---
id: ADR-CMT-MTG-019
title: Authorize Staff and Member Access on the Server
product_area: committees
module: meetings
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
decision: >-
  Console access is association-wide under route permissions, while member reads
  and actions use server-side participation checks, with extra restrictions for
  confidential decisions and sensitive disclosures.
constrains:
  - DOM-CMT-MTG-001
  - DOM-CMT-MTG-002
  - DOM-CMT-MTG-003
  - DOM-CMT-MTG-004
  - DOM-CMT-MTG-005
  - DOM-CMT-MTG-006
  - SVC-CMT-MTG-meetings
  - SVC-CMT-MTG-decisions
  - SVC-CMT-MTG-recruitment
origin: >-
  CMTE-M1 D11 (Andrew 2026-10-19 18:05 ET),
  services-committees:docs/milestones/CMTE-M1-committees-seats-and-rosters.md#Decisions
alternatives:
  - option: Apply organizational-unit console grants immediately.
    why_not: That requires Platform scope work outside the chosen staff baseline.
  - option: Rely on member screens to hide unauthorized records.
    why_not: A direct operation call could bypass a client-only restriction.
consequences:
  - >-
    Opening and nomination permissions declare an organizational-unit resource
    type that the console routes do not enforce, under recorded temporary
    exceptions.
  - >-
    The meeting projection reports a chair or liaison management flag; it does
    not establish implemented portal attendance-edit routes.
supersedes: []
evidence:
  - >-
    services-committees at 36129c24: aws/committees.service.ts;
    modules/meetings/services/participation/participation-rule.ts;
    modules/decisions/services/rules/decision-visibility.ts; docs/debt/README.md
    DEBT-12
---
# Authorize Staff and Member Access on the Server

## Context

Permission scope and record eligibility are independent boundaries. The recorded staff scope is association-wide, and hidden member records are answered as not found.

## Decision

Console access is association-wide under route permissions, while member reads and actions use server-side participation checks, with extra restrictions for confidential decisions and sensitive disclosures.

## Alternatives Considered

Apply organizational-unit console grants immediately. That requires Platform scope work outside the chosen staff baseline.

Rely on member screens to hide unauthorized records. A direct operation call could bypass a client-only restriction.

## Consequences

Opening and nomination permissions declare an organizational-unit resource type that the console routes do not enforce, under recorded temporary exceptions. The meeting projection reports a chair or liaison management flag; it does not establish implemented portal attendance-edit routes.