--- id: AUTH-CMT title: Committees Authorization Model product_area: committees revision: 1 status: draft design_intent: proposed implementation_evidence: partially-observed source_sha: rhythm-v2-docs: 57bd42267bc7cb15b38c01033f6175b515e25d36 services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d react-console: baf6dae382d6f41dce976c7f848667ccc37e076f provenance: observed source: 'services-committees:aws/committees.service.ts; lib/http/committees-route.ts' scopes: - name: customer meaning: >- Platform customer-wide assignments contribute authority to covered workspaces; Committees does not administer them. provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md - name: workspace meaning: >- Protected committee operations evaluate their declared key in the addressed workspace. provenance: observed source: 'services-committees:lib/http/committees-route.ts:handle' - name: organizational unit meaning: >- Several permission groups declare unit scope and the proposed derivation engine supplies unit-and-descendant assignments, but committee routes currently pass no unit resource to permission evaluation. provenance: observed source: >- services-committees:aws/committees.service.ts; lib/http/committees-route.ts:handle - name: record meaning: >- Portal guards limit actions by the linked person, participation, voter eligibility and record visibility after the route permission succeeds. provenance: observed source: >- services-committees:modules/meetings/services/portal; modules/decisions/services/portal; modules/appointments/aws/api/appointments.routes.ts roles: - id: ROLE-CMT-001 name: Administrator who: >- A customer administrator using the generated Committees administrator policy. grants: &ref_0 - committees.application.access - committees.configuration.read - committees.configuration.manage - committees.committees.read - committees.committees.manage - committees.appointments.read - committees.appointments.manage - committees.seats.manage - committees.self.read - committees.rosters.read - committees.authority.read - committees.meetings.read - committees.meetings.manage - committees.portal.participate - committees.portal.calendar - committees.decisions.read - committees.decisions.manage - committees.minutes.manage - committees.openings.read - committees.openings.manage - committees.nominations.read - committees.nominations.manage - committees.disclosures.read - committees.disclosures.manage - committees.committee-layouts.read - committees.committee-layouts.create - committees.committee-layouts.update - committees.committee-layouts.delete provenance: inferred source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md note: >- Committee permission slices inferred from the declared tiers and the landed Platform policy model, with the older console inventory as a seed; deployed policy composition is unverified: FND-CMT-CMT-058. - id: ROLE-CMT-002 name: Power User who: A customer power user using the same application administrator tier. grants: *ref_0 provenance: inferred source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md note: >- Committee permission slices inferred from the declared tiers and the landed Platform policy model, with the older console inventory as a seed; deployed policy composition is unverified: FND-CMT-CMT-058. - id: ROLE-CMT-003 name: Standard User who: A governance operator using the generated application user tier. grants: - committees.application.access - committees.configuration.read - committees.committees.read - committees.committees.manage - committees.appointments.read - committees.appointments.manage - committees.seats.manage - committees.self.read - committees.rosters.read - committees.authority.read - committees.meetings.read - committees.meetings.manage - committees.portal.participate - committees.portal.calendar - committees.decisions.read - committees.decisions.manage - committees.minutes.manage - committees.openings.read - committees.openings.manage - committees.nominations.read - committees.nominations.manage - committees.disclosures.read - committees.disclosures.manage - committees.committee-layouts.read provenance: inferred source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md note: >- Committee permission slices inferred from the declared tiers and the landed Platform policy model, with the older console inventory as a seed; deployed policy composition is unverified: FND-CMT-CMT-058. - id: ROLE-CMT-004 name: Read Only who: A governance reader using the generated application read tier. grants: - committees.application.access - committees.configuration.read - committees.committees.read - committees.appointments.read - committees.self.read - committees.rosters.read - committees.authority.read - committees.meetings.read - committees.portal.participate - committees.portal.calendar - committees.decisions.read - committees.openings.read - committees.nominations.read - committees.disclosures.read - committees.committee-layouts.read provenance: inferred source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md note: >- Committee permission slices inferred from the declared tiers and the landed Platform policy model, with the older console inventory as a seed; deployed policy composition is unverified: FND-CMT-CMT-058. - id: ROLE-CMT-005 name: Portal Member who: >- A person signed in through the workspace’s member portal whose committee keys require additional grants. grants: [] provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md note: >- Committee permission slices inferred from the declared tiers and the landed Platform policy model, with the older console inventory as a seed; deployed policy composition is unverified: FND-CMT-CMT-058. permissions: - key: committees.application.access intent: >- Enter the Committees application without gaining record management authority. operations: - listCommitteeAppointments - appointToCommittee - bulkAppointments - getBulkAppointmentsJob - getAppointment - getAppointmentHistory - updateAppointment - endAppointment - extendAppointment - vacateAppointment - acceptAppointment - declineAppointment - listContactAppointments - listMyAppointments - acceptMyAppointment - declineMyAppointment - getPortalCommittee - getPortalRoster - listAuthorityRules - createAuthorityRule - getAuthorityRule - updateAuthorityRule - deleteAuthorityRule - getContactAuthority - reconcileAuthority - listCommitteeTypes - createCommitteeType - getCommitteeType - updateCommitteeType - deleteCommitteeType - listPositions - createPosition - getPosition - updatePosition - deletePosition - getCommitteeSettings - updateCommitteeSettings - listCommittees - createCommittee - getCommittee - updateCommittee - deleteCommittee - getCommitteeHistory - getCommitteeVacancies - getCommitteeEffectiveProfile - getCommitteeHierarchy - getCommitteeAuditRoster - dissolveCommittee - listCommitteeRecordLinks - createCommitteeRecordLink - deleteCommitteeRecordLink - listRecordLinkedCommittees - listCommitteeTerms - createCommitteeTerm - getCommitteeTerm - updateCommitteeTerm - deleteCommitteeTerm - listCommitteeSeats - createCommitteeSeat - defineSeatsFromRoster - getCommitteeSeat - getCommitteeSeatHistory - updateCommitteeSeat - deleteCommitteeSeat - retireCommitteeSeat - suspendCommitteeSeat - reactivateCommitteeSeat - listDecisions - createDecision - getDecision - openDecision - tableDecision - withdrawDecision - recordDecisionVote - recordDecisionTally - closeDecision - amendDecision - rescindDecision - listDecisionRecusals - recordDecisionRecusal - getPortalDecision - castPortalVote - recordPortalRecusal - listMyDecisions - applyCertifiedElection - listConflictDisclosures - getConflictDisclosure - requestConflictDisclosure - listMyDisclosures - listCommitteeMeetings - createMeeting - getMeeting - updateMeeting - listMeetingParticipants - addMeetingParticipant - updateMeetingParticipant - recordMeetingAttendance - getMeetingAgenda - replaceMeetingAgendaOrder - addAgendaItem - updateAgendaItem - deleteAgendaItem - deferAgendaItem - listMeetingMaterials - addMeetingMaterial - deleteMeetingMaterial - publishMeetingAgenda - publishMeetingPacket - closeMeeting - cancelMeeting - getMeetingCalendar - getMeetingMinutes - saveMeetingMinutes - assembleMeetingMinutes - circulateMeetingMinutes - revertMeetingMinutes - listMeetingItemNotes - addMeetingItemNote - listMeetingActionItems - proposeMeetingActionItem - acceptMeetingActionItem - dismissMeetingActionItem - determineMeetingQuorum - approveMeetingMinutes - correctMeetingMinutes - listCommitteeSeries - createMeetingSeries - getMeetingSeries - updateMeetingSeries - materializeMeetingSeries - listMyMeetings - getPortalMeeting - answerMeetingInvitation - getPortalMeetingMinutes - issueCalendarFeedToken - listCommitteeOpenings - createCommitteeOpening - createOpeningsFromForecast - getCommitteeOpening - updateCommitteeOpening - publishCommitteeOpening - closeCommitteeOpening - cancelCommitteeOpening - listCommitteeOpeningInterests - getVacancyForecast - listCommitteeNominations - createCommitteeNomination - getCommitteeNomination - updateCommitteeNomination - slateCommitteeNomination - declineCommitteeNomination - withdrawCommitteeNomination - listCommitteeOpeningAlternates - listPortalOpenings - expressOpeningInterest - portalNominate surfaces: - api - console - job guarded_by: [] provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md operation_sources: [] note: >- Application-level boundary for protected operations, rather than their individual route permission. - key: committees.configuration.read intent: 'Inspect committee types, positions, settings and proposed authority rules.' operations: - listAuthorityRules - getAuthorityRule - listCommitteeTypes - getCommitteeType - listPositions - getPosition - getCommitteeSettings surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-authority.md - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-committees.md - key: committees.configuration.manage intent: >- Maintain shared committee configuration and proposed authority mappings and request authority reconciliation. operations: - createAuthorityRule - updateAuthorityRule - deleteAuthorityRule - reconcileAuthority - createCommitteeType - updateCommitteeType - deleteCommitteeType - createPosition - updatePosition - deletePosition - updateCommitteeSettings surfaces: - api - console - job guarded_by: - BR-CAP-CMT-CMT-001-07 - BR-CAP-CMT-CMT-001-09 - BR-CAP-CMT-CMT-001-10 - BR-CAP-CMT-CMT-001-11 - BR-CAP-CMT-CMT-019-01 - BR-CAP-CMT-CMT-019-02 - BR-CAP-CMT-CMT-019-03 - BR-CAP-CMT-CMT-019-04 - BR-CAP-CMT-CMT-019-05 - BR-CAP-CMT-CMT-019-06 - BR-CAP-CMT-CMT-019-08 - BR-CAP-CMT-CMT-019-09 - BR-CAP-CMT-CMT-019-11 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-authority.md - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-committees.md - key: committees.committees.read intent: >- Inspect bodies, calendars, places, relationships and governance information. operations: - listCommittees - getCommittee - getCommitteeHistory - getCommitteeVacancies - getCommitteeEffectiveProfile - getCommitteeHierarchy - listCommitteeRecordLinks - listRecordLinkedCommittees - listCommitteeTerms - getCommitteeTerm - listCommitteeSeats - getCommitteeSeat - getCommitteeSeatHistory surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-committees.md - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-seats.md - key: committees.committees.manage intent: 'Maintain bodies, terms and relationships and record committee closure.' operations: - createCommittee - updateCommittee - deleteCommittee - dissolveCommittee - createCommitteeRecordLink - deleteCommitteeRecordLink - createCommitteeTerm - updateCommitteeTerm - deleteCommitteeTerm surfaces: - api - console guarded_by: - BR-CAP-CMT-CMT-003-02 - BR-CAP-CMT-CMT-003-05 - BR-CAP-CMT-CMT-003-08 - BR-CAP-CMT-CMT-003-10 - BR-CAP-CMT-CMT-004-01 - BR-CAP-CMT-CMT-004-02 - BR-CAP-CMT-CMT-004-03 - BR-CAP-CMT-CMT-004-08 - BR-CAP-CMT-CMT-006-01 - BR-CAP-CMT-CMT-006-06 - BR-CAP-CMT-CMT-006-08 - BR-CAP-CMT-CMT-006-09 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-committees.md - key: committees.appointments.read intent: >- Inspect dated participation, its history, bulk-job progress and audit rosters. operations: - listCommitteeAppointments - getBulkAppointmentsJob - getAppointment - getAppointmentHistory - listContactAppointments - getCommitteeAuditRoster surfaces: - api - console - job - portal guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-appointments.md - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-committees.md - key: committees.appointments.manage intent: >- Record and change participation and answer offers on behalf of participants. operations: - appointToCommittee - bulkAppointments - updateAppointment - endAppointment - extendAppointment - vacateAppointment - acceptAppointment - declineAppointment surfaces: - api - console - job - portal guarded_by: - BR-CAP-CMT-CMT-008-01 - BR-CAP-CMT-CMT-008-02 - BR-CAP-CMT-CMT-008-03 - BR-CAP-CMT-CMT-008-04 - BR-CAP-CMT-CMT-008-06 - BR-CAP-CMT-CMT-008-09 - BR-CAP-CMT-CMT-009-01 - BR-CAP-CMT-CMT-009-02 - BR-CAP-CMT-CMT-009-04 - BR-CAP-CMT-CMT-010-03 - BR-CAP-CMT-CMT-010-04 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-appointments.md - key: committees.seats.manage intent: Maintain committee places and their effective standing. operations: - createCommitteeSeat - defineSeatsFromRoster - updateCommitteeSeat - deleteCommitteeSeat - retireCommitteeSeat - suspendCommitteeSeat - reactivateCommitteeSeat surfaces: - api - console - job guarded_by: - BR-CAP-CMT-CMT-007-01 - BR-CAP-CMT-CMT-007-04 - BR-CAP-CMT-CMT-007-06 - BR-CAP-CMT-CMT-007-08 - BR-CAP-CMT-CMT-007-09 - BR-CAP-CMT-CMT-007-11 - BR-CAP-CMT-CMT-007-12 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-seats.md - key: committees.self.read intent: Inspect own participation and answer own offers through the portal. operations: - listMyAppointments - acceptMyAppointment - declineMyAppointment surfaces: - api - console - job - portal guarded_by: - BR-CAP-CMT-CMT-010-04 - BR-CAP-CMT-CMT-010-08 - BR-CAP-CMT-CMT-010-11 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-appointments.md - key: committees.rosters.read intent: >- Read committee information, rosters and openings within portal visibility limits. operations: - getPortalCommittee - getPortalRoster - listPortalOpenings surfaces: - api - console - portal - job guarded_by: - BR-CAP-CMT-CMT-016-08 - BR-CAP-CMT-CMT-016-09 - BR-CAP-CMT-MTG-016-06 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-appointments.md - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-recruitment.md - key: committees.authority.read intent: Inspect the explanation of appointment-derived Platform access. operations: - getContactAuthority surfaces: - api - job guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/committees/design/contracts/SVC-CMT-CMT-authority.md - key: committees.meetings.read intent: 'Inspect meetings, series, participants, agendas, papers and minutes.' operations: - listCommitteeMeetings - getMeeting - listMeetingParticipants - getMeetingAgenda - listMeetingMaterials - getMeetingCalendar - getMeetingMinutes - listMeetingItemNotes - listMeetingActionItems - listCommitteeSeries - getMeetingSeries surfaces: - api - job - portal guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-meetings.md - key: committees.meetings.manage intent: >- Maintain meetings, series, attendance, preparation and follow-up proposals. operations: - createMeeting - updateMeeting - addMeetingParticipant - updateMeetingParticipant - recordMeetingAttendance - replaceMeetingAgendaOrder - addAgendaItem - updateAgendaItem - deleteAgendaItem - deferAgendaItem - addMeetingMaterial - deleteMeetingMaterial - publishMeetingAgenda - publishMeetingPacket - closeMeeting - cancelMeeting - saveMeetingMinutes - assembleMeetingMinutes - circulateMeetingMinutes - revertMeetingMinutes - addMeetingItemNote - proposeMeetingActionItem - acceptMeetingActionItem - dismissMeetingActionItem - determineMeetingQuorum - createMeetingSeries - updateMeetingSeries - materializeMeetingSeries surfaces: - api - job guarded_by: - BR-CAP-CMT-MTG-001-04 - BR-CAP-CMT-MTG-001-06 - BR-CAP-CMT-MTG-003-16 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-meetings.md - key: committees.portal.participate intent: >- Participate in permitted meetings, decisions, disclosure and recruitment work as the linked person. operations: - getPortalDecision - castPortalVote - recordPortalRecusal - listMyDecisions - listMyDisclosures - listMyMeetings - getPortalMeeting - answerMeetingInvitation - getPortalMeetingMinutes - expressOpeningInterest - portalNominate surfaces: - api - portal - job guarded_by: - BR-CAP-CMT-MTG-020-01 - BR-CAP-CMT-MTG-020-03 - BR-CAP-CMT-MTG-020-05 - BR-CAP-CMT-MTG-020-06 - BR-CAP-CMT-MTG-020-07 - BR-CAP-CMT-MTG-020-08 - BR-CAP-CMT-MTG-020-09 - BR-CAP-CMT-MTG-020-13 - BR-CAP-CMT-MTG-015-01 - BR-CAP-CMT-MTG-015-02 - BR-CAP-CMT-MTG-015-03 - BR-CAP-CMT-MTG-015-05 - BR-CAP-CMT-MTG-015-07 - BR-CAP-CMT-MTG-016-06 - BR-CAP-CMT-MTG-018-02 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-decisions.md - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-meetings.md - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-recruitment.md - key: committees.portal.calendar intent: Issue or replace the linked person’s calendar feed credential. operations: - issueCalendarFeedToken surfaces: - api - portal - job guarded_by: &ref_1 - BR-CAP-CMT-MTG-006-07 - BR-CAP-CMT-MTG-006-08 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-meetings.md - key: committees.decisions.read intent: >- Inspect decisions and their votes, recusals and outcomes within confidentiality limits. operations: - listDecisions - getDecision - listDecisionRecusals surfaces: - api - job - portal guarded_by: - BR-CAP-CMT-MTG-013-02 - BR-CAP-CMT-MTG-015-05 - BR-CAP-CMT-MTG-015-06 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-decisions.md - key: committees.decisions.manage intent: >- Maintain motions, voting records, decision outcomes and their governance consequences. operations: - createDecision - openDecision - tableDecision - withdrawDecision - recordDecisionVote - recordDecisionTally - closeDecision - amendDecision - rescindDecision - recordDecisionRecusal - applyCertifiedElection surfaces: - api - job - portal guarded_by: - BR-CAP-CMT-MTG-010-03 - BR-CAP-CMT-MTG-010-05 - BR-CAP-CMT-MTG-010-06 - BR-CAP-CMT-MTG-010-07 - BR-CAP-CMT-MTG-010-08 - BR-CAP-CMT-MTG-010-09 - BR-CAP-CMT-MTG-010-10 - BR-CAP-CMT-MTG-010-11 - BR-CAP-CMT-MTG-010-14 - BR-CAP-CMT-MTG-010-15 - BR-CAP-CMT-MTG-012-01 - BR-CAP-CMT-MTG-012-05 - BR-CAP-CMT-MTG-012-08 - BR-CAP-CMT-MTG-015-01 - BR-CAP-CMT-MTG-015-02 - BR-CAP-CMT-MTG-015-03 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-decisions.md - key: committees.minutes.manage intent: >- Record minutes approval and begin corrections under the committee’s governing rules. operations: - approveMeetingMinutes - correctMeetingMinutes surfaces: - api guarded_by: - BR-CAP-CMT-MTG-008-01 - BR-CAP-CMT-MTG-008-02 - BR-CAP-CMT-MTG-008-03 - BR-CAP-CMT-MTG-008-04 - BR-CAP-CMT-MTG-008-05 - BR-CAP-CMT-MTG-008-10 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-meetings.md - key: committees.openings.read intent: 'Inspect openings, expressed interests, alternates and vacancy forecasts.' operations: - listCommitteeOpenings - getCommitteeOpening - listCommitteeOpeningInterests - getVacancyForecast - listCommitteeOpeningAlternates surfaces: - api - portal - job guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-recruitment.md - key: committees.openings.manage intent: 'Maintain, publish and close openings and draft them from forecasts.' operations: - createCommitteeOpening - createOpeningsFromForecast - updateCommitteeOpening - publishCommitteeOpening - closeCommitteeOpening - cancelCommitteeOpening surfaces: - api - portal - job guarded_by: - BR-CAP-CMT-MTG-016-01 - BR-CAP-CMT-MTG-016-02 - BR-CAP-CMT-MTG-016-03 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-recruitment.md - key: committees.nominations.read intent: Inspect nominations and their review and election standing. operations: - listCommitteeNominations - getCommitteeNomination surfaces: - api - portal guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-recruitment.md - key: committees.nominations.manage intent: 'Maintain nominations and their slate, decline and withdrawal outcomes.' operations: - createCommitteeNomination - updateCommitteeNomination - slateCommitteeNomination - declineCommitteeNomination - withdrawCommitteeNomination surfaces: - api - portal guarded_by: - BR-CAP-CMT-MTG-018-01 - BR-CAP-CMT-MTG-018-02 - BR-CAP-CMT-MTG-018-03 - BR-CAP-CMT-MTG-018-04 - BR-CAP-CMT-MTG-018-09 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-recruitment.md - key: committees.disclosures.read intent: Inspect sensitive conflict disclosures and authorized recusal suggestions. operations: - listConflictDisclosures - getConflictDisclosure surfaces: - api - portal - job guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-decisions.md - key: committees.disclosures.manage intent: Request disclosure forms through Submissions. operations: - requestConflictDisclosure surfaces: - api - portal - job guarded_by: - BR-CAP-CMT-MTG-014-04 provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: - >- rhythm-v2-docs:specs/committees/meetings/design/contracts/SVC-CMT-MTG-decisions.md - key: committees.committee-layouts.read intent: Inspect shared committee form and page layouts through Platform. operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: [] note: >- Platform owns layout operations; this service publishes the keys without owning a layout route. - key: committees.committee-layouts.create intent: Create shared committee form and page layouts through Platform. operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: [] note: >- Platform owns layout operations; this service publishes the keys without owning a layout route. - key: committees.committee-layouts.update intent: Change shared committee form and page layouts through Platform. operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: [] note: >- Platform owns layout operations; this service publishes the keys without owning a layout route. - key: committees.committee-layouts.delete intent: Remove shared committee form and page layouts through Platform. operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-committees:aws/committees.service.ts' operation_sources: [] note: >- Platform owns layout operations; this service publishes the keys without owning a layout route. - key: 'none: the shared health route' intent: Expose the shared health response without a permission grant. operations: - getAppointmentsHealth - getAuthorityHealth - getCommitteesHealth - getSeatsHealth surfaces: - api guarded_by: [] provenance: documented source: >- rhythm-v2-docs:specs/committees/meetings/design/contracts; specs/committees/committees/design/contracts note: >- Access descriptor preserved for literal conformance matching; this is not a published permission and cannot be granted. - key: >- none: the shared health route (the operation name follows the getHealth pattern of the route library) intent: Expose the shared health response without a permission grant. operations: - getDecisionsHealth - getMeetingsHealth - getRecruitmentHealth surfaces: - api guarded_by: [] provenance: documented source: >- rhythm-v2-docs:specs/committees/meetings/design/contracts; specs/committees/committees/design/contracts note: >- Access descriptor preserved for literal conformance matching; this is not a published permission and cannot be granted. - key: 'none: the feed token in the query is the credential' intent: Accept a valid calendar feed token without a signed-in session. operations: - getPersonalCalendarFeed surfaces: - api - portal guarded_by: *ref_1 provenance: documented source: >- rhythm-v2-docs:specs/committees/meetings/design/contracts; specs/committees/committees/design/contracts note: >- Access descriptor preserved for literal conformance matching; this is not a published permission and cannot be granted. - key: 'none: public meetings only' intent: Expose only information allowed by public visibility. operations: - getDirectoryMeeting surfaces: - api - portal guarded_by: - BR-CAP-CMT-MTG-020-02 provenance: documented source: >- rhythm-v2-docs:specs/committees/meetings/design/contracts; specs/committees/committees/design/contracts note: >- Access descriptor preserved for literal conformance matching; this is not a published permission and cannot be granted. - key: 'none: public listings only' intent: Expose only information allowed by public visibility. operations: - listPublicOpenings - getPublicOpening surfaces: - api - portal guarded_by: - BR-CAP-CMT-MTG-016-06 provenance: documented source: >- rhythm-v2-docs:specs/committees/meetings/design/contracts; specs/committees/committees/design/contracts note: >- Access descriptor preserved for literal conformance matching; this is not a published permission and cannot be granted. staff_access: >- Platform requires an active staff-access grant with an ordinary scoped role assignment for customer work; HQ authority alone does not supply committee access. evidence: - provenance: observed source: 'services-committees:aws/committees.service.ts' supports: >- Published permission groups, tiers, unit resource declarations and sensitive disclosure read. - provenance: observed source: 'services-committees:modules/committees/aws/api/committees.routes.ts' supports: 'Operation permissions and public, portal and console access declarations.' - provenance: observed source: 'services-committees:modules/seats/aws/api/seats.routes.ts' supports: 'Operation permissions and public, portal and console access declarations.' - provenance: observed source: 'services-committees:modules/appointments/aws/api/appointments.routes.ts' supports: 'Operation permissions and public, portal and console access declarations.' - provenance: observed source: 'services-committees:modules/authority/aws/api/authority.routes.ts' supports: 'Operation permissions and public, portal and console access declarations.' - provenance: observed source: 'services-committees:modules/meetings/aws/api/meetings.routes.ts' supports: 'Operation permissions and public, portal and console access declarations.' - provenance: observed source: 'services-committees:modules/decisions/aws/api/decisions.routes.ts' supports: 'Operation permissions and public, portal and console access declarations.' - provenance: observed source: 'services-committees:modules/recruitment/aws/api/recruitment.routes.ts' supports: 'Operation permissions and public, portal and console access declarations.' - provenance: observed source: >- services-committees:lib/http/committees-route.ts:handle; modules/authority/services/persistence/authority-rules.ts:assertRuleMayGrant; modules/decisions/services/rules/decision-visibility.ts; modules/meetings/services/persistence/calendar-feeds.ts supports: >- Server permission evaluation, grant widening checks, confidentiality and feed credentials. - provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md; CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md; CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md; CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md supports: >- Role composition, scoped assignments, evaluation and staff-entry ownership. - provenance: documented source: >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md; specs/platform/security/design/decisions/ADR-PFM-SEC-007-authority-comes-only-from-assignments-signed-per-request-and.md supports: Signed context and bounded cached authority. - provenance: documented source: 'react-console:acceptance/committees/inventory/permissions.json' supports: >- Earlier role-policy mapping seed, not verification of the current deployed catalog. - provenance: unknown source: FND-CMT-CMT-058 supports: >- Current shared policy definitions are not available in the supplied repositories; role slices remain inferred. --- # Committees Authorization Model ## Authorization Boundary Protected committee operations require the application boundary and the operation’s declared permission. Console and portal callers enter through their corresponding authenticated contexts. Services check the key again before running the handler. Public health, public meeting and public opening operations carry no permission grant; the personal calendar feed instead requires its own live credential. Committees publishes no staff-only business permission. Rhythm staff enter customer work through Platform’s recorded staff-access process and the resulting ordinary role assignment. Responsibility routing directs attention to staff without granting record access. Built portal routes and authority functions retain the release questions recorded by their owning modules. ## Scopes Workspace scope is the effective permission boundary for the current protected routes. Platform can supply customer-wide authority covering a workspace. Committee, appointment, seat, opening and nomination permission groups declare organizational-unit scope, but their routes do not supply the resource needed to evaluate a unit grant. A declared unit scope therefore does not establish working unit isolation. The proposed authority engine derives grants over a committee’s unit and descendants. Committee parentage supplies navigation rather than inherited authority. Portal ownership and participation checks narrow a successful route permission to particular people and records; they are guards rather than separately assignable record permissions. ## Roles Administrator and Power User use the application administrator tier; Standard User uses the user tier; Read Only uses the read tier. These names describe the Committees portion of Platform roles, not separate committee offices. Portal Member supplies no committee permission by itself, so additional grants are necessary for committee portal work. Being a chair or liaison supplies only the meeting-role guards that explicitly recognize that relationship. The matrix is an inferred composition of the declared permission tiers and the landed Platform policy model, checked against the earlier console inventory. Current shared policy definitions and deployed assignments are unavailable in the supplied repositories. In particular, the sensitive disclosure read and portal-related read keys require policy verification before this matrix is treated as a verified entitlement record. Customer-defined roles and explicit denies can change an individual’s effective access. ## Permission Catalogue The structured catalogue records exact keys, operation bindings, surfaces and references to additional guards. Application entry supplies no record-management power. Configuration management also covers proposed authority-rule changes and manual reconciliation. Layout administration is delegated to Platform and has no operation owned by this service. Meeting, decision and recruitment operations declare console API access, but that declaration does not establish a built console screen. Their service contracts retain the deferred hosting boundary. Public access descriptions appear separately below because the conformance checker compares the literal service-contract permission field; those descriptions are neither permission keys nor role entitlements. | Permission | Purpose | |---|---| | `committees.application.access` | Enter the Committees application without gaining record management authority. | | `committees.configuration.read` | Inspect committee types, positions, settings and proposed authority rules. | | `committees.configuration.manage` | Maintain shared committee configuration and proposed authority mappings and request authority reconciliation. | | `committees.committees.read` | Inspect bodies, calendars, places, relationships and governance information. | | `committees.committees.manage` | Maintain bodies, terms and relationships and record committee closure. | | `committees.appointments.read` | Inspect dated participation, its history, bulk-job progress and audit rosters. | | `committees.appointments.manage` | Record and change participation and answer offers on behalf of participants. | | `committees.seats.manage` | Maintain committee places and their effective standing. | | `committees.self.read` | Inspect own participation and answer own offers through the portal. | | `committees.rosters.read` | Read committee information, rosters and openings within portal visibility limits. | | `committees.authority.read` | Inspect the explanation of appointment-derived Platform access. | | `committees.meetings.read` | Inspect meetings, series, participants, agendas, papers and minutes. | | `committees.meetings.manage` | Maintain meetings, series, attendance, preparation and follow-up proposals. | | `committees.portal.participate` | Participate in permitted meetings, decisions, disclosure and recruitment work as the linked person. | | `committees.portal.calendar` | Issue or replace the linked person’s calendar feed credential. | | `committees.decisions.read` | Inspect decisions and their votes, recusals and outcomes within confidentiality limits. | | `committees.decisions.manage` | Maintain motions, voting records, decision outcomes and their governance consequences. | | `committees.minutes.manage` | Record minutes approval and begin corrections under the committee’s governing rules. | | `committees.openings.read` | Inspect openings, expressed interests, alternates and vacancy forecasts. | | `committees.openings.manage` | Maintain, publish and close openings and draft them from forecasts. | | `committees.nominations.read` | Inspect nominations and their review and election standing. | | `committees.nominations.manage` | Maintain nominations and their slate, decline and withdrawal outcomes. | | `committees.disclosures.read` | Inspect sensitive conflict disclosures and authorized recusal suggestions. | | `committees.disclosures.manage` | Request disclosure forms through Submissions. | | `committees.committee-layouts.read` | Inspect shared committee form and page layouts through Platform. | | `committees.committee-layouts.create` | Create shared committee form and page layouts through Platform. | | `committees.committee-layouts.update` | Change shared committee form and page layouts through Platform. | | `committees.committee-layouts.delete` | Remove shared committee form and page layouts through Platform. | | Public Access Descriptor | Access Basis | |---|---| | none: the shared health route | Expose the shared health response without a permission grant. | | none: the shared health route (the operation name follows the getHealth pattern of the route library) | Expose the shared health response without a permission grant. | | none: the feed token in the query is the credential | Accept a valid calendar feed token without a signed-in session. | | none: public meetings only | Expose only information allowed by public visibility. | | none: public listings only | Expose only information allowed by public visibility. | ## Role Entitlement Matrix The columns show the inferred committee permission slice before scope, conditions, explicit denies and record guards apply. A dash supplies no grant. The portal column represents the built-in Portal Member role before any additional assignment. | Permission | Administrator | Power User | Standard User | Read Only | Portal Member | |---|---|---|---|---|---| | `committees.application.access` | Yes | Yes | Yes | Yes | — | | `committees.configuration.read` | Yes | Yes | Yes | Yes | — | | `committees.configuration.manage` | Yes | Yes | — | — | — | | `committees.committees.read` | Yes | Yes | Yes | Yes | — | | `committees.committees.manage` | Yes | Yes | Yes | — | — | | `committees.appointments.read` | Yes | Yes | Yes | Yes | — | | `committees.appointments.manage` | Yes | Yes | Yes | — | — | | `committees.seats.manage` | Yes | Yes | Yes | — | — | | `committees.self.read` | Yes | Yes | Yes | Yes | — | | `committees.rosters.read` | Yes | Yes | Yes | Yes | — | | `committees.authority.read` | Yes | Yes | Yes | Yes | — | | `committees.meetings.read` | Yes | Yes | Yes | Yes | — | | `committees.meetings.manage` | Yes | Yes | Yes | — | — | | `committees.portal.participate` | Yes | Yes | Yes | Yes | — | | `committees.portal.calendar` | Yes | Yes | Yes | Yes | — | | `committees.decisions.read` | Yes | Yes | Yes | Yes | — | | `committees.decisions.manage` | Yes | Yes | Yes | — | — | | `committees.minutes.manage` | Yes | Yes | Yes | — | — | | `committees.openings.read` | Yes | Yes | Yes | Yes | — | | `committees.openings.manage` | Yes | Yes | Yes | — | — | | `committees.nominations.read` | Yes | Yes | Yes | Yes | — | | `committees.nominations.manage` | Yes | Yes | Yes | — | — | | `committees.disclosures.read` | Yes | Yes | Yes | Yes | — | | `committees.disclosures.manage` | Yes | Yes | Yes | — | — | | `committees.committee-layouts.read` | Yes | Yes | Yes | Yes | — | | `committees.committee-layouts.create` | Yes | Yes | — | — | — | | `committees.committee-layouts.update` | Yes | Yes | — | — | — | | `committees.committee-layouts.delete` | Yes | Yes | — | — | — | ## Protected Actions Authority-rule saves that put a rule in force or widen access also ask Platform whether the editor may grant the mapped role. Inactive or portal-disabled rules do not take that same in-force check. Authority inspection and reconciliation do not make the caller an access administrator. Offer responses require the caller’s own linked participation on portal paths. Portal voting, recusal, attendance and invitation responses require the relevant person or meeting relationship after permission evaluation. Confidential decision reads also evaluate management authority; disclosure-derived suggestions require disclosure read authority. Approval, dissolution, recruitment transitions and decision consequences retain their capability guards. Direct minutes approval currently records the permission-bearing caller without verifying chair status; the owning module keeps the approving-authority question open. No evidence establishes a general second-approver requirement for this area. ## Guards Distinguished From Permissions Permissions are assignable powers evaluated against scoped Platform authority. Guards test the particular record and proposed action: ownership, visibility, participation, eligibility, current standing, version, valid dates or the editor’s ability to grant a mapped role. A guard cannot grant a missing permission. A successful permission check does not bypass a guard. The calendar feed token is a credential for a specific person’s feed, not a role permission. Issuing a replacement revokes the earlier live token; the store retains its hash rather than the token itself. Public visibility likewise supplies a record eligibility test rather than a role grant. ## What People See When Refused Missing operation authority returns a forbidden response. Inaccessible confidential decisions and visibility-limited portal records appear missing, so callers do not learn their protected content. Invalid or revoked feed credentials also receive a missing-feed response. Validation failures explain the rejected action, while stale versions and records still in use return conflict or domain refusals. The existing committee screens hide unavailable change controls and present read-only states or service errors. Meetings, decision and recruitment API refusals do not establish a corresponding built screen experience. Platform’s gateway decisions can remain cached for sixty seconds, with signed context valid for thirty seconds beyond that bound; grant withdrawal must not be described as an immediate cutoff.