - failObligation
      - reportObligationPrerequisite
    surfaces:
      - api
      - job
      - system
    guarded_by:
      - BR-CAP-COM-FUL-004-07
      - BR-CAP-COM-FUL-004-08
    tier: admin
    staff_only: true
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#completeObligation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#failObligation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#reportObligationPrerequisite
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-004-deliver-each-authorized-obligation-through-the-application.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#completeObligation'
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#failObligation'
      - >-
        services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#reportObligationPrerequisite
  - key: commerce.obligations.complete-manually
    intent: Record manual completion for obligations.
    operations:
      - completeObligationManually
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-005-02
      - BR-CAP-COM-FUL-005-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#completeObligationManually
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
      - >-
        services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#completeObligationManually
  - key: commerce.obligations.hold
    intent: Place or release a staff hold for obligations.
    operations:
      - holdObligation
      - releaseObligationHold
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-005-02
      - BR-CAP-COM-FUL-005-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#holdObligation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#releaseObligationHold
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#holdObligation'
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#releaseObligationHold'
  - key: commerce.obligations.override
    intent: Perform a reasoned override for obligations.
    operations:
      - overrideObligationGate
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-005-02
      - BR-CAP-COM-FUL-005-04
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#overrideObligationGate
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#overrideObligationGate'
  - key: commerce.obligations.read
    intent: Inspect obligations.
    operations:
      - getObligation
      - listObligations
    surfaces:
      - api
      - console
      - job
    guarded_by:
      - BR-CAP-COM-FUL-005-01
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#getObligation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#listObligations
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-003-hold-a-line-priced-by-a-same-order-membership-until-the.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#listObligations'
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#getObligation'
  - key: commerce.obligations.reauthorize
    intent: Authorize another attempt for obligations.
    operations:
      - reauthorizeObligation
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-004-07
      - BR-CAP-COM-FUL-004-08
      - BR-CAP-COM-FUL-005-02
      - BR-CAP-COM-FUL-005-05
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#reauthorizeObligation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#reauthorizeObligation'
  - key: commerce.obligations.resolve
    intent: Resolve failed work for obligations.
    operations:
      - resolveObligation
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-FUL-005-02
      - BR-CAP-COM-FUL-005-05
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#resolveObligation
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
      - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts#resolveObligation'
  - key: commerce.offers.read
    intent: Inspect offers.
    operations:
      - evaluateOffers
    surfaces:
      - api
      - portal
    guarded_by:
      - BR-CAP-COM-CAT-020-05
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#evaluateOffers
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-020-offer-suggestions-to-a-buyer-and-record-the-answer.md
      - 'services-commerce:modules/recommendations/aws/api/offers.routes.ts#evaluateOffers'
  - key: commerce.offers.respond
    intent: Respond to offers.
    operations:
      - acceptOffer
      - dismissOffer
    surfaces:
      - api
      - portal
    guarded_by:
      - BR-CAP-COM-CAT-020-05
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#acceptOffer
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#dismissOffer
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-020-offer-suggestions-to-a-buyer-and-record-the-answer.md
      - 'services-commerce:modules/recommendations/aws/api/offers.routes.ts#acceptOffer'
      - 'services-commerce:modules/recommendations/aws/api/offers.routes.ts#dismissOffer'
  - key: commerce.ordering-profiles.bulk
    intent: Load records in bulk for ordering profiles.
    operations:
      - applyOrderingProfileDataJob
      - cancelOrderingProfileDataJob
      - getOrderingProfileDataJob
      - listOrderingProfileDataJobRejections
      - listOrderingProfileDataJobResults
      - listOrderingProfileDataJobs
      - pauseOrderingProfileDataJob
      - readOrderingProfilesBySourceKey
      - resumeOrderingProfileDataJob
      - retryOrderingProfileDataJob
      - submitOrderingProfileDataJob
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-001-16
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-001-define-how-each-kind-of-sale-is-billed-and-paid.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readOrderingProfilesBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitOrderingProfileDataJob
  - key: commerce.ordering-profiles.create
    intent: Create ordering profiles.
    operations:
      - createOrderingProfile
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-001-16
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#createOrderingProfile
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-001-define-how-each-kind-of-sale-is-billed-and-paid.md
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#createOrderingProfile
  - key: commerce.ordering-profiles.delete
    intent: Remove ordering profiles.
    operations:
      - deleteOrderingProfile
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-001-16
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#deleteOrderingProfile
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-001-define-how-each-kind-of-sale-is-billed-and-paid.md
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#deleteOrderingProfile
  - key: commerce.ordering-profiles.read
    intent: Inspect ordering profiles.
    operations:
      - getOrderingProfile
      - getOrderingProfileDefaults
      - getOrderingProfileUsage
      - listOrderingProfiles
      - resolveOrderingProfile
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-001-16
      - BR-CAP-COM-CAT-002-06
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#getOrderingProfile
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#getOrderingProfileDefaults
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#getOrderingProfileUsage
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#listOrderingProfiles
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#resolveOrderingProfile
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-001-define-how-each-kind-of-sale-is-billed-and-paid.md
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-002-decide-which-checkout-policy-a-sale-follows.md
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#listOrderingProfiles
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#resolveOrderingProfile
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#getOrderingProfileDefaults
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#getOrderingProfile
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#getOrderingProfileUsage
  - key: commerce.ordering-profiles.update
    intent: Change ordering profiles.
    operations:
      - applyOrderingProfileDataJob
      - cancelOrderingProfileDataJob
      - getOrderingProfileDataJob
      - listOrderingProfileDataJobRejections
      - listOrderingProfileDataJobResults
      - listOrderingProfileDataJobs
      - pauseOrderingProfileDataJob
      - readOrderingProfilesBySourceKey
      - replaceOrderingProfileDefaults
      - resumeOrderingProfileDataJob
      - retryOrderingProfileDataJob
      - submitOrderingProfileDataJob
      - updateOrderingProfile
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-001-16
      - BR-CAP-COM-CAT-002-06
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#replaceOrderingProfileDefaults
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#updateOrderingProfile
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-001-define-how-each-kind-of-sale-is-billed-and-paid.md
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-002-decide-which-checkout-policy-a-sale-follows.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readOrderingProfilesBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryOrderingProfileDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitOrderingProfileDataJob
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#replaceOrderingProfileDefaults
      - >-
        services-commerce:modules/configuration/aws/api/ordering-profiles.routes.ts#updateOrderingProfile
  - key: commerce.orders.bulk
    intent: Load records in bulk for orders.
    operations:
      - applyOrderDataJob
      - cancelOrderDataJob
      - getOrderDataJob
      - listOrderDataJobRejections
      - listOrderDataJobResults
      - listOrderDataJobs
      - pauseOrderDataJob
      - readOrdersBySourceKey
      - resumeOrderDataJob
      - retryOrderDataJob
      - submitOrderDataJob
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readOrdersBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
  - key: commerce.orders.create
    intent: Create orders.
    operations:
      - addCheckoutItem
      - applyCheckoutPromotionCode
      - applyOrderDataJob
      - cancelOrderDataJob
      - changeCheckoutItem
      - chooseCheckoutInstallmentPlan
      - chooseCheckoutShipping
      - createCheckout
      - getOrderDataJob
      - listOrderDataJobRejections
      - listOrderDataJobResults
      - listOrderDataJobs
      - pauseOrderDataJob
      - placeCheckout
      - previewCheckout
      - readOrdersBySourceKey
      - removeCheckoutPromotionCode
      - requestCheckoutItemHold
      - resumeOrderDataJob
      - retryOrderDataJob
      - submitOrderDataJob
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-CAT-013-07
      - BR-CAP-COM-CAT-013-11
      - BR-CAP-COM-CAT-013-12
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
      - BR-CAP-COM-ORD-001-01
      - BR-CAP-COM-ORD-001-04
      - BR-CAP-COM-ORD-001-05
      - BR-CAP-COM-ORD-002-04
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-013-work-out-what-a-buyer-pays-for-an-item.md
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-016-apply-the-lowest-valid-discount-at-checkout.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readOrdersBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitOrderDataJob
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#addCheckoutItem
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#applyCheckoutPromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#changeCheckoutItem
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#chooseCheckoutInstallmentPlan
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#chooseCheckoutShipping
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#createCheckout'
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#placeCheckout'
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#previewCheckout
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#removeCheckoutPromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#requestCheckoutItemHold
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-001-open-a-cart-for-a-buyer-and-fill-it-with-what-they-want.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-005-place-the-order-once-at-the-price-the-buyer-saw.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-006-bill-the-order-through-accounting.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
      - 'services-commerce:modules/checkout/aws/api/checkouts.routes.ts#placeCheckout'
  - key: commerce.orders.delete
    intent: Remove orders.
    operations: []
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
  - key: commerce.orders.read
    intent: Inspect orders.
    operations:
      - getOrder
      - getOrderInstallmentSchedule
      - listOrders
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
      - BR-CAP-COM-ORD-007-03
      - BR-CAP-COM-ORD-007-08
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#getOrder'
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#getOrderInstallmentSchedule
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#listOrders'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-007-take-payment-on-an-order.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-009-spread-a-purchase-over-a-deposit-and-installments.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-010-find-an-order-and-see-where-it-stands.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
      - 'services-commerce:modules/orders/aws/api/orders.routes.ts#listOrders'
      - 'services-commerce:modules/orders/aws/api/orders.routes.ts#getOrder'
      - 'services-commerce:modules/orders/aws/api/orders.routes.ts#getOrderInstallmentSchedule'
  - key: commerce.orders.tender
    intent: Collect payment for orders.
    operations:
      - tenderOrder
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-007-03
      - BR-CAP-COM-ORD-007-08
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#tenderOrder'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-006-bill-the-order-through-accounting.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-007-take-payment-on-an-order.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-009-spread-a-purchase-over-a-deposit-and-installments.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
      - 'services-commerce:modules/orders/aws/api/tenders.routes.ts#tenderOrder'
  - key: commerce.orders.update
    intent: Change orders.
    operations: []
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
  - key: commerce.orders.void
    intent: Void orders.
    operations:
      - voidOrder
    surfaces:
      - api
      - console
      - job
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-011-03
      - BR-CAP-COM-ORD-011-04
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#voidOrder'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-008-void-an-unpaid-order-and-give-back-what-it-held.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-011-keep-carts-and-orders-within-the-workspace-and-the-people.md
      - 'services-commerce:modules/orders/aws/api/orders.routes.ts#voidOrder'
  - key: commerce.pick-lists.create
    intent: Create pick lists.
    operations:
      - createPickList
    surfaces:
      - api
      - console
    guarded_by: []
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#createPickList
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
  - key: commerce.pick-lists.read
    intent: Inspect pick lists.
    operations:
      - getPickList
      - listPickLists
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#getPickList
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listPickLists
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
  - key: commerce.pick-lists.update
    intent: Change pick lists.
    operations:
      - cancelPickList
      - claimPickList
      - completePickList
      - pickPickListLine
    surfaces:
      - api
      - console
    guarded_by: []
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#cancelPickList
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#claimPickList
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#completePickList
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#pickPickListLine
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
  - key: commerce.price-quotes.read
    intent: Inspect price quotes.
    operations:
      - createPriceQuote
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-CAT-013-07
      - BR-CAP-COM-CAT-013-11
      - BR-CAP-COM-CAT-013-12
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#createPriceQuote
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-013-work-out-what-a-buyer-pays-for-an-item.md
      - 'services-commerce:modules/pricing/aws/api/price-quotes.routes.ts#createPriceQuote'
  - key: commerce.pricing-audiences.bulk
    intent: Load records in bulk for pricing audiences.
    operations: []
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-010-12
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-010-define-the-groups-of-buyers-that-get-their-own-price.md
  - key: commerce.pricing-audiences.create
    intent: Create pricing audiences.
    operations:
      - createPricingAudience
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-010-12
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#createPricingAudience
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-010-define-the-groups-of-buyers-that-get-their-own-price.md
      - 'services-commerce:modules/pricing/aws/api/pricing-audiences.routes.ts#createPricingAudience'
  - key: commerce.pricing-audiences.delete
    intent: Remove pricing audiences.
    operations:
      - deletePricingAudience
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-010-12
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#deletePricingAudience
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-010-define-the-groups-of-buyers-that-get-their-own-price.md
      - 'services-commerce:modules/pricing/aws/api/pricing-audiences.routes.ts#deletePricingAudience'
  - key: commerce.pricing-audiences.read
    intent: Inspect pricing audiences.
    operations:
      - getPricingAudience
      - listPricingAudiences
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-010-12
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#getPricingAudience
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#listPricingAudiences
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-010-define-the-groups-of-buyers-that-get-their-own-price.md
      - 'services-commerce:modules/pricing/aws/api/pricing-audiences.routes.ts#listPricingAudiences'
      - 'services-commerce:modules/pricing/aws/api/pricing-audiences.routes.ts#getPricingAudience'
  - key: commerce.pricing-audiences.update
    intent: Change pricing audiences.
    operations:
      - updatePricingAudience
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-010-12
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#updatePricingAudience
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-010-define-the-groups-of-buyers-that-get-their-own-price.md
      - 'services-commerce:modules/pricing/aws/api/pricing-audiences.routes.ts#updatePricingAudience'
  - key: commerce.pricing-schedules.bulk
    intent: Load records in bulk for pricing schedules.
    operations: []
    surfaces:
      - api
    guarded_by:
      - BR-CAP-COM-CAT-011-11
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-011-vary-prices-over-dated-periods.md
  - key: commerce.pricing-schedules.create
    intent: Create pricing schedules.
    operations:
      - createPricingSchedule
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-011-11
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#createPricingSchedule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-011-vary-prices-over-dated-periods.md
      - 'services-commerce:modules/pricing/aws/api/pricing-schedules.routes.ts#createPricingSchedule'
  - key: commerce.pricing-schedules.delete
    intent: Remove pricing schedules.
    operations:
      - deletePricingSchedule
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-011-11
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#deletePricingSchedule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-011-vary-prices-over-dated-periods.md
      - 'services-commerce:modules/pricing/aws/api/pricing-schedules.routes.ts#deletePricingSchedule'
  - key: commerce.pricing-schedules.read
    intent: Inspect pricing schedules.
    operations:
      - getPricingSchedule
      - listPricingSchedules
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-011-11
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#getPricingSchedule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#listPricingSchedules
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-011-vary-prices-over-dated-periods.md
      - 'services-commerce:modules/pricing/aws/api/pricing-schedules.routes.ts#listPricingSchedules'
      - 'services-commerce:modules/pricing/aws/api/pricing-schedules.routes.ts#getPricingSchedule'
  - key: commerce.pricing-schedules.update
    intent: Change pricing schedules.
    operations:
      - updatePricingSchedule
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-011-11
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#updatePricingSchedule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-011-vary-prices-over-dated-periods.md
      - 'services-commerce:modules/pricing/aws/api/pricing-schedules.routes.ts#updatePricingSchedule'
  - key: commerce.product-categories.bulk
    intent: Load records in bulk for product categories.
    operations:
      - applyProductCategoryDataJob
      - cancelProductCategoryDataJob
      - getProductCategoryDataJob
      - listProductCategoryDataJobRejections
      - listProductCategoryDataJobResults
      - listProductCategoryDataJobs
      - pauseProductCategoryDataJob
      - readProductCategorysBySourceKey
      - resumeProductCategoryDataJob
      - retryProductCategoryDataJob
      - submitProductCategoryDataJob
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-005-10
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-005-arrange-products-onto-shelves.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readProductCategorysBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitProductCategoryDataJob
  - key: commerce.product-categories.create
    intent: Create product categories.
    operations:
      - createProductCategory
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-005-10
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#createProductCategory
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-005-arrange-products-onto-shelves.md
      - 'services-commerce:modules/catalog/aws/api/product-categories.routes.ts#createProductCategory'
  - key: commerce.product-categories.delete
    intent: Remove product categories.
    operations:
      - deleteProductCategory
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-005-10
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#deleteProductCategory
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-005-arrange-products-onto-shelves.md
      - 'services-commerce:modules/catalog/aws/api/product-categories.routes.ts#deleteProductCategory'
  - key: commerce.product-categories.read
    intent: Inspect product categories.
    operations:
      - getProductCategory
      - listCategoryProducts
      - listProductCategories
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-005-10
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#getProductCategory
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#listCategoryProducts
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#listProductCategories
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-005-arrange-products-onto-shelves.md
      - 'services-commerce:modules/catalog/aws/api/product-categories.routes.ts#listProductCategories'
      - 'services-commerce:modules/catalog/aws/api/product-categories.routes.ts#getProductCategory'
      - 'services-commerce:modules/catalog/aws/api/product-categories.routes.ts#listCategoryProducts'
  - key: commerce.product-categories.update
    intent: Change product categories.
    operations:
      - applyProductCategoryDataJob
      - cancelProductCategoryDataJob
      - getProductCategoryDataJob
      - listProductCategoryDataJobRejections
      - listProductCategoryDataJobResults
      - listProductCategoryDataJobs
      - pauseProductCategoryDataJob
      - readProductCategorysBySourceKey
      - replaceCategoryProducts
      - resumeProductCategoryDataJob
      - retryProductCategoryDataJob
      - submitProductCategoryDataJob
      - updateProductCategory
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-005-10
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#replaceCategoryProducts
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#updateProductCategory
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-005-arrange-products-onto-shelves.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readProductCategorysBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryProductCategoryDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitProductCategoryDataJob
      - 'services-commerce:modules/catalog/aws/api/product-categories.routes.ts#updateProductCategory'
      - >-
        services-commerce:modules/catalog/aws/api/product-categories.routes.ts#replaceCategoryProducts
  - key: commerce.product-extensions.bulk
    intent: Load records in bulk for product extensions.
    operations: []
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
  - key: commerce.product-extensions.create
    intent: Create product extensions.
    operations: []
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
  - key: commerce.product-extensions.delete
    intent: Remove product extensions.
    operations:
      - deleteProductExtension
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#deleteProductExtension
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
      - >-
        services-commerce:modules/pricing/aws/api/product-extensions.routes.ts#deleteProductExtension
  - key: commerce.product-extensions.read
    intent: Inspect product extensions.
    operations:
      - getProductExtension
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#getProductExtension
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
      - 'services-commerce:modules/pricing/aws/api/product-extensions.routes.ts#getProductExtension'
  - key: commerce.product-extensions.update
    intent: Change product extensions.
    operations:
      - setProductExtension
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#setProductExtension
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
      - 'services-commerce:modules/pricing/aws/api/product-extensions.routes.ts#setProductExtension'
  - key: commerce.product-listings.bulk
    intent: Load records in bulk for product listings.
    operations:
      - applyProductListingDataJob
      - cancelProductListingDataJob
      - getProductListingDataJob
      - listProductListingDataJobRejections
      - listProductListingDataJobResults
      - listProductListingDataJobs
      - pauseProductListingDataJob
      - readProductListingsBySourceKey
      - resumeProductListingDataJob
      - retryProductListingDataJob
      - submitProductListingDataJob
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-006-13
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-006-present-a-product-in-the-store-and-publish-it.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readProductListingsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitProductListingDataJob
  - key: commerce.product-listings.create
    intent: Create product listings.
    operations:
      - createProductListing
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-006-13
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#createProductListing
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-006-present-a-product-in-the-store-and-publish-it.md
      - 'services-commerce:modules/catalog/aws/api/product-listings.routes.ts#createProductListing'
  - key: commerce.product-listings.delete
    intent: Remove product listings.
    operations:
      - deleteProductListing
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-006-13
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#deleteProductListing
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-006-present-a-product-in-the-store-and-publish-it.md
      - 'services-commerce:modules/catalog/aws/api/product-listings.routes.ts#deleteProductListing'
  - key: commerce.product-listings.read
    intent: Inspect product listings.
    operations:
      - getProductListing
      - listProductListings
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-006-13
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#getProductListing
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#listProductListings
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-006-present-a-product-in-the-store-and-publish-it.md
      - 'services-commerce:modules/catalog/aws/api/product-listings.routes.ts#listProductListings'
      - 'services-commerce:modules/catalog/aws/api/product-listings.routes.ts#getProductListing'
  - key: commerce.product-listings.update
    intent: Change product listings.
    operations:
      - applyProductListingDataJob
      - cancelProductListingDataJob
      - getProductListingDataJob
      - listProductListingDataJobRejections
      - listProductListingDataJobResults
      - listProductListingDataJobs
      - pauseProductListingDataJob
      - readProductListingsBySourceKey
      - resumeProductListingDataJob
      - retryProductListingDataJob
      - submitProductListingDataJob
      - updateProductListing
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-006-13
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#updateProductListing
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-006-present-a-product-in-the-store-and-publish-it.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readProductListingsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryProductListingDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitProductListingDataJob
      - 'services-commerce:modules/catalog/aws/api/product-listings.routes.ts#updateProductListing'
  - key: commerce.product-purchasing-settings.bulk
    intent: Load records in bulk for product purchasing settings.
    operations: []
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
  - key: commerce.product-purchasing-settings.create
    intent: Create product purchasing settings.
    operations: []
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
  - key: commerce.product-purchasing-settings.delete
    intent: Remove product purchasing settings.
    operations: []
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
  - key: commerce.product-purchasing-settings.read
    intent: Inspect product purchasing settings.
    operations:
      - getProductPurchasingSettings
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#getProductPurchasingSettings
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
      - >-
        services-commerce:modules/pricing/aws/api/product-purchasing-settings.routes.ts#getProductPurchasingSettings
  - key: commerce.product-purchasing-settings.update
    intent: Change product purchasing settings.
    operations:
      - setProductPurchasingSettings
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#setProductPurchasingSettings
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-012-set-how-a-product-is-priced-and-bought.md
      - >-
        services-commerce:modules/pricing/aws/api/product-purchasing-settings.routes.ts#setProductPurchasingSettings
  - key: commerce.promotions.activate
    intent: Launch promotions.
    operations:
      - activatePromotion
      - resumePromotion
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-014-09
      - BR-CAP-COM-CAT-014-12
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#activatePromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#resumePromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-014-create-a-promotion-and-take-it-through-its-life.md
  - key: commerce.promotions.manage
    intent: Prepare and maintain promotions.
    operations:
      - applyPromotionDataJob
      - applyPromotionRedemptionDataJob
      - archivePromotion
      - cancelPromotionDataJob
      - cancelPromotionRedemptionDataJob
      - createPromotion
      - createPromotionCode
      - createPromotionCodeIssuance
      - disablePromotionCode
      - duplicatePromotion
      - enablePromotionCode
      - endPromotion
      - getPromotionDataJob
      - getPromotionRedemptionDataJob
      - listPromotionDataJobRejections
      - listPromotionDataJobResults
      - listPromotionDataJobs
      - listPromotionRedemptionDataJobRejections
      - listPromotionRedemptionDataJobResults
      - listPromotionRedemptionDataJobs
      - pausePromotion
      - pausePromotionDataJob
      - pausePromotionRedemptionDataJob
      - readPromotionRedemptionsBySourceKey
      - readPromotionsBySourceKey
      - resumePromotionDataJob
      - resumePromotionRedemptionDataJob
      - retryPromotionDataJob
      - retryPromotionRedemptionDataJob
      - revokePromotionCode
      - submitPromotionDataJob
      - submitPromotionRedemptionDataJob
      - updatePromotion
      - updatePromotionCode
    surfaces:
      - api
      - console
      - job
    guarded_by:
      - BR-CAP-COM-CAT-014-09
      - BR-CAP-COM-CAT-014-12
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#archivePromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#createPromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#createPromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#createPromotionCodeIssuance
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#disablePromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#duplicatePromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#enablePromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#endPromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#pausePromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#revokePromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#updatePromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#updatePromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-014-create-a-promotion-and-take-it-through-its-life.md
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-015-give-out-codes-and-say-who-may-use-them.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyPromotionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyPromotionRedemptionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelPromotionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelPromotionRedemptionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getPromotionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getPromotionRedemptionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listPromotionDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listPromotionDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listPromotionDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listPromotionRedemptionDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listPromotionRedemptionDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listPromotionRedemptionDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pausePromotionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pausePromotionRedemptionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readPromotionRedemptionsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readPromotionsBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumePromotionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumePromotionRedemptionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryPromotionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryPromotionRedemptionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitPromotionDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitPromotionRedemptionDataJob
      - >-
        services-commerce:modules/promotions/aws/api/promotion-code-issuances.routes.ts#createPromotionCodeIssuance
      - 'services-commerce:modules/promotions/aws/api/promotion-codes.routes.ts#updatePromotionCode'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#createPromotion'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#updatePromotion'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#duplicatePromotion'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#createPromotionCode'
  - key: commerce.promotions.override
    intent: Perform a reasoned override for promotions.
    operations:
      - releasePromotionRedemption
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-017-04
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#releasePromotionRedemption
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-017-track-release-and-measure-promotion-uses.md
      - >-
        services-commerce:modules/promotions/aws/api/promotion-redemptions.routes.ts#releasePromotionRedemption
  - key: commerce.promotions.read
    intent: Inspect promotions.
    operations:
      - exportPromotionCodeIssuanceCodes
      - getPromotion
      - getPromotionCode
      - getPromotionCodeIssuance
      - listAllPromotionCodes
      - listOrderPromotionRedemptions
      - listPromotionAreas
      - listPromotionCodeRedemptions
      - listPromotionCodes
      - listPromotionHistory
      - listPromotionRedemptions
      - listPromotions
      - previewPromotions
      - readPromotionPerformance
    surfaces:
      - api
      - console
      - job
    guarded_by:
      - BR-CAP-COM-CAT-014-09
      - BR-CAP-COM-CAT-014-12
      - BR-CAP-COM-CAT-017-04
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#exportPromotionCodeIssuanceCodes
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#getPromotion
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#getPromotionCode
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#getPromotionCodeIssuance
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listAllPromotionCodes
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listOrderPromotionRedemptions
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listPromotionAreas
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listPromotionCodeRedemptions
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listPromotionCodes
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listPromotionHistory
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listPromotionRedemptions
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#listPromotions
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#previewPromotions
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#readPromotionPerformance
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-014-create-a-promotion-and-take-it-through-its-life.md
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-015-give-out-codes-and-say-who-may-use-them.md
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-017-track-release-and-measure-promotion-uses.md
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-018-try-promotions-on-a-sample-cart-before-they-go-live.md
      - 'services-commerce:modules/promotions/aws/api/promotion-areas.routes.ts#listPromotionAreas'
      - >-
        services-commerce:modules/promotions/aws/api/promotion-code-issuances.routes.ts#getPromotionCodeIssuance
      - >-
        services-commerce:modules/promotions/aws/api/promotion-code-issuances.routes.ts#exportPromotionCodeIssuanceCodes
      - 'services-commerce:modules/promotions/aws/api/promotion-codes.routes.ts#listAllPromotionCodes'
      - >-
        services-commerce:modules/promotions/aws/api/promotion-codes.routes.ts#listPromotionCodeRedemptions
      - 'services-commerce:modules/promotions/aws/api/promotion-codes.routes.ts#getPromotionCode'
      - 'services-commerce:modules/promotions/aws/api/promotion-previews.routes.ts#previewPromotions'
      - >-
        services-commerce:modules/promotions/aws/api/promotion-redemptions.routes.ts#listOrderPromotionRedemptions
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#listPromotions'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#getPromotion'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#listPromotionCodes'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#listPromotionRedemptions'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#readPromotionPerformance'
      - 'services-commerce:modules/promotions/aws/api/promotions.routes.ts#listPromotionHistory'
  - key: commerce.purchasing.bulk
    intent: Load records in bulk for purchasing.
    operations: []
    surfaces:
      - api
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-017-buy-stock-from-vendors-on-purchase-orders.md
  - key: commerce.purchasing.create
    intent: Create purchasing.
    operations:
      - createPurchaseOrder
      - createVendor
      - recordInventoryReceipt
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#createPurchaseOrder
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#createVendor'
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#recordInventoryReceipt
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-017-buy-stock-from-vendors-on-purchase-orders.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-018-receive-stock-and-keep-what-it-cost.md
  - key: commerce.purchasing.delete
    intent: Remove purchasing.
    operations:
      - deleteVendor
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#deleteVendor'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-017-buy-stock-from-vendors-on-purchase-orders.md
  - key: commerce.purchasing.read
    intent: Inspect purchasing.
    operations:
      - getInventoryReceipt
      - getPurchaseOrder
      - getVendor
      - listInventoryReceipts
      - listPurchaseOrders
      - listVendors
    surfaces:
      - api
      - console
      - job
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getInventoryReceipt
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getPurchaseOrder
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getVendor'
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#listInventoryReceipts
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#listPurchaseOrders
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#listVendors'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-017-buy-stock-from-vendors-on-purchase-orders.md
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-018-receive-stock-and-keep-what-it-cost.md
  - key: commerce.purchasing.update
    intent: Change purchasing.
    operations:
      - cancelPurchaseOrder
      - cancelPurchaseOrderLineQuantity
      - closePurchaseOrder
      - issuePurchaseOrder
      - updatePurchaseOrder
      - updateVendor
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#cancelPurchaseOrder
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#cancelPurchaseOrderLineQuantity
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#closePurchaseOrder
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#issuePurchaseOrder
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#updatePurchaseOrder
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#updateVendor'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-017-buy-stock-from-vendors-on-purchase-orders.md
  - key: commerce.recommendation-journeys.bulk
    intent: Load records in bulk for recommendation journeys.
    operations: []
    surfaces:
      - api
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
  - key: commerce.recommendation-journeys.create
    intent: Create recommendation journeys.
    operations:
      - createRecommendationJourney
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#createRecommendationJourney
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-registry.routes.ts#createRecommendationJourney
  - key: commerce.recommendation-journeys.delete
    intent: Remove recommendation journeys.
    operations:
      - deleteRecommendationJourney
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#deleteRecommendationJourney
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-registry.routes.ts#deleteRecommendationJourney
  - key: commerce.recommendation-journeys.read
    intent: Inspect recommendation journeys.
    operations:
      - getRecommendationJourney
      - listRecommendationJourneys
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#getRecommendationJourney
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#listRecommendationJourneys
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-registry.routes.ts#listRecommendationJourneys
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-registry.routes.ts#getRecommendationJourney
  - key: commerce.recommendation-journeys.update
    intent: Change recommendation journeys.
    operations:
      - updateRecommendationJourney
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#updateRecommendationJourney
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-registry.routes.ts#updateRecommendationJourney
  - key: commerce.recommendation-placements.read
    intent: Inspect recommendation placements.
    operations:
      - getRecommendationPlacement
      - listRecommendationPlacements
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#getRecommendationPlacement
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#listRecommendationPlacements
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-registry.routes.ts#listRecommendationPlacements
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-registry.routes.ts#getRecommendationPlacement
  - key: commerce.recommendation-rules.activate
    intent: Launch recommendation rules.
    operations:
      - activateRecommendationRule
      - resumeRecommendationRule
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#activateRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#resumeRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
  - key: commerce.recommendation-rules.bulk
    intent: Load records in bulk for recommendation rules.
    operations: []
    surfaces:
      - api
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
  - key: commerce.recommendation-rules.create
    intent: Create recommendation rules.
    operations:
      - createRecommendationRule
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#createRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-rules.routes.ts#createRecommendationRule
  - key: commerce.recommendation-rules.delete
    intent: Remove recommendation rules.
    operations: []
    surfaces:
      - api
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
  - key: commerce.recommendation-rules.read
    intent: Inspect recommendation rules.
    operations:
      - getRecommendationRule
      - getRecommendationRulePerformance
      - listRecommendationRules
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#getRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#getRecommendationRulePerformance
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#listRecommendationRules
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-rules.routes.ts#listRecommendationRules
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-rules.routes.ts#getRecommendationRule
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-rules.routes.ts#getRecommendationRulePerformance
  - key: commerce.recommendation-rules.update
    intent: Change recommendation rules.
    operations:
      - archiveRecommendationRule
      - endRecommendationRule
      - pauseRecommendationRule
      - updateRecommendationRule
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-019-06
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#archiveRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#endRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#pauseRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#updateRecommendationRule
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-019-configure-what-is-recommended-where.md
      - >-
        services-commerce:modules/recommendations/aws/api/recommendation-rules.routes.ts#updateRecommendationRule
  - key: commerce.return-policies.bulk
    intent: Load records in bulk for return policies.
    operations: []
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
  - key: commerce.return-policies.create
    intent: Create return policies.
    operations:
      - createReturnPolicy
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#createReturnPolicy
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#createReturnPolicy'
  - key: commerce.return-policies.delete
    intent: Remove return policies.
    operations:
      - deleteReturnPolicy
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#deleteReturnPolicy
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#deleteReturnPolicy'
  - key: commerce.return-policies.read
    intent: Inspect return policies.
    operations:
      - getReturnPolicy
      - listReturnPolicies
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#getReturnPolicy'
      - >-
        rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#listReturnPolicies
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#listReturnPolicies'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#getReturnPolicy'
  - key: commerce.return-policies.update
    intent: Change return policies.
    operations: []
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
  - key: commerce.return-receipts.create
    intent: Create return receipts.
    operations:
      - receiveReturn
    surfaces:
      - api
      - console
    guarded_by: []
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#receiveReturn
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-015-receive-inspect-and-disposition-returned-goods.md
  - key: commerce.return-receipts.read
    intent: Inspect return receipts.
    operations:
      - getReturnReceipt
      - listReturnReceipts
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#getReturnReceipt
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listReturnReceipts
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-015-receive-inspect-and-disposition-returned-goods.md
  - key: commerce.return-receipts.update
    intent: Change return receipts.
    operations:
      - dispositionReturnReceipt
      - inspectReturnReceipt
    surfaces:
      - api
      - console
    guarded_by: []
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#dispositionReturnReceipt
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#inspectReturnReceipt
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-015-receive-inspect-and-disposition-returned-goods.md
  - key: commerce.returns.approve
    intent: Approve returns.
    operations:
      - approveReturn
      - rejectReturn
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#approveReturn'
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#rejectReturn'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#approveReturn'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#rejectReturn'
  - key: commerce.returns.create
    intent: Create returns.
    operations:
      - requestReturn
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestReturn'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#requestReturn'
  - key: commerce.returns.override
    intent: Perform a reasoned override for returns.
    operations:
      - requestReturn
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestReturn'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
  - key: commerce.returns.read
    intent: Inspect returns.
    operations:
      - getReturn
      - listReturns
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#getReturn'
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#listReturns'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#listReturns'
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#getReturn'
  - key: commerce.returns.update
    intent: Change returns.
    operations:
      - withdrawReturn
    surfaces:
      - api
      - console
      - portal
    guarded_by:
      - BR-CAP-COM-ORD-016-01
      - BR-CAP-COM-ORD-016-04
      - BR-CAP-COM-ORD-016-05
      - BR-CAP-COM-ORD-016-09
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#withdrawReturn'
      - >-
        rhythm-v2-docs:specs/commerce/orders/planning/capabilities/CAP-COM-ORD-016-take-back-delivered-goods-under-the-return-policy.md
      - 'services-commerce:modules/orders/aws/api/post-purchase.routes.ts#withdrawReturn'
  - key: commerce.shipments.cancel
    intent: Cancel shipments.
    operations:
      - cancelShipment
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#cancelShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
  - key: commerce.shipments.create
    intent: Create shipments.
    operations:
      - createShipment
    surfaces:
      - api
      - console
    guarded_by: []
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#createShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
  - key: commerce.shipments.handoff
    intent: Record carrier departure for shipments.
    operations:
      - handoffShipment
    surfaces:
      - api
      - console
    guarded_by: []
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#handoffShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-014-hand-shipments-to-the-carrier-or-the-buyer-and-record-what.md
  - key: commerce.shipments.handover
    intent: Record collection by the buyer for shipments.
    operations:
      - handoverShipment
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#handoverShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-014-hand-shipments-to-the-carrier-or-the-buyer-and-record-what.md
  - key: commerce.shipments.read
    intent: Inspect shipments.
    operations:
      - getShipment
      - listShipmentEvents
      - listShipmentPackages
      - listShipments
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#getShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listShipmentEvents
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listShipmentPackages
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listShipments
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
  - key: commerce.shipments.update
    intent: Change shipments.
    operations:
      - manifestShipment
      - packShipment
      - purchasePackageLabel
      - releaseShipment
      - resolvePackageLabel
      - trackPackage
      - voidPackageLabel
    surfaces:
      - api
      - console
    guarded_by: []
    tier: user
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#manifestShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#packShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#purchasePackageLabel
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#releaseShipment
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#resolvePackageLabel
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#trackPackage
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#voidPackageLabel
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-013-buy-void-and-track-carrier-labels-without-buying-twice.md
  - key: commerce.shipping-strategies.create
    intent: Create shipping strategies.
    operations:
      - createShippingStrategy
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#createShippingStrategy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.shipping-strategies.delete
    intent: Remove shipping strategies.
    operations:
      - deleteShippingStrategy
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#deleteShippingStrategy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.shipping-strategies.read
    intent: Inspect shipping strategies.
    operations:
      - getShippingStrategy
      - listShippingStrategies
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#getShippingStrategy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listShippingStrategies
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.shipping-strategies.update
    intent: Change shipping strategies.
    operations:
      - updateShippingStrategy
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#updateShippingStrategy
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.shipping-zones.create
    intent: Create shipping zones.
    operations:
      - createShippingZone
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#createShippingZone
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.shipping-zones.delete
    intent: Remove shipping zones.
    operations:
      - deleteShippingZone
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#deleteShippingZone
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.shipping-zones.read
    intent: Inspect shipping zones.
    operations:
      - getShippingZone
      - listShippingZones
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#getShippingZone
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#listShippingZones
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.shipping-zones.update
    intent: Change shipping zones.
    operations:
      - updateShippingZone
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#updateShippingZone
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-010-set-up-where-the-workspace-ships-how-it-charges-and-which.md
  - key: commerce.storefront.read
    intent: Inspect storefront.
    operations:
      - getStorefrontListing
      - listStorefrontListings
    surfaces:
      - api
      - portal
    guarded_by:
      - BR-CAP-COM-CAT-008-01
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#getStorefrontListing
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#listStorefrontListings
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-008-show-shoppers-what-a-store-sells.md
      - 'services-commerce:modules/catalog/aws/api/storefront.routes.ts#listStorefrontListings'
      - 'services-commerce:modules/catalog/aws/api/storefront.routes.ts#getStorefrontListing'
  - key: commerce.stores.bulk
    intent: Load records in bulk for stores.
    operations:
      - applyStoreDataJob
      - cancelStoreDataJob
      - getStoreDataJob
      - listStoreDataJobRejections
      - listStoreDataJobResults
      - listStoreDataJobs
      - pauseStoreDataJob
      - readStoresBySourceKey
      - resumeStoreDataJob
      - retryStoreDataJob
      - submitStoreDataJob
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-003-13
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-003-open-a-store-that-sells-a-chosen-assortment.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readStoresBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitStoreDataJob
  - key: commerce.stores.create
    intent: Create stores.
    operations:
      - createStore
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-003-13
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#createStore
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-003-open-a-store-that-sells-a-chosen-assortment.md
      - 'services-commerce:modules/configuration/aws/api/stores.routes.ts#createStore'
  - key: commerce.stores.delete
    intent: Remove stores.
    operations:
      - deleteStore
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-003-13
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#deleteStore
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-003-open-a-store-that-sells-a-chosen-assortment.md
      - 'services-commerce:modules/configuration/aws/api/stores.routes.ts#deleteStore'
  - key: commerce.stores.read
    intent: Inspect stores.
    operations:
      - getStore
      - listStores
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-003-13
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - 'rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#getStore'
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#listStores
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-003-open-a-store-that-sells-a-chosen-assortment.md
      - 'services-commerce:modules/configuration/aws/api/stores.routes.ts#listStores'
      - 'services-commerce:modules/configuration/aws/api/stores.routes.ts#getStore'
  - key: commerce.stores.update
    intent: Change stores.
    operations:
      - applyStoreDataJob
      - cancelStoreDataJob
      - getStoreDataJob
      - listStoreDataJobRejections
      - listStoreDataJobResults
      - listStoreDataJobs
      - pauseStoreDataJob
      - readStoresBySourceKey
      - resumeStoreDataJob
      - retryStoreDataJob
      - submitStoreDataJob
      - updateStore
    surfaces:
      - api
      - console
    guarded_by:
      - BR-CAP-COM-CAT-003-13
      - BR-CAP-COM-FUL-020-06
      - BR-CAP-COM-FUL-020-07
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#updateStore
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-003-open-a-store-that-sells-a-chosen-assortment.md
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobRejections
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobResults
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobs
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readStoresBySourceKey
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryStoreDataJob
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitStoreDataJob
      - 'services-commerce:modules/configuration/aws/api/stores.routes.ts#updateStore'
  - key: commerce.tax-zones.bulk
    intent: Load records in bulk for tax zones.
    operations: []
    surfaces:
      - api
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-004-charge-tax-according-to-where-the-buyer-is.md
  - key: commerce.tax-zones.create
    intent: Create tax zones.
    operations:
      - createTaxZone
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#createTaxZone
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-004-charge-tax-according-to-where-the-buyer-is.md
      - 'services-commerce:modules/configuration/aws/api/tax-zones.routes.ts#createTaxZone'
  - key: commerce.tax-zones.delete
    intent: Remove tax zones.
    operations:
      - deleteTaxZone
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#deleteTaxZone
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-004-charge-tax-according-to-where-the-buyer-is.md
      - 'services-commerce:modules/configuration/aws/api/tax-zones.routes.ts#deleteTaxZone'
  - key: commerce.tax-zones.read
    intent: Inspect tax zones.
    operations:
      - getTaxZone
      - listTaxZones
    surfaces:
      - api
      - console
    guarded_by: []
    tier: read
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#getTaxZone
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#listTaxZones
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-004-charge-tax-according-to-where-the-buyer-is.md
      - 'services-commerce:modules/configuration/aws/api/tax-zones.routes.ts#listTaxZones'
      - 'services-commerce:modules/configuration/aws/api/tax-zones.routes.ts#getTaxZone'
  - key: commerce.tax-zones.update
    intent: Change tax zones.
    operations:
      - updateTaxZone
    surfaces:
      - api
      - console
    guarded_by: []
    tier: admin
    staff_only: false
    grantable: true
    provenance: observed
    source: 'services-commerce:aws/commerce.service.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#updateTaxZone
      - >-
        rhythm-v2-docs:specs/commerce/catalog/planning/capabilities/CAP-COM-CAT-004-charge-tax-according-to-where-the-buyer-is.md
      - 'services-commerce:modules/configuration/aws/api/tax-zones.routes.ts#updateTaxZone'
  - key: none (anonymous)
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - createPublicPriceQuote
      - evaluatePublicOffers
      - getPublicStorefrontListing
      - listPublicStorefrontListings
    surfaces:
      - public
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#listPublicStorefrontListings;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#getPublicStorefrontListing;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#createPublicPriceQuote;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#evaluatePublicOffers
  - key: none (system caller)
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - catalog.assetCleanupConsumer
      - catalog.assetCleanupSweep
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#catalog.assetCleanupSweep;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md#catalog.assetCleanupConsumer
  - key: none (in-process)
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - configuration.listActiveTaxZones
      - configuration.resolveOrderingProfile
      - configuration.snapshotOf
      - merchandise.findMerchandiseProductIds
      - merchandise.readMerchandiseCatalog
      - pricing.prepareAudienceSettlement
      - pricing.priceCheckout
      - pricing.quoteTax
      - promotions.findPromotionDiscountDrift
      - promotions.listOrderLineDiscountsForBilling
      - promotions.recordRedemption
      - promotions.releaseRedemptionsForCancelledLines
      - promotions.releaseVoidedOrderRedemptions
      - promotions.resolveCheckoutCandidates
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#configuration.resolveOrderingProfile;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#configuration.snapshotOf;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md#configuration.listActiveTaxZones;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#merchandise.readMerchandiseCatalog;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#merchandise.findMerchandiseProductIds;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#pricing.priceCheckout;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#pricing.prepareAudienceSettlement;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#pricing.quoteTax;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#promotions.resolveCheckoutCandidates;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#promotions.recordRedemption;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#promotions.releaseVoidedOrderRedemptions;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#promotions.releaseRedemptionsForCancelledLines;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#promotions.listOrderLineDiscountsForBilling;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#promotions.findPromotionDiscountDrift
  - key: none (participant contract)
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - merchandise.extend_hold
      - merchandise.fulfill
      - merchandise.prepare_cancellation
      - merchandise.prepare_change
      - merchandise.prepare_purchase
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#merchandise.prepare_purchase;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#merchandise.extend_hold;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#merchandise.fulfill;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#merchandise.prepare_cancellation;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md#merchandise.prepare_change
  - key: none (provisioning)
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - pricing.seedBuiltInPricingAudiences
      - recommendations.seedStorePlacements
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#pricing.seedBuiltInPricingAudiences;
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md#recommendations.seedStorePlacements
  - key: none (no caller)
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - pricing.realizePricingAudienceHandovers
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md#pricing.realizePricingAudienceHandovers
  - key: none (worker)
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - promotions.runPromotionCodeIssuance
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md#promotions.runPromotionCodeIssuance
  - key: commerce.stores.bulk with commerce.stores.update per record
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - applyStoreDataJob
      - cancelStoreDataJob
      - getStoreDataJob
      - listStoreDataJobRejections
      - listStoreDataJobResults
      - listStoreDataJobs
      - pauseStoreDataJob
      - readStoresBySourceKey
      - resumeStoreDataJob
      - retryStoreDataJob
      - submitStoreDataJob
    surfaces:
      - console
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.stores.bulk
      - commerce.stores.update
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitStoreDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getStoreDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readStoresBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listStoreDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyStoreDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseStoreDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeStoreDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelStoreDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryStoreDataJob
  - key: commerce.ordering-profiles.bulk with commerce.ordering-profiles.update per record
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - applyOrderingProfileDataJob
      - cancelOrderingProfileDataJob
      - getOrderingProfileDataJob
      - listOrderingProfileDataJobRejections
      - listOrderingProfileDataJobResults
      - listOrderingProfileDataJobs
      - pauseOrderingProfileDataJob
      - readOrderingProfilesBySourceKey
      - resumeOrderingProfileDataJob
      - retryOrderingProfileDataJob
      - submitOrderingProfileDataJob
    surfaces:
      - console
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.ordering-profiles.bulk
      - commerce.ordering-profiles.update
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitOrderingProfileDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getOrderingProfileDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readOrderingProfilesBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderingProfileDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyOrderingProfileDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseOrderingProfileDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeOrderingProfileDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelOrderingProfileDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryOrderingProfileDataJob
  - key: commerce.orders.bulk with commerce.orders.create per record
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - applyOrderDataJob
      - cancelOrderDataJob
      - getOrderDataJob
      - listOrderDataJobRejections
      - listOrderDataJobResults
      - listOrderDataJobs
      - pauseOrderDataJob
      - readOrdersBySourceKey
      - resumeOrderDataJob
      - retryOrderDataJob
      - submitOrderDataJob
    surfaces:
      - console
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.orders.bulk
      - commerce.orders.create
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitOrderDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getOrderDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readOrdersBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listOrderDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyOrderDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseOrderDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeOrderDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelOrderDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryOrderDataJob
  - key: commerce.product-categories.bulk with commerce.product-categories.update per record
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - applyProductCategoryDataJob
      - cancelProductCategoryDataJob
      - getProductCategoryDataJob
      - listProductCategoryDataJobRejections
      - listProductCategoryDataJobResults
      - listProductCategoryDataJobs
      - pauseProductCategoryDataJob
      - readProductCategorysBySourceKey
      - resumeProductCategoryDataJob
      - retryProductCategoryDataJob
      - submitProductCategoryDataJob
    surfaces:
      - console
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.product-categories.bulk
      - commerce.product-categories.update
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitProductCategoryDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getProductCategoryDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readProductCategorysBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductCategoryDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyProductCategoryDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseProductCategoryDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeProductCategoryDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelProductCategoryDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryProductCategoryDataJob
  - key: commerce.product-listings.bulk with commerce.product-listings.update per record
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - applyProductListingDataJob
      - cancelProductListingDataJob
      - getProductListingDataJob
      - listProductListingDataJobRejections
      - listProductListingDataJobResults
      - listProductListingDataJobs
      - pauseProductListingDataJob
      - readProductListingsBySourceKey
      - resumeProductListingDataJob
      - retryProductListingDataJob
      - submitProductListingDataJob
    surfaces:
      - console
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.product-listings.bulk
      - commerce.product-listings.update
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitProductListingDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getProductListingDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readProductListingsBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listProductListingDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyProductListingDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseProductListingDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeProductListingDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelProductListingDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryProductListingDataJob
  - key: commerce.merchandise.bulk with commerce.merchandise.update per record
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - applyMerchandiseDataJob
      - applyMerchandiseOptionSetDataJob
      - cancelMerchandiseDataJob
      - cancelMerchandiseOptionSetDataJob
      - getMerchandiseDataJob
      - getMerchandiseOptionSetDataJob
      - listMerchandiseDataJobRejections
      - listMerchandiseDataJobResults
      - listMerchandiseDataJobs
      - listMerchandiseOptionSetDataJobRejections
      - listMerchandiseOptionSetDataJobResults
      - listMerchandiseOptionSetDataJobs
      - pauseMerchandiseDataJob
      - pauseMerchandiseOptionSetDataJob
      - readMerchandiseOptionSetsBySourceKey
      - readMerchandisesBySourceKey
      - resumeMerchandiseDataJob
      - resumeMerchandiseOptionSetDataJob
      - retryMerchandiseDataJob
      - retryMerchandiseOptionSetDataJob
      - submitMerchandiseDataJob
      - submitMerchandiseOptionSetDataJob
    surfaces:
      - console
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.merchandise.bulk
      - commerce.merchandise.update
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitMerchandiseOptionSetDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getMerchandiseOptionSetDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readMerchandiseOptionSetsBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseOptionSetDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyMerchandiseOptionSetDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseMerchandiseOptionSetDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeMerchandiseOptionSetDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelMerchandiseOptionSetDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryMerchandiseOptionSetDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitMerchandiseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getMerchandiseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readMerchandisesBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listMerchandiseDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyMerchandiseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseMerchandiseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeMerchandiseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelMerchandiseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryMerchandiseDataJob
  - key: commerce.inventory.bulk with commerce.inventory.update per record
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - applyInventoryItemDataJob
      - applyInventoryLocationDataJob
      - applyWarehouseDataJob
      - cancelInventoryItemDataJob
      - cancelInventoryLocationDataJob
      - cancelWarehouseDataJob
      - getInventoryItemDataJob
      - getInventoryLocationDataJob
      - getWarehouseDataJob
      - listInventoryItemDataJobRejections
      - listInventoryItemDataJobResults
      - listInventoryItemDataJobs
      - listInventoryLocationDataJobRejections
      - listInventoryLocationDataJobResults
      - listInventoryLocationDataJobs
      - listWarehouseDataJobRejections
      - listWarehouseDataJobResults
      - listWarehouseDataJobs
      - pauseInventoryItemDataJob
      - pauseInventoryLocationDataJob
      - pauseWarehouseDataJob
      - readInventoryItemsBySourceKey
      - readInventoryLocationsBySourceKey
      - readWarehousesBySourceKey
      - resumeInventoryItemDataJob
      - resumeInventoryLocationDataJob
      - resumeWarehouseDataJob
      - retryInventoryItemDataJob
      - retryInventoryLocationDataJob
      - retryWarehouseDataJob
      - submitInventoryItemDataJob
      - submitInventoryLocationDataJob
      - submitWarehouseDataJob
    surfaces:
      - console
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.inventory.bulk
      - commerce.inventory.update
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitWarehouseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getWarehouseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readWarehousesBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listWarehouseDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyWarehouseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseWarehouseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeWarehouseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelWarehouseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryWarehouseDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitInventoryLocationDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getInventoryLocationDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readInventoryLocationsBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryLocationDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyInventoryLocationDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseInventoryLocationDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeInventoryLocationDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelInventoryLocationDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryInventoryLocationDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#submitInventoryItemDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobs;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#getInventoryItemDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#readInventoryItemsBySourceKey;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobResults;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#listInventoryItemDataJobRejections;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#applyInventoryItemDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#pauseInventoryItemDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#resumeInventoryItemDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#cancelInventoryItemDataJob;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md#retryInventoryItemDataJob
  - key: none
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - getFulfillmentHealth
      - getInventoryHealth
      - getOperationsHealth
      - getShippingHealth
    surfaces:
      - public
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md#getFulfillmentHealth;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md#getInventoryHealth;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md#getOperationsHealth;
      rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md#getShippingHealth
  - key: 'none: public health route'
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - getCheckoutHealth
      - getEntitlementsHealth
      - getOrdersHealth
      - getPurchasingHealth
    surfaces:
      - public
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#getCheckoutHealth;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md#getEntitlementsHealth;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#getOrdersHealth;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md#getPurchasingHealth
  - key: >-
      commerce.checkouts.create (the workflow also evaluates commerce.orders.create for the
      organization override)
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - createCheckout
    surfaces:
      - portal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.checkouts.create
      - commerce.orders.create
    provenance: documented
    source: 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#createCheckout'
  - key: commerce.checkouts.update (evaluates commerce.orders.create)
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - addCheckoutItem
      - applyCheckoutPromotionCode
      - changeCheckoutItem
      - chooseCheckoutInstallmentPlan
      - chooseCheckoutShipping
      - previewCheckout
      - removeCheckoutPromotionCode
      - requestCheckoutItemHold
    surfaces:
      - portal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.checkouts.update
      - commerce.orders.create
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#addCheckoutItem;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#changeCheckoutItem;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#previewCheckout;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#applyCheckoutPromotionCode;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#removeCheckoutPromotionCode;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#requestCheckoutItemHold;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#chooseCheckoutShipping;
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md#chooseCheckoutInstallmentPlan
  - key: 'database: EXECUTE granted to the rhythm_commerce_consumer role only'
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - consume_entitlement
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md#consume_entitlement
  - key: commerce.cancellations.create (evaluates commerce.cancellations.override)
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - requestCancellation
    surfaces:
      - portal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.cancellations.create
      - commerce.cancellations.override
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestCancellation
  - key: commerce.amendments.create (evaluates commerce.amendments.override)
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - requestAmendment
    surfaces:
      - portal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.amendments.create
      - commerce.amendments.override
    provenance: documented
    source: 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestAmendment'
  - key: commerce.returns.create (evaluates commerce.returns.override)
    intent: Retain the service contract annotation for the named permission checks.
    operations:
      - requestReturn
    surfaces:
      - portal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys:
      - commerce.returns.create
      - commerce.returns.override
    provenance: documented
    source: 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md#requestReturn'
  - key: >-
      IAM: the commerce-participant-registration-invoke policy attached to the application deploy
      role
    intent: Describe an operation access mechanism without declaring an assignable Commerce permission.
    operations:
      - registerParticipant
    surfaces:
      - internal
    guarded_by: []
    entry_kind: operation-access-annotation
    grantable: false
    canonical_keys: []
    provenance: documented
    source: >-
      rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-participants.md#registerParticipant
  - key: orders.obligations.view
    intent: Show the delivery register in the console.
    operations:
      - getObligation
      - listObligations
    surfaces:
      - console
    guarded_by:
      - BR-CAP-COM-FUL-005-01
    entry_kind: console-alias
    grantable: false
    canonical_keys:
      - commerce.obligations.read
    alias_match: any
    provenance: observed
    source: 'react-console:lib/authz/backend-aliases.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-005-follow-an-order-s-obligations-and-step-in-by-hand.md
  - key: orders.operations.view
    intent: Show order operations findings in the console.
    operations:
      - getOperationalException
      - listOperationalExceptions
      - summarizeOperationalExceptions
    surfaces:
      - console
    guarded_by: []
    entry_kind: console-alias
    grantable: false
    canonical_keys:
      - commerce.exceptions.read
    alias_match: any
    provenance: observed
    source: 'react-console:lib/authz/backend-aliases.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-008-work-the-operations-queue.md
  - key: orders.operations.intervene
    intent: Offer interventions when at least one underlying intervention power is present.
    operations:
      - acknowledgeOperationalException
      - resolveOperationalException
      - retryFinancialAdjustment
      - resolveFinancialAdjustment
      - resolveEnforcement
      - approveObligation
      - overrideObligationGate
      - reauthorizeObligation
      - resolveObligation
      - holdObligation
      - releaseObligationHold
      - completeObligationManually
    surfaces:
      - console
    guarded_by:
      - BR-CAP-COM-FUL-005-02
      - BR-CAP-COM-FUL-005-03
      - BR-CAP-COM-FUL-005-04
      - BR-CAP-COM-FUL-004-07
      - BR-CAP-COM-FUL-004-08
      - BR-CAP-COM-FUL-005-05
      - BR-CAP-COM-FUL-005-06
      - BR-CAP-COM-FUL-005-07
    entry_kind: console-alias
    grantable: false
    canonical_keys:
      - commerce.exceptions.acknowledge
      - commerce.exceptions.resolve
      - commerce.adjustments.retry
      - commerce.adjustments.resolve
      - commerce.enforcements.resolve
      - commerce.obligations.approve
      - commerce.obligations.override
      - commerce.obligations.reauthorize
      - commerce.obligations.resolve
      - commerce.obligations.hold
      - commerce.obligations.complete-manually
    alias_match: any
    provenance: observed
    source: 'react-console:lib/authz/backend-aliases.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-008-work-the-operations-queue.md
  - key: orders.orders.ship
    intent: Offer shipment creation from an order.
    operations:
      - createShipment
    surfaces:
      - console
    guarded_by: []
    entry_kind: console-alias
    grantable: false
    canonical_keys:
      - commerce.shipments.create
    alias_match: any
    provenance: observed
    source: 'react-console:lib/authz/backend-aliases.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-012-turn-paid-orders-into-shipments-and-work-them-through-the.md
  - key: orders.shipments.printLabel
    intent: Offer label work through the shipment update authority.
    operations:
      - purchasePackageLabel
      - resolvePackageLabel
    surfaces:
      - console
    guarded_by: []
    entry_kind: console-alias
    grantable: false
    canonical_keys:
      - commerce.shipments.update
    alias_match: any
    provenance: observed
    source: 'react-console:lib/authz/backend-aliases.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-013-buy-void-and-track-carrier-labels-without-buying-twice.md
  - key: orders.shipments.voidLabel
    intent: Offer label voiding through the shipment update authority.
    operations:
      - voidPackageLabel
    surfaces:
      - console
    guarded_by: []
    entry_kind: console-alias
    grantable: false
    canonical_keys:
      - commerce.shipments.update
    alias_match: any
    provenance: observed
    source: 'react-console:lib/authz/backend-aliases.ts'
    evidence:
      - >-
        rhythm-v2-docs:specs/commerce/fulfillment/planning/capabilities/CAP-COM-FUL-013-buy-void-and-track-carrier-labels-without-buying-twice.md
staff_access: >-
  Platform supplies approved, direct, emergency and standing workspace grants; Commerce applies the
  granted workspace role and attributes interventions to the verified actor.
provenance: observed
source: 'services-commerce:aws/commerce.service.ts'
evidence:
  - 'services-commerce:aws/commerce.service.ts#CommerceBuiltInPolicies'
  - 'services-commerce:modules/checkout/services/checkout/checkout-actor.ts'
  - 'services-commerce:modules/fulfillment/aws/api/fulfillment.routes.ts'
  - 'services-commerce:modules/recommendations/tests/e2e/recommendations-security.e2e.spec.js'
  - 'react-console:lib/authz/backend-aliases.ts'
  - 'react-console:lib/authz/permissions.ts'
  - 'macroservice-libraries:packages/authorization/src/permission-catalog.ts'
  - >-
    rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md
  - >-
    rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md
  - >-
    rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md
  - 'rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-catalog.md'
  - 'rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-configuration.md'
  - 'rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-merchandise.md'
  - 'rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-pricing.md'
  - 'rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-promotions.md'
  - 'rhythm-v2-docs:specs/commerce/catalog/design/contracts/SVC-COM-CAT-recommendations.md'
  - 'rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-data-operations.md'
  - 'rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-fulfillment.md'
  - 'rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-inventory.md'
  - 'rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-operations.md'
  - 'rhythm-v2-docs:specs/commerce/fulfillment/design/contracts/SVC-COM-FUL-shipping.md'
  - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-checkout.md'
  - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-entitlements.md'
  - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-orders.md'
  - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-participants.md'
  - 'rhythm-v2-docs:specs/commerce/orders/design/contracts/SVC-COM-ORD-purchasing.md'
  - 'rhythm-v2-docs:specs/platform/security/design/contracts/SVC-PFM-SEC-security.md'
  - >-
    rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md
  - 'services-commerce:modules/data-operations/aws/api/data-operations.routes.ts'
  - 'services-commerce:modules/shipping/aws/api/shipping.routes.ts'
  - 'services-commerce:modules/participants/aws/logic/participant-registration.lambda.ts'
---

# Commerce Authorization Model

## Authorization Boundary

Anonymous routes expose storefront, quote and offer evaluation, alongside public service health. Protected operations use the verified caller, Commerce application access and the declared operation permission. Console, portal and system access are separate route boundaries. An application callback uses system access and a platform grant; a workspace administrator cannot acquire that callback power through the Commerce administrator tier.

Platform owns roles, assignments, policy evaluation and staff entry. Commerce declares no additional named built-in policies. The entitlement groupings below describe the generated Commerce policies, rather than new shipped roles. The area's working actors identify goals and responsibilities; they do not establish grants. In particular, authenticated purchasing routes do not prove that the built-in Portal Member role includes Commerce permissions. Platform's recorded portal defaults name sign-in and selected Submissions powers, so Commerce portal assignments need explicit verification.

## Scopes

Workspace authority determines which customer's Commerce operations a caller may reach. Record guards further constrain portal activity using the linked contact and the purchasing or grant record. Product, store, warehouse and policy scope references select domain behavior; they do not establish a separate organizational-unit entitlement model. Platform scope is reserved for the callback identity and Platform-managed staff authority. An application invocation policy and a database execution role are distinct access mechanisms, not customer permission keys.

## Roles

Commerce Read Only contains the eligible read-tier keys. Commerce User adds user-tier keys, including ordinary record changes, campaign preparation, payment collection and offer responses. Commerce Administrator adds the eligible administrator-tier keys, including configuration writes and sensitive interventions. All three include application access and remain subject to deny policies and route guards. Custom workspace roles can select individual permissions through Platform; the generated tiers are starting groupings rather than a requirement to grant every power together.

A delivering application receives the callback key separately at platform scope. Rhythm staff enter through Platform's workspace-grant mechanisms and act under the resulting workspace authority. Staff identity alone does not supply every Commerce power, and the service callback is not a human support role.

## Permission Catalogue

The structured catalogue lists each Commerce key, its declared tier, associated operations, surfaces and restricting rule references. Console aliases identify presentation checks and translate to the underlying Commerce keys; the server evaluates those underlying keys. A declared key with no listed operation does not imply an executable route. Configuration resources place writes at administrator tier, while ordinary record resources default to user-tier writes and administrator-tier bulk loading. Promotion preparation, launch and usage restoration have separate keys. Post-sale promotion application also has its own authority, distinct from promotion usage restoration.

Some existing service contracts put additional checks or non-permission access descriptions in their permission field. The catalogue retains those exact annotations as non-grantable entries with their canonical keys, so their references remain visible. They do not enter any role's grants. Public, in-process, scheduled, invocation-policy and database-role descriptions therefore remain distinguishable from assignable Commerce keys.

## Role Entitlement Matrix

Allow means the grouping includes the key before denies, route restrictions and domain guards are evaluated. A dash means the grouping supplies no grant. Non-grantable access annotations are excluded.

| Permission | Read Only | User | Administrator | Delivering Application |
|---|---|---|---|---|
| `commerce.adjustments.read` | Allow | Allow | Allow | — |
| `commerce.adjustments.resolve` | — | — | Allow | — |
| `commerce.adjustments.retry` | — | — | Allow | — |
| `commerce.amendments.apply-promotion` | — | — | Allow | — |
| `commerce.amendments.approve` | — | — | Allow | — |
| `commerce.amendments.create` | — | Allow | Allow | — |
| `commerce.amendments.override` | — | — | Allow | — |
| `commerce.amendments.read` | Allow | Allow | Allow | — |
| `commerce.amendments.update` | — | Allow | Allow | — |
| `commerce.application.access` | Allow | Allow | Allow | — |
| `commerce.cancellations.approve` | — | — | Allow | — |
| `commerce.cancellations.create` | — | Allow | Allow | — |
| `commerce.cancellations.override` | — | — | Allow | — |
| `commerce.cancellations.read` | Allow | Allow | Allow | — |
| `commerce.cancellations.update` | — | Allow | Allow | — |
| `commerce.carrier-accounts.create` | — | — | Allow | — |
| `commerce.carrier-accounts.delete` | — | — | Allow | — |
| `commerce.carrier-accounts.read` | Allow | Allow | Allow | — |
| `commerce.carrier-accounts.update` | — | — | Allow | — |
| `commerce.checkouts.bulk` | — | — | Allow | — |
| `commerce.checkouts.create` | — | Allow | Allow | — |
| `commerce.checkouts.delete` | — | Allow | Allow | — |
| `commerce.checkouts.read` | Allow | Allow | Allow | — |
| `commerce.checkouts.update` | — | Allow | Allow | — |
| `commerce.downloads.read` | Allow | Allow | Allow | — |
| `commerce.enforcements.read` | Allow | Allow | Allow | — |
| `commerce.enforcements.resolve` | — | — | Allow | — |
| `commerce.entitlements.grant` | — | — | Allow | — |
| `commerce.entitlements.read` | Allow | Allow | Allow | — |
| `commerce.entitlements.restore` | — | — | Allow | — |
| `commerce.entitlements.revoke` | — | — | Allow | — |
| `commerce.exceptions.acknowledge` | — | — | Allow | — |
| `commerce.exceptions.read` | Allow | Allow | Allow | — |
| `commerce.exceptions.resolve` | — | — | Allow | — |
| `commerce.fulfillment-policies.apply` | — | — | Allow | — |
| `commerce.fulfillment-policies.create` | — | — | Allow | — |
| `commerce.fulfillment-policies.delete` | — | — | Allow | — |
| `commerce.fulfillment-policies.read` | Allow | Allow | Allow | — |
| `commerce.fulfillment-policies.update` | — | — | Allow | — |
| `commerce.inventory-costing.bulk` | — | — | Allow | — |
| `commerce.inventory-costing.create` | — | — | Allow | — |
| `commerce.inventory-costing.delete` | — | — | Allow | — |
| `commerce.inventory-costing.read` | Allow | Allow | Allow | — |
| `commerce.inventory-costing.update` | — | — | Allow | — |
| `commerce.inventory.bulk` | — | — | Allow | — |
| `commerce.inventory.create` | — | — | Allow | — |
| `commerce.inventory.delete` | — | — | Allow | — |
| `commerce.inventory.read` | Allow | Allow | Allow | — |
| `commerce.inventory.update` | — | — | Allow | — |
| `commerce.merchandise.bulk` | — | — | Allow | — |
| `commerce.merchandise.create` | — | — | Allow | — |
| `commerce.merchandise.delete` | — | — | Allow | — |
| `commerce.merchandise.read` | Allow | Allow | Allow | — |
| `commerce.merchandise.update` | — | — | Allow | — |
| `commerce.obligations.approve` | — | — | Allow | — |
| `commerce.obligations.callback` | — | — | — | Allow |
| `commerce.obligations.complete-manually` | — | — | Allow | — |
| `commerce.obligations.hold` | — | — | Allow | — |
| `commerce.obligations.override` | — | — | Allow | — |
| `commerce.obligations.read` | Allow | Allow | Allow | — |
| `commerce.obligations.reauthorize` | — | — | Allow | — |
| `commerce.obligations.resolve` | — | — | Allow | — |
| `commerce.offers.read` | Allow | Allow | Allow | — |
| `commerce.offers.respond` | — | Allow | Allow | — |
| `commerce.ordering-profiles.bulk` | — | — | Allow | — |
| `commerce.ordering-profiles.create` | — | — | Allow | — |
| `commerce.ordering-profiles.delete` | — | — | Allow | — |
| `commerce.ordering-profiles.read` | Allow | Allow | Allow | — |
| `commerce.ordering-profiles.update` | — | — | Allow | — |
| `commerce.orders.bulk` | — | — | Allow | — |
| `commerce.orders.create` | — | Allow | Allow | — |
| `commerce.orders.delete` | — | Allow | Allow | — |
| `commerce.orders.read` | Allow | Allow | Allow | — |
| `commerce.orders.tender` | — | Allow | Allow | — |
| `commerce.orders.update` | — | Allow | Allow | — |
| `commerce.orders.void` | — | — | Allow | — |
| `commerce.pick-lists.create` | — | Allow | Allow | — |
| `commerce.pick-lists.read` | Allow | Allow | Allow | — |
| `commerce.pick-lists.update` | — | Allow | Allow | — |
| `commerce.price-quotes.read` | Allow | Allow | Allow | — |
| `commerce.pricing-audiences.bulk` | — | — | Allow | — |
| `commerce.pricing-audiences.create` | — | — | Allow | — |
| `commerce.pricing-audiences.delete` | — | — | Allow | — |
| `commerce.pricing-audiences.read` | Allow | Allow | Allow | — |
| `commerce.pricing-audiences.update` | — | — | Allow | — |
| `commerce.pricing-schedules.bulk` | — | — | Allow | — |
| `commerce.pricing-schedules.create` | — | — | Allow | — |
| `commerce.pricing-schedules.delete` | — | — | Allow | — |
| `commerce.pricing-schedules.read` | Allow | Allow | Allow | — |
| `commerce.pricing-schedules.update` | — | — | Allow | — |
| `commerce.product-categories.bulk` | — | — | Allow | — |
| `commerce.product-categories.create` | — | — | Allow | — |
| `commerce.product-categories.delete` | — | — | Allow | — |
| `commerce.product-categories.read` | Allow | Allow | Allow | — |
| `commerce.product-categories.update` | — | — | Allow | — |
| `commerce.product-extensions.bulk` | — | — | Allow | — |
| `commerce.product-extensions.create` | — | — | Allow | — |
| `commerce.product-extensions.delete` | — | — | Allow | — |
| `commerce.product-extensions.read` | Allow | Allow | Allow | — |
| `commerce.product-extensions.update` | — | — | Allow | — |
| `commerce.product-listings.bulk` | — | — | Allow | — |
| `commerce.product-listings.create` | — | — | Allow | — |
| `commerce.product-listings.delete` | — | — | Allow | — |
| `commerce.product-listings.read` | Allow | Allow | Allow | — |
| `commerce.product-listings.update` | — | — | Allow | — |
| `commerce.product-purchasing-settings.bulk` | — | — | Allow | — |
| `commerce.product-purchasing-settings.create` | — | — | Allow | — |
| `commerce.product-purchasing-settings.delete` | — | — | Allow | — |
| `commerce.product-purchasing-settings.read` | Allow | Allow | Allow | — |
| `commerce.product-purchasing-settings.update` | — | — | Allow | — |
| `commerce.promotions.activate` | — | — | Allow | — |
| `commerce.promotions.manage` | — | Allow | Allow | — |
| `commerce.promotions.override` | — | — | Allow | — |
| `commerce.promotions.read` | Allow | Allow | Allow | — |
| `commerce.purchasing.bulk` | — | — | Allow | — |
| `commerce.purchasing.create` | — | — | Allow | — |
| `commerce.purchasing.delete` | — | — | Allow | — |
| `commerce.purchasing.read` | Allow | Allow | Allow | — |
| `commerce.purchasing.update` | — | — | Allow | — |
| `commerce.recommendation-journeys.bulk` | — | — | Allow | — |
| `commerce.recommendation-journeys.create` | — | — | Allow | — |
| `commerce.recommendation-journeys.delete` | — | — | Allow | — |
| `commerce.recommendation-journeys.read` | Allow | Allow | Allow | — |
| `commerce.recommendation-journeys.update` | — | — | Allow | — |
| `commerce.recommendation-placements.read` | Allow | Allow | Allow | — |
| `commerce.recommendation-rules.activate` | — | — | Allow | — |
| `commerce.recommendation-rules.bulk` | — | — | Allow | — |
| `commerce.recommendation-rules.create` | — | — | Allow | — |
| `commerce.recommendation-rules.delete` | — | — | Allow | — |
| `commerce.recommendation-rules.read` | Allow | Allow | Allow | — |
| `commerce.recommendation-rules.update` | — | — | Allow | — |
| `commerce.return-policies.bulk` | — | — | Allow | — |
| `commerce.return-policies.create` | — | — | Allow | — |
| `commerce.return-policies.delete` | — | — | Allow | — |
| `commerce.return-policies.read` | Allow | Allow | Allow | — |
| `commerce.return-policies.update` | — | — | Allow | — |
| `commerce.return-receipts.create` | — | Allow | Allow | — |
| `commerce.return-receipts.read` | Allow | Allow | Allow | — |
| `commerce.return-receipts.update` | — | Allow | Allow | — |
| `commerce.returns.approve` | — | — | Allow | — |
| `commerce.returns.create` | — | Allow | Allow | — |
| `commerce.returns.override` | — | — | Allow | — |
| `commerce.returns.read` | Allow | Allow | Allow | — |
| `commerce.returns.update` | — | Allow | Allow | — |
| `commerce.shipments.cancel` | — | — | Allow | — |
| `commerce.shipments.create` | — | Allow | Allow | — |
| `commerce.shipments.handoff` | — | Allow | Allow | — |
| `commerce.shipments.handover` | — | — | Allow | — |
| `commerce.shipments.read` | Allow | Allow | Allow | — |
| `commerce.shipments.update` | — | Allow | Allow | — |
| `commerce.shipping-strategies.create` | — | — | Allow | — |
| `commerce.shipping-strategies.delete` | — | — | Allow | — |
| `commerce.shipping-strategies.read` | Allow | Allow | Allow | — |
| `commerce.shipping-strategies.update` | — | — | Allow | — |
| `commerce.shipping-zones.create` | — | — | Allow | — |
| `commerce.shipping-zones.delete` | — | — | Allow | — |
| `commerce.shipping-zones.read` | Allow | Allow | Allow | — |
| `commerce.shipping-zones.update` | — | — | Allow | — |
| `commerce.storefront.read` | Allow | Allow | Allow | — |
| `commerce.stores.bulk` | — | — | Allow | — |
| `commerce.stores.create` | — | — | Allow | — |
| `commerce.stores.delete` | — | — | Allow | — |
| `commerce.stores.read` | Allow | Allow | Allow | — |
| `commerce.stores.update` | — | — | Allow | — |
| `commerce.tax-zones.bulk` | — | — | Allow | — |
| `commerce.tax-zones.create` | — | — | Allow | — |
| `commerce.tax-zones.delete` | — | — | Allow | — |
| `commerce.tax-zones.read` | Allow | Allow | Allow | — |
| `commerce.tax-zones.update` | — | — | Allow | — |

## Protected Actions

Sensitive interventions include voiding an unfinished sale, post-sale overrides, benefit changes, delivery interventions, retroactive policy application and privileged shipment decisions. Their catalogue entries cite the owning rules for reasons, evidence, permitted states and any remaining approval requirements. An override permission does not remove every domain safeguard. Ordinary campaign preparation and authorized launch remain separate authorities.

## Guards Distinguished From Permissions

A permission answers whether the caller has the named power. Workspace context, access channel, purchasing-party ownership, linked contact, qualification, record locks, current authorization, read version and lifecycle state determine whether that power may act on this record now. The catalogue cites the owning rules rather than redefining them here. Previously issued authority can remain cached until expiry; a stored role edit does not establish immediate refusal on every request.

## What People See When Refused

Protected API requests without usable authentication receive an unauthorized response. Missing operation grants and denied application access receive forbidden responses with an access-refusal reason. A foreign workspace record is treated as unavailable, while a portal attempt to act for an unauthorized party can receive a forbidden response. Validation and changed-state failures remain distinct from permission refusal. Console surfaces use their own permission checks to limit available actions, but the server still evaluates direct requests. Commerce retains gaps in cross-surface refusal wording and shared audit publication in the owning module findings.
