---
id: ADR-COM-ORD-012
title: Rights are drawn through one database function
product_area: commerce
module: orders
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Expose entitlement consumption through a restricted database function within the consumer's transaction and
  expose active rights through a read view.
constrains:
  - DOM-COM-ORD-004
  - SVC-COM-ORD-entitlements
  - WF-COM-ORD-009
origin: >-
  services-commerce:docs/migrations/entitlements/README.md (decisions D-E series); services-platform
  docs/proposals/commerce-orders/19-entitlements.md section 2.3 as cited by the code
alternatives:
  - option: Consume benefits through an HTTP request
    why_not: The consumed benefit would commit separately from its consumer record.
  - option: Grant consumers direct use-table insertion
    why_not: 'Every consumer would need to replicate time, allowance and replay checks.'
consequences:
  - Benefit consumption shares the consumer record transaction.
  - 'Validity, allowance and replay checks have one database implementation.'
  - Committed revocation immediately affects the active-rights view.
supersedes: []
evidence:
  - >-
    services-commerce at c8b66a98: db/migrations/20261018130023_entitlements.sql;
    modules/entitlements/services/persistence/*.ts.
---

# Rights are drawn through one database function

## Context

Consumers need benefit use to succeed or fail with their own records.

## Decision

Give consumers a constrained execution role for the consumption function, keeping allowance and validity checks inside one database boundary.

## Alternatives Considered

An HTTP draw would commit independently of the consuming record. Direct use-table writes would duplicate allowance and replay rules in every consumer.

## Consequences

Consumers depend on a coordinated database signature. Revocation affects active-rights reads as soon as its transaction commits.