--- id: AUTH-CRM title: CRM Authorization Model product_area: crm revision: 1 status: draft design_intent: proposed implementation_evidence: observed source_sha: services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 rhythm-v2-docs: 74bec48899048f6472ba876a4c2f9da463bd071f scopes: - name: customer meaning: Platform customer-wide assignments can reach that customer’s workspaces. provenance: documented source: BR-CAP-PFM-SEC-010-03 - name: workspace meaning: CRM record operations act within the workspace authorized for the request. provenance: observed source: 'services-crm:aws/crm.service.ts:RECORD_TIERS' - name: record meaning: >- Selected history and merge inspection paths check reach to the identified record in addition to the operation permission. provenance: observed source: 'services-crm:modules/merges/aws/api/merges.routes.ts:requireRecordRead' roles: - id: ROLE-CRM-001 name: Administrator who: A customer security administrator responsible for the workspace. grants: - crm.activities.bulk - crm.activities.create - crm.activities.delete - crm.activities.history - crm.activities.query - crm.activities.read - crm.activities.update - crm.activity-types.bulk - crm.activity-types.create - crm.activity-types.delete - crm.activity-types.read - crm.activity-types.update - crm.address-types.bulk - crm.address-types.create - crm.address-types.delete - crm.address-types.read - crm.address-types.update - crm.affiliation-types.bulk - crm.affiliation-types.create - crm.affiliation-types.delete - crm.affiliation-types.read - crm.affiliation-types.set-default - crm.affiliation-types.update - crm.application.access - crm.contact-layouts.bulk - crm.contact-layouts.create - crm.contact-layouts.delete - crm.contact-layouts.read - crm.contact-layouts.update - crm.contact-roles.bulk - crm.contact-roles.create - crm.contact-roles.delete - crm.contact-roles.lock - crm.contact-roles.read - crm.contact-roles.unlock - crm.contact-roles.update - crm.contact-types.bulk - crm.contact-types.create - crm.contact-types.delete - crm.contact-types.read - crm.contact-types.update - crm.contacts.archive - crm.contacts.bulk - crm.contacts.create - crm.contacts.create-despite-duplicate-block - crm.contacts.delete - crm.contacts.history - crm.contacts.lock - crm.contacts.merge - crm.contacts.query - crm.contacts.read - crm.contacts.unlock - crm.contacts.update - crm.duplicates.configure - crm.duplicates.read - crm.duplicates.review - crm.merges.read - crm.organization-layouts.bulk - crm.organization-layouts.create - crm.organization-layouts.delete - crm.organization-layouts.read - crm.organization-layouts.update - crm.organization-types.bulk - crm.organization-types.create - crm.organization-types.delete - crm.organization-types.read - crm.organization-types.update - crm.organizations.archive - crm.organizations.bulk - crm.organizations.create - crm.organizations.create-despite-duplicate-block - crm.organizations.delete - crm.organizations.history - crm.organizations.lock - crm.organizations.merge - crm.organizations.query - crm.organizations.read - crm.organizations.unlock - crm.organizations.update - crm.phone-number-types.bulk - crm.phone-number-types.create - crm.phone-number-types.delete - crm.phone-number-types.read - crm.phone-number-types.update - crm.regions.bulk - crm.regions.create - crm.regions.delete - crm.regions.read - crm.regions.recalculate - crm.regions.update - crm.task-queues.bulk - crm.task-queues.create - crm.task-queues.delete - crm.task-queues.read - crm.task-queues.update - crm.task-types.bulk - crm.task-types.create - crm.task-types.delete - crm.task-types.read - crm.task-types.update - crm.tasks.bulk - crm.tasks.create - crm.tasks.delete - crm.tasks.query - crm.tasks.read - crm.tasks.update provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-07 - id: ROLE-CRM-002 name: Power User who: A colleague who administers application information without customer security administration. grants: - crm.activities.bulk - crm.activities.create - crm.activities.delete - crm.activities.history - crm.activities.query - crm.activities.read - crm.activities.update - crm.activity-types.bulk - crm.activity-types.create - crm.activity-types.delete - crm.activity-types.read - crm.activity-types.update - crm.address-types.bulk - crm.address-types.create - crm.address-types.delete - crm.address-types.read - crm.address-types.update - crm.affiliation-types.bulk - crm.affiliation-types.create - crm.affiliation-types.delete - crm.affiliation-types.read - crm.affiliation-types.set-default - crm.affiliation-types.update - crm.application.access - crm.contact-layouts.bulk - crm.contact-layouts.create - crm.contact-layouts.delete - crm.contact-layouts.read - crm.contact-layouts.update - crm.contact-roles.bulk - crm.contact-roles.create - crm.contact-roles.delete - crm.contact-roles.lock - crm.contact-roles.read - crm.contact-roles.unlock - crm.contact-roles.update - crm.contact-types.bulk - crm.contact-types.create - crm.contact-types.delete - crm.contact-types.read - crm.contact-types.update - crm.contacts.archive - crm.contacts.bulk - crm.contacts.create - crm.contacts.create-despite-duplicate-block - crm.contacts.delete - crm.contacts.history - crm.contacts.lock - crm.contacts.merge - crm.contacts.query - crm.contacts.read - crm.contacts.unlock - crm.contacts.update - crm.duplicates.configure - crm.duplicates.read - crm.duplicates.review - crm.merges.read - crm.organization-layouts.bulk - crm.organization-layouts.create - crm.organization-layouts.delete - crm.organization-layouts.read - crm.organization-layouts.update - crm.organization-types.bulk - crm.organization-types.create - crm.organization-types.delete - crm.organization-types.read - crm.organization-types.update - crm.organizations.archive - crm.organizations.bulk - crm.organizations.create - crm.organizations.create-despite-duplicate-block - crm.organizations.delete - crm.organizations.history - crm.organizations.lock - crm.organizations.merge - crm.organizations.query - crm.organizations.read - crm.organizations.unlock - crm.organizations.update - crm.phone-number-types.bulk - crm.phone-number-types.create - crm.phone-number-types.delete - crm.phone-number-types.read - crm.phone-number-types.update - crm.regions.bulk - crm.regions.create - crm.regions.delete - crm.regions.read - crm.regions.recalculate - crm.regions.update - crm.task-queues.bulk - crm.task-queues.create - crm.task-queues.delete - crm.task-queues.read - crm.task-queues.update - crm.task-types.bulk - crm.task-types.create - crm.task-types.delete - crm.task-types.read - crm.task-types.update - crm.tasks.bulk - crm.tasks.create - crm.tasks.delete - crm.tasks.query - crm.tasks.read - crm.tasks.update provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-07 - id: ROLE-CRM-003 name: Standard User who: A colleague who performs ordinary application work. grants: - crm.activities.create - crm.activities.delete - crm.activities.history - crm.activities.query - crm.activities.read - crm.activities.update - crm.activity-types.read - crm.address-types.read - crm.affiliation-types.create - crm.affiliation-types.read - crm.affiliation-types.update - crm.application.access - crm.contact-layouts.read - crm.contact-roles.create - crm.contact-roles.read - crm.contact-roles.update - crm.contact-types.create - crm.contact-types.read - crm.contact-types.update - crm.contacts.create - crm.contacts.history - crm.contacts.query - crm.contacts.read - crm.contacts.update - crm.duplicates.read - crm.duplicates.review - crm.merges.read - crm.organization-layouts.read - crm.organization-types.create - crm.organization-types.read - crm.organization-types.update - crm.organizations.create - crm.organizations.history - crm.organizations.query - crm.organizations.read - crm.organizations.update - crm.phone-number-types.read - crm.regions.create - crm.regions.read - crm.regions.update - crm.task-queues.read - crm.task-types.read - crm.tasks.create - crm.tasks.query - crm.tasks.read - crm.tasks.update provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-07 - id: ROLE-CRM-004 name: Read Only who: A colleague who inspects application information. grants: - crm.activities.history - crm.activities.query - crm.activities.read - crm.activity-types.read - crm.address-types.read - crm.affiliation-types.read - crm.application.access - crm.contact-layouts.read - crm.contact-roles.read - crm.contact-types.read - crm.contacts.history - crm.contacts.query - crm.contacts.read - crm.organization-layouts.read - crm.organization-types.read - crm.organizations.history - crm.organizations.query - crm.organizations.read - crm.phone-number-types.read - crm.regions.read - crm.task-queues.read - crm.task-types.read - crm.tasks.query - crm.tasks.read provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-07 - id: ROLE-CRM-005 name: Portal Member who: A portal account using the Platform registration boundary. grants: [] provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md#BR-CAP-PFM-SEC-013-07 permissions: - key: crm.activities.bulk intent: Submit bulk work for interaction records. tier: admin operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.activities.create intent: Create interaction records. tier: user operations: - createActivity surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ACT-001-03 - BR-CAP-CRM-ACT-002-01 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activities.delete intent: Remove interaction records. tier: user operations: - deleteActivity surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ACT-003-06 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activities.history intent: Inspect past values of interaction records. tier: read operations: - listActivityHistory - getActivityRevision - listActivityHistoryActors surfaces: - api - console guarded_by: - BR-CAP-CRM-ACT-006-01 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activities.query intent: Explore and query interaction records. tier: read operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform Queries consumes this dataset key. - key: crm.activities.read intent: Read interaction records. tier: read operations: - getActivity - listActivityHistory - getActivityRevision - listActivityHistoryActors - getContactTimeline - getOrganizationTimeline - getContactTimelineSummary - getOrganizationTimelineSummary surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activities.update intent: Maintain interaction records. tier: user operations: - updateActivity - patchActivity - getContactTimeline - getOrganizationTimeline surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ACT-003-01 - BR-CAP-CRM-ACT-003-06 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activity-types.bulk intent: Submit bulk work for activity classifications. tier: admin operations: [] surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.activity-types.create intent: Create activity classifications. tier: admin operations: - createActivityType surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activity-types.delete intent: Remove activity classifications. tier: admin operations: - deleteActivityType surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activity-types.read intent: Read activity classifications. tier: read operations: - listActivityTypes - getActivityType surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.activity-types.update intent: Maintain activity classifications. tier: admin operations: - reorderActivityTypes - updateActivityType surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ACT-008-11 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.address-types.bulk intent: Submit bulk work for address classifications. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.address-types.create intent: Create address classifications. tier: admin operations: - createAddressType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.address-types.delete intent: Remove address classifications. tier: admin operations: - deleteAddressType surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.address-types.read intent: Read address classifications. tier: read operations: - listAddressTypes - getAddressType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.address-types.update intent: Maintain address classifications. tier: admin operations: - reorderAddressTypes - updateAddressType - patchAddressType surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.affiliation-types.bulk intent: Submit bulk work for affiliation classifications. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.affiliation-types.create intent: Create affiliation classifications. tier: user operations: - createAffiliationType surfaces: - api - console - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.affiliation-types.delete intent: Remove affiliation classifications. tier: admin operations: - deleteAffiliationType surfaces: - api - console - portal guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.affiliation-types.read intent: Read affiliation classifications. tier: read operations: - listAffiliationTypes - getAffiliationType - getCrmSettings surfaces: - api - console - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.affiliation-types.set-default intent: Choose the default kind of affiliation classifications. tier: admin operations: - patchCrmSettings surfaces: - api - console - portal guarded_by: - BR-CAP-CRM-ENT-017-06 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.affiliation-types.update intent: Maintain affiliation classifications. tier: user operations: - updateAffiliationType - patchAffiliationType surfaces: - api - console - portal guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.application.access intent: Open CRM. tier: read operations: [] surfaces: - api - console guarded_by: - BR-CAP-PFM-SEC-015-09 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.contact-layouts.bulk intent: Submit bulk work for contact presentation definitions. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform owns definition administration; CRM owns default selection and consumption. - key: crm.contact-layouts.create intent: Create contact presentation definitions. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform owns definition administration; CRM owns default selection and consumption. - key: crm.contact-layouts.delete intent: Remove contact presentation definitions. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform owns definition administration; CRM owns default selection and consumption. - key: crm.contact-layouts.read intent: Read contact presentation definitions. tier: read operations: - getCrmSettings surfaces: - api - console - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-layouts.update intent: Maintain contact presentation definitions. tier: admin operations: - patchCrmSettings surfaces: - api - console - portal guarded_by: - BR-CAP-CRM-ENT-019-02 - BR-CAP-CRM-ENT-019-03 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-roles.bulk intent: Submit bulk work for organizational contact roles. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.contact-roles.create intent: Create organizational contact roles. tier: user operations: - createContactRole surfaces: - api - console - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-roles.delete intent: Remove organizational contact roles. tier: admin operations: - deleteContactRole surfaces: - api - console - portal guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-roles.lock intent: Apply record locks to organizational contact roles. tier: admin operations: - lockContactRole surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-roles.read intent: Read organizational contact roles. tier: read operations: - listContactRoles - getContactRole - listContactRoleLockChanges surfaces: - api - console - job - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-roles.unlock intent: Release record locks on organizational contact roles. tier: admin operations: - unlockContactRole surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-roles.update intent: Maintain organizational contact roles. tier: user operations: - reorderContactRoles - updateContactRole - patchContactRole surfaces: - api - console - portal guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-types.bulk intent: Submit bulk work for contact classifications. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.contact-types.create intent: Create contact classifications. tier: user operations: - createContactType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-types.delete intent: Remove contact classifications. tier: admin operations: - deleteContactType surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-types.read intent: Read contact classifications. tier: read operations: - listContactTypes - getContactType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contact-types.update intent: Maintain contact classifications. tier: user operations: - reorderContactTypes - updateContactType - patchContactType surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.archive intent: Archive and restore people. tier: admin operations: - archiveContact - unarchiveContact surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-013-02 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.bulk intent: Submit bulk work for people. tier: admin operations: - reconcileAffiliationDates surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.create intent: Create people. tier: user operations: - createContact surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-001-11 - BR-CAP-CRM-ENT-001-12 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.create-despite-duplicate-block intent: Create despite blocking duplicate evidence for people. tier: admin operations: - createContact surfaces: - api - console guarded_by: - BR-CAP-CRM-DQ-004-06 - BR-CAP-CRM-DQ-004-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.delete intent: Remove people. tier: admin operations: - deleteContact surfaces: - api - job - console guarded_by: - BR-CAP-CRM-ENT-014-04 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.history intent: Inspect past values of people. tier: read operations: - listContactHistory - listContactHistoryActors - getContactRevision - listMergedContactHistory - listMergedContactHistoryActors - getMergedContactRevision surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-016-02 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.lock intent: Apply record locks to people. tier: admin operations: - lockContact surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-06 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.merge intent: Prepare and execute combinations of people. tier: admin operations: - createMergePlan - listMergePlans - getMergeLimits - getMergePlan - updateMergePlan - validateMergePlan - executeMergePlan surfaces: - api - job - console guarded_by: - BR-CAP-CRM-DQ-012-01 - BR-CAP-CRM-DQ-012-02 - BR-CAP-CRM-DQ-016-01 - BR-CAP-CRM-DQ-016-02 - BR-CAP-CRM-DQ-016-06 - BR-CAP-CRM-DQ-016-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.query intent: Explore and query people. tier: read operations: [] surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-003-11 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform Queries consumes this dataset key. - key: crm.contacts.read intent: Read people. tier: read operations: - getContactTimeline - getContactTimelineSummary - createMergePlan - listMergePlans - getMergeLimits - getMergePlan - updateMergePlan - validateMergePlan - executeMergePlan - listMergesIntoRecord - getMergeIntoRecord - listContacts - recursivelyListContactsForOrganizationId - getContact - getContactMailingAddress - listContactHistory - listContactHistoryActors - getContactRevision - listMergedContactHistory - listMergedContactHistoryActors - getMergedContactRevision - listContactLockChanges - listOrganizationAffiliations - getEffectiveDefinitions - renderEmailPreview surfaces: - api - console - job - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.unlock intent: Release record locks on people. tier: admin operations: - updateContact - patchContact - unlockContact surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-06 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.contacts.update intent: Maintain people. tier: user operations: - updateContact - patchContact - verifyContactAddress - relinkContactAddress - removeContactAddress - verifyContactPhoneNumber - relinkContactPhoneNumber - removeContactPhoneNumber surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ENT-004-01 - BR-CAP-CRM-ENT-004-06 - BR-CAP-CRM-ENT-015-05 - BR-CAP-CRM-REG-009-05 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.duplicates.configure intent: Maintain matching policy for duplicate evidence. tier: admin operations: - startDuplicateRescan - listDuplicateRescans - getDuplicateRescan - listDuplicateRules - updateDuplicateRule surfaces: - api - console - job guarded_by: - BR-CAP-CRM-DQ-003-06 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.duplicates.read intent: Read duplicate evidence. tier: user operations: - listDuplicateGroups - getDuplicateGroup - getDuplicateSummary - listDuplicateCandidates - getDuplicateCandidate - listRecordDuplicateCandidates - checkForDuplicates surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.duplicates.review intent: Decide whether identities match in duplicate evidence. tier: user operations: - dismissDuplicateGroup - restoreDuplicateGroupDismissal - addManualDuplicateCandidate - dismissDuplicateCandidate - restoreDuplicateCandidate surfaces: - api - console guarded_by: - BR-CAP-CRM-DQ-009-03 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.merges.read intent: Read retained merge outcomes. tier: user operations: - listRecordMerges - getRecordMerge - getRecordMergeDetails - listMergesIntoRecord - getMergeIntoRecord - getMergedRecordAlias surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organization-layouts.bulk intent: Submit bulk work for organization presentation definitions. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform owns definition administration; CRM owns default selection and consumption. - key: crm.organization-layouts.create intent: Create organization presentation definitions. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform owns definition administration; CRM owns default selection and consumption. - key: crm.organization-layouts.delete intent: Remove organization presentation definitions. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform owns definition administration; CRM owns default selection and consumption. - key: crm.organization-layouts.read intent: Read organization presentation definitions. tier: read operations: - getCrmSettings surfaces: - api - console - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organization-layouts.update intent: Maintain organization presentation definitions. tier: admin operations: - patchCrmSettings surfaces: - api - console - portal guarded_by: - BR-CAP-CRM-ENT-019-02 - BR-CAP-CRM-ENT-019-03 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organization-types.bulk intent: Submit bulk work for organization classifications. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.organization-types.create intent: Create organization classifications. tier: user operations: - createOrganizationType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organization-types.delete intent: Remove organization classifications. tier: admin operations: - deleteOrganizationType surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organization-types.read intent: Read organization classifications. tier: read operations: - listOrganizationTypes - getOrganizationType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organization-types.update intent: Maintain organization classifications. tier: user operations: - reorderOrganizationTypes - updateOrganizationType - patchOrganizationType - renderEmailPreview surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.archive intent: Archive and restore organizations. tier: admin operations: - archiveOrganization - unarchiveOrganization surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-013-02 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.bulk intent: Submit bulk work for organizations. tier: admin operations: [] surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.organizations.create intent: Create organizations. tier: user operations: - createOrganization surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-002-11 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.create-despite-duplicate-block intent: Create despite blocking duplicate evidence for organizations. tier: admin operations: - createOrganization surfaces: - api - console guarded_by: - BR-CAP-CRM-DQ-004-06 - BR-CAP-CRM-DQ-004-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.delete intent: Remove organizations. tier: admin operations: - deleteOrganization surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ENT-014-04 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.history intent: Inspect past values of organizations. tier: read operations: - listOrganizationHistory - listOrganizationHistoryActors - getOrganizationRevision surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-016-02 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.lock intent: Apply record locks to organizations. tier: admin operations: - lockOrganization surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-06 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.merge intent: Prepare and execute combinations of organizations. tier: admin operations: - createMergePlan - listMergePlans - getMergeLimits - getMergePlan - updateMergePlan - validateMergePlan - executeMergePlan surfaces: - api - job - console guarded_by: - BR-CAP-CRM-DQ-012-01 - BR-CAP-CRM-DQ-012-02 - BR-CAP-CRM-DQ-016-01 - BR-CAP-CRM-DQ-016-02 - BR-CAP-CRM-DQ-016-06 - BR-CAP-CRM-DQ-016-08 - BR-CAP-CRM-DQ-017-05 - BR-CAP-CRM-DQ-017-09 - BR-CAP-CRM-DQ-017-10 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.query intent: Explore and query organizations. tier: read operations: [] surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-003-11 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform Queries consumes this dataset key. - key: crm.organizations.read intent: Read organizations. tier: read operations: - getOrganizationTimeline - getOrganizationTimelineSummary - createMergePlan - listMergePlans - getMergeLimits - getMergePlan - updateMergePlan - validateMergePlan - executeMergePlan - listMergesIntoRecord - getMergeIntoRecord - listOrganizations - getOrganization - listOrganizationHistory - listOrganizationHistoryActors - getOrganizationRevision - listOrganizationLockChanges - getEffectiveDefinitions - renderEmailPreview surfaces: - api - console - job - portal guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.unlock intent: Release record locks on organizations. tier: admin operations: - updateOrganization - patchOrganization - unlockOrganization surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-06 - BR-CAP-CRM-ENT-015-08 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.organizations.update intent: Maintain organizations. tier: user operations: - updateOrganization - patchOrganization - reprocessCompliance - previewContactRoleComplianceEmail surfaces: - api - console - job guarded_by: - BR-CAP-CRM-ENT-004-01 - BR-CAP-CRM-ENT-004-06 - BR-CAP-CRM-ENT-015-05 - BR-CAP-CRM-REG-009-05 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.phone-number-types.bulk intent: Submit bulk work for phone classifications. tier: admin operations: [] surfaces: - api guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.phone-number-types.create intent: Create phone classifications. tier: admin operations: - createPhoneNumberType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.phone-number-types.delete intent: Remove phone classifications. tier: admin operations: - deletePhoneNumberType surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.phone-number-types.read intent: Read phone classifications. tier: read operations: - listPhoneNumberTypes - getPhoneNumberType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.phone-number-types.update intent: Maintain phone classifications. tier: admin operations: - reorderPhoneNumberTypes - updatePhoneNumberType - patchPhoneNumberType surfaces: - api - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.regions.bulk intent: Submit bulk work for regional definitions and geographic policy. tier: admin operations: - submitRegionsDataJob - listRegionsDataJobs - getRegionsDataJob - readRegionsBySourceKey - listRegionsDataJobResults - listRegionsDataJobRejections - applyRegionsDataJob - pauseRegionsDataJob - resumeRegionsDataJob - cancelRegionsDataJob - retryRegionsDataJob - revalidateRegionsDataJobConflicts surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.regions.create intent: Create regional definitions and geographic policy. tier: user operations: - createRegion surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.regions.delete intent: Remove regional definitions and geographic policy. tier: admin operations: - deleteRegion surfaces: - api - console guarded_by: - BR-CAP-CRM-REG-002-04 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.regions.read intent: Read regional definitions and geographic policy. tier: read operations: - listRegions - getRegion - getRegionAssignmentSettings - listRegionAssignmentRules - previewRegionAssignment - getRegionAssignmentRule - listRegionRecalculations - getRegionRecalculation surfaces: - api - console - job guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.regions.recalculate intent: Recalculate placements for regional definitions and geographic policy. tier: admin operations: - recalculateRegionAssignments surfaces: - api - console - job guarded_by: - BR-CAP-CRM-REG-011-06 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.regions.update intent: Maintain regional definitions and geographic policy. tier: user operations: - updateRegion - patchRegion - updateRegionAssignmentSettings - createRegionAssignmentRule - reorderRegionAssignmentRules - updateRegionAssignmentRule - patchRegionAssignmentRule - deleteRegionAssignmentRule - submitRegionsDataJob - listRegionsDataJobs - getRegionsDataJob - readRegionsBySourceKey - listRegionsDataJobResults - listRegionsDataJobRejections - applyRegionsDataJob - pauseRegionsDataJob - resumeRegionsDataJob - cancelRegionsDataJob - retryRegionsDataJob - revalidateRegionsDataJobConflicts surfaces: - api - console - job guarded_by: - BR-CAP-CRM-REG-001-05 - BR-CAP-CRM-REG-002-04 - BR-CAP-CRM-REG-003-08 - BR-CAP-CRM-REG-005-02 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-queues.bulk intent: Submit bulk work for shared task queues. tier: admin operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.task-queues.create intent: Create shared task queues. tier: admin operations: - createTaskQueue surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-queues.delete intent: Remove shared task queues. tier: admin operations: - deleteTaskQueue surfaces: - api - console guarded_by: - BR-CAP-CRM-ACT-016-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-queues.read intent: Read shared task queues. tier: read operations: - listTaskQueues - getTaskQueue surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-queues.update intent: Maintain shared task queues. tier: admin operations: - reorderTaskQueues - updateTaskQueue - patchTaskQueue surfaces: - api - console guarded_by: - BR-CAP-CRM-ACT-016-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-types.bulk intent: Submit bulk work for task classifications. tier: admin operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.task-types.create intent: Create task classifications. tier: admin operations: - createTaskType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-types.delete intent: Remove task classifications. tier: admin operations: - deleteTaskType surfaces: - api - console guarded_by: - BR-CAP-CRM-ACT-016-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-types.read intent: Read task classifications. tier: read operations: - listTaskTypes - getTaskType surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.task-types.update intent: Maintain task classifications. tier: admin operations: - reorderTaskTypes - updateTaskType - patchTaskType surfaces: - api - console guarded_by: - BR-CAP-CRM-ACT-016-07 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.tasks.bulk intent: Submit bulk work for task work. tier: admin operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Declaration does not establish a local consuming operation. - key: crm.tasks.create intent: Create task work. tier: user operations: - createActivity - createTask - runTaskServiceOperation surfaces: - api - console - job - service guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.tasks.delete intent: Remove task work. tier: admin operations: - deleteTask surfaces: - api - console guarded_by: - BR-CAP-CRM-ACT-010-11 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.tasks.query intent: Explore and query task work. tier: read operations: [] surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Platform Queries consumes this dataset key. - key: crm.tasks.read intent: Read task work. tier: read operations: - getContactTimeline - getOrganizationTimeline - getContactTimelineSummary - getOrganizationTimelineSummary - getTask - listOfferedTasks surfaces: - api - console guarded_by: [] provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: crm.tasks.update intent: Maintain task work. tier: user operations: - getContactTimeline - getOrganizationTimeline - updateTask - patchTask - assignTask - claimTask - releaseTask - completeTask - reopenTask - cancelTask - runTaskServiceOperation surfaces: - api - console - job - service guarded_by: - BR-CAP-CRM-ACT-010-10 - BR-CAP-CRM-ACT-010-11 - BR-CAP-CRM-ACT-011-08 - BR-CAP-CRM-ACT-012-04 - BR-CAP-CRM-ACT-012-05 - BR-CAP-CRM-ACT-012-09 - BR-CAP-CRM-ACT-013-02 - BR-CAP-CRM-ACT-013-06 provenance: observed source: 'services-crm:aws/crm.service.ts' usage: Local operations declare or evaluate this key. - key: >- any of crm.contact-layouts.read, crm.organization-layouts.read, crm.affiliation-types.read; each section or kind is checked by the handler kind: declaration-reference grantable: false component_keys: - crm.contact-layouts.read - crm.organization-layouts.read - crm.affiliation-types.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getCrmSettings surfaces: - console guarded_by: [] provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: >- any of crm.contact-layouts.update, crm.organization-layouts.update, crm.affiliation-types.set-default; each section or kind is checked by the handler kind: declaration-reference grantable: false component_keys: - crm.contact-layouts.update - crm.organization-layouts.update - crm.affiliation-types.set-default intent: Resolve this contract declaration through its component permissions and handler guards. operations: - patchCrmSettings surfaces: - console guarded_by: - BR-CAP-CRM-ENT-019-02 - BR-CAP-CRM-ENT-019-03 - BR-CAP-CRM-ENT-017-06 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: >- any of crm.contacts.merge, crm.contacts.read, crm.organizations.merge, crm.organizations.read admits; the handler requires a complete read and merge pair for at least one record type kind: declaration-reference grantable: false component_keys: - crm.contacts.merge - crm.contacts.read - crm.organizations.merge - crm.organizations.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getMergeLimits surfaces: - console guarded_by: - BR-CAP-CRM-DQ-012-01 - BR-CAP-CRM-DQ-012-02 - BR-CAP-CRM-DQ-016-01 - BR-CAP-CRM-DQ-016-02 - BR-CAP-CRM-DQ-016-06 - BR-CAP-CRM-DQ-016-08 - BR-CAP-CRM-DQ-017-05 - BR-CAP-CRM-DQ-017-09 - BR-CAP-CRM-DQ-017-10 provenance: documented source: - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-merges.md' - key: >- any of crm.contacts.merge, crm.contacts.read, crm.organizations.merge, crm.organizations.read admits; the handler requires the merge and read keys of the plan record type kind: declaration-reference grantable: false component_keys: - crm.contacts.merge - crm.contacts.read - crm.organizations.merge - crm.organizations.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - createMergePlan - listMergePlans - getMergePlan - updateMergePlan - validateMergePlan - executeMergePlan surfaces: - console guarded_by: - BR-CAP-CRM-DQ-012-01 - BR-CAP-CRM-DQ-012-02 - BR-CAP-CRM-DQ-016-01 - BR-CAP-CRM-DQ-016-02 - BR-CAP-CRM-DQ-016-06 - BR-CAP-CRM-DQ-016-08 - BR-CAP-CRM-DQ-017-05 - BR-CAP-CRM-DQ-017-09 - BR-CAP-CRM-DQ-017-10 provenance: documented source: - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-merges.md' - key: 'any of crm.contacts.read, crm.organizations.read; each section or kind is checked by the handler' kind: declaration-reference grantable: false component_keys: - crm.contacts.read - crm.organizations.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getEffectiveDefinitions surfaces: - console guarded_by: [] provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: crm.activities.create (also crm.tasks.create when a follow-up is asked for) kind: declaration-reference grantable: false component_keys: - crm.activities.create - crm.tasks.create intent: Resolve this contract declaration through its component permissions and handler guards. operations: - createActivity surfaces: - console guarded_by: - BR-CAP-CRM-ACT-001-03 - BR-CAP-CRM-ACT-002-01 provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - key: crm.activities.history (evaluates crm.activities.read for a live activity) kind: declaration-reference grantable: false component_keys: - crm.activities.history - crm.activities.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - listActivityHistory - getActivityRevision - listActivityHistoryActors surfaces: - console guarded_by: - BR-CAP-CRM-ACT-006-01 provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - key: crm.activities.read and crm.contacts.read (evaluates crm.tasks.read) kind: declaration-reference grantable: false component_keys: - crm.activities.read - crm.contacts.read - crm.tasks.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getContactTimelineSummary surfaces: - console guarded_by: [] provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - key: >- crm.activities.read and crm.contacts.read (evaluates crm.tasks.read, crm.tasks.update, crm.activities.update) kind: declaration-reference grantable: false component_keys: - crm.activities.read - crm.contacts.read - crm.tasks.read - crm.tasks.update - crm.activities.update intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getContactTimeline surfaces: - console guarded_by: - BR-CAP-CRM-ACT-010-10 - BR-CAP-CRM-ACT-010-11 - BR-CAP-CRM-ACT-011-08 - BR-CAP-CRM-ACT-012-04 - BR-CAP-CRM-ACT-012-05 - BR-CAP-CRM-ACT-012-09 - BR-CAP-CRM-ACT-013-02 - BR-CAP-CRM-ACT-013-06 - BR-CAP-CRM-ACT-003-01 - BR-CAP-CRM-ACT-003-06 provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - key: crm.activities.read and crm.organizations.read (evaluates crm.tasks.read) kind: declaration-reference grantable: false component_keys: - crm.activities.read - crm.organizations.read - crm.tasks.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getOrganizationTimelineSummary surfaces: - console guarded_by: [] provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - key: >- crm.activities.read and crm.organizations.read (evaluates crm.tasks.read, crm.tasks.update, crm.activities.update) kind: declaration-reference grantable: false component_keys: - crm.activities.read - crm.organizations.read - crm.tasks.read - crm.tasks.update - crm.activities.update intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getOrganizationTimeline surfaces: - console guarded_by: - BR-CAP-CRM-ACT-010-10 - BR-CAP-CRM-ACT-010-11 - BR-CAP-CRM-ACT-011-08 - BR-CAP-CRM-ACT-012-04 - BR-CAP-CRM-ACT-012-05 - BR-CAP-CRM-ACT-012-09 - BR-CAP-CRM-ACT-013-02 - BR-CAP-CRM-ACT-013-06 - BR-CAP-CRM-ACT-003-01 - BR-CAP-CRM-ACT-003-06 provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - key: crm.contacts.create (also evaluates crm.contacts.create-despite-duplicate-block) kind: declaration-reference grantable: false component_keys: - crm.contacts.create - crm.contacts.create-despite-duplicate-block intent: Resolve this contract declaration through its component permissions and handler guards. operations: - createContact surfaces: - console guarded_by: - BR-CAP-CRM-ENT-001-11 - BR-CAP-CRM-ENT-001-12 - BR-CAP-CRM-DQ-004-06 - BR-CAP-CRM-DQ-004-07 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: crm.contacts.history (also evaluates crm.contacts.read) kind: declaration-reference grantable: false component_keys: - crm.contacts.history - crm.contacts.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - listContactHistory - listContactHistoryActors - getContactRevision - listMergedContactHistory - listMergedContactHistoryActors - getMergedContactRevision surfaces: - console guarded_by: - BR-CAP-CRM-ENT-016-02 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: >- crm.contacts.read or crm.organizations.read for the path record type, reaching the record; crm.merges.read widens nothing here kind: declaration-reference grantable: false component_keys: - crm.contacts.read - crm.organizations.read - crm.merges.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - listMergesIntoRecord surfaces: - console guarded_by: [] provenance: documented source: - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-merges.md' - key: crm.contacts.read or crm.organizations.read for the path record type; crm.merges.read widens the details kind: declaration-reference grantable: false component_keys: - crm.contacts.read - crm.organizations.read - crm.merges.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - getMergeIntoRecord surfaces: - console guarded_by: [] provenance: documented source: - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-merges.md' - key: crm.contacts.update (also evaluates crm.contacts.unlock) kind: declaration-reference grantable: false component_keys: - crm.contacts.update - crm.contacts.unlock intent: Resolve this contract declaration through its component permissions and handler guards. operations: - updateContact - patchContact surfaces: - console guarded_by: - BR-CAP-CRM-ENT-004-01 - BR-CAP-CRM-ENT-004-06 - BR-CAP-CRM-ENT-015-05 - BR-CAP-CRM-REG-009-05 - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-06 - BR-CAP-CRM-ENT-015-08 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: 'crm.organization-types.update (also evaluates crm.organizations.read, crm.contacts.read)' kind: declaration-reference grantable: false component_keys: - crm.organization-types.update - crm.organizations.read - crm.contacts.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - renderEmailPreview surfaces: - console guarded_by: - BR-CAP-CRM-ENT-018-07 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: crm.organizations.create (also evaluates crm.organizations.create-despite-duplicate-block) kind: declaration-reference grantable: false component_keys: - crm.organizations.create - crm.organizations.create-despite-duplicate-block intent: Resolve this contract declaration through its component permissions and handler guards. operations: - createOrganization surfaces: - console guarded_by: - BR-CAP-CRM-ENT-002-11 - BR-CAP-CRM-DQ-004-06 - BR-CAP-CRM-DQ-004-07 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: crm.organizations.history (also evaluates crm.organizations.read) kind: declaration-reference grantable: false component_keys: - crm.organizations.history - crm.organizations.read intent: Resolve this contract declaration through its component permissions and handler guards. operations: - listOrganizationHistory - listOrganizationHistoryActors - getOrganizationRevision surfaces: - console guarded_by: - BR-CAP-CRM-ENT-016-02 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: crm.organizations.update (also evaluates crm.organizations.unlock) kind: declaration-reference grantable: false component_keys: - crm.organizations.update - crm.organizations.unlock intent: Resolve this contract declaration through its component permissions and handler guards. operations: - updateOrganization - patchOrganization surfaces: - console guarded_by: - BR-CAP-CRM-ENT-004-01 - BR-CAP-CRM-ENT-004-06 - BR-CAP-CRM-ENT-015-05 - BR-CAP-CRM-REG-009-05 - BR-CAP-CRM-ENT-015-02 - BR-CAP-CRM-ENT-015-06 - BR-CAP-CRM-ENT-015-08 provenance: documented source: - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - key: crm.regions.bulk and crm.regions.update (both required) kind: declaration-reference grantable: false component_keys: - crm.regions.bulk - crm.regions.update intent: Resolve this contract declaration through its component permissions and handler guards. operations: - submitRegionsDataJob - listRegionsDataJobs - getRegionsDataJob - readRegionsBySourceKey - listRegionsDataJobResults - listRegionsDataJobRejections - applyRegionsDataJob - pauseRegionsDataJob - resumeRegionsDataJob - cancelRegionsDataJob - retryRegionsDataJob - revalidateRegionsDataJobConflicts surfaces: - console guarded_by: - BR-CAP-CRM-REG-001-05 - BR-CAP-CRM-REG-002-04 - BR-CAP-CRM-REG-003-08 - BR-CAP-CRM-REG-005-02 provenance: documented source: - 'rhythm-v2-docs:specs/crm/regions/design/contracts/SVC-CRM-REG-regions.md' - key: >- crm.tasks.create and crm.tasks.update (service access by invoke grant; evaluated as all for a trusted service) kind: declaration-reference grantable: false component_keys: - crm.tasks.create - crm.tasks.update intent: Resolve this contract declaration through its component permissions and handler guards. operations: - runTaskServiceOperation surfaces: - service guarded_by: - BR-CAP-CRM-ACT-010-10 - BR-CAP-CRM-ACT-010-11 - BR-CAP-CRM-ACT-011-08 - BR-CAP-CRM-ACT-012-04 - BR-CAP-CRM-ACT-012-05 - BR-CAP-CRM-ACT-012-09 - BR-CAP-CRM-ACT-013-02 - BR-CAP-CRM-ACT-013-06 provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-tasks.md' - key: 'none: public health route' kind: declaration-reference grantable: false component_keys: [] intent: Expose service health without customer record access. operations: - getActivitiesHealth - getTasksHealth - getDuplicatesHealth - getMergesHealth - getConfigurationTypesHealth - getEntitiesHealth - getRegionsHealth surfaces: - public guarded_by: [] provenance: documented source: - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-tasks.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-duplicates.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-merges.md' - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-configuration-types.md' - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - 'rhythm-v2-docs:specs/crm/regions/design/contracts/SVC-CRM-REG-regions.md' staff_access: >- Platform grants customer access explicitly through standing, temporary or emergency access; staff HQ authority alone does not grant CRM console access. evidence: - 'services-crm:aws/crm.service.ts' - 'services-crm:modules/entities/aws/api/address-types.routes.ts' - 'services-crm:modules/entities/aws/api/affiliation-types.routes.ts' - 'services-crm:modules/entities/aws/api/collection-types.routes.ts' - 'services-crm:modules/entities/aws/api/contact-roles.routes.ts' - 'services-crm:modules/entities/aws/api/contact-types.routes.ts' - 'services-crm:modules/entities/aws/api/contacts.routes.ts' - 'services-crm:modules/entities/aws/api/crm-settings.routes.ts' - 'services-crm:modules/entities/aws/api/effective-definitions.routes.ts' - 'services-crm:modules/entities/aws/api/email-previews.routes.ts' - 'services-crm:modules/entities/aws/api/entities.routes.ts' - 'services-crm:modules/entities/aws/api/organization-types.routes.ts' - 'services-crm:modules/entities/aws/api/organizations.routes.ts' - 'services-crm:modules/entities/aws/api/phone-number-types.routes.ts' - 'services-crm:modules/entities/aws/api/record-locks.routes.ts' - 'services-crm:modules/configuration-types/aws/api/configuration-types.routes.ts' - 'services-crm:modules/activities/aws/api/activities.routes.ts' - 'services-crm:modules/tasks/aws/api/task-configurations.routes.ts' - 'services-crm:modules/tasks/aws/api/task-queues.routes.ts' - 'services-crm:modules/tasks/aws/api/task-types.routes.ts' - 'services-crm:modules/tasks/aws/api/tasks-service.routes.ts' - 'services-crm:modules/tasks/aws/api/tasks.routes.ts' - 'services-crm:modules/duplicates/aws/api/duplicates.routes.ts' - 'services-crm:modules/merges/aws/api/merges.routes.ts' - 'services-crm:modules/regions/aws/api/regions.routes.ts' - 'services-crm:modules/tasks/services/persistence/tasks.ts:assignTask,claimTask,rolesHeldBy,holdsRole' - 'services-crm:modules/merges/aws/api/merges.routes.ts:requireMergeAccess,requireRecordRead' - 'react-console:components/tasks/task-detail-sheet.tsx:taskMenuItems,errorMessage' - 'react-console:components/records/create/duplicate-block-refusal.tsx' - 'react-console:components/regions/use-regions.ts:useRegionsPermissions' - 'react-console:components/regions/recalculation.tsx:useRecalculation' - 'rhythm-v2-docs: specs/crm/entities/FINDINGS.md (OQ-CRM-ENT-002 decided 2026-10-22: B; FND-CRM-ENT-016).' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-activities.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/contracts/SVC-CRM-ACT-tasks.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-duplicates.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/contracts/SVC-CRM-DQ-merges.md' - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-configuration-types.md' - 'rhythm-v2-docs:specs/crm/entities/design/contracts/SVC-CRM-ENT-entities.md' - 'rhythm-v2-docs:specs/crm/regions/design/contracts/SVC-CRM-REG-regions.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-001-activities.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-002-activity-link-landing.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-003-record-activity-timeline.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-004-log-or-edit-activity-sheet.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-005-tasks.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-006-task-drawer.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-007-activity-types-configuration.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-008-task-types-configuration.md' - 'rhythm-v2-docs:specs/crm/activities-tasks/design/screens/SCR-CRM-ACT-009-task-queues-configuration.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-001-data-quality-overview.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-002-duplicate-review-queue.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-003-duplicate-group.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-004-dismissed-duplicates.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-005-recently-merged.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-006-merge-details.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-007-start-a-merge.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-008-merge-workspace.md' - 'rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-009-duplicate-rules-configuration.md' - >- rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-010-possible-duplicates-and-merge-on-a-record-page.md - >- rhythm-v2-docs:specs/crm/data-quality/design/screens/SCR-CRM-DQ-011-duplicate-warning-and-block-at-record-creation.md - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-001-contacts-list.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-002-create-contact.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-003-contact-360.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-004-edit-contact.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-005-organizations-list.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-006-create-organization.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-007-organization-360.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-008-contact-types-configuration.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-009-organization-types-configuration.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-010-affiliation-types-configuration.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-011-contact-roles-configuration.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-012-address-types-configuration.md' - 'rhythm-v2-docs:specs/crm/entities/design/screens/SCR-CRM-ENT-013-phone-number-types-configuration.md' - 'rhythm-v2-docs:specs/crm/regions/design/screens/SCR-CRM-REG-001-regions-catalogue.md' - 'rhythm-v2-docs:specs/crm/regions/design/screens/SCR-CRM-REG-002-assignment-rules-view.md' - 'rhythm-v2-docs:specs/crm/regions/design/screens/SCR-CRM-REG-003-assignment-rules-editor.md' - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-007-know-what-i-may-do-in-a-workspace.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-008-invite-people-and-follow-their-invitations.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md - 'rhythm-v2-docs:specs/platform/security/design/contracts/SVC-PFM-SEC-security.md' - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md provenance: observed staff_access_evidence: provenance: documented source: >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md guards: - BR-CAP-PFM-SEC-017-01 - BR-CAP-PFM-SEC-017-07 - BR-CAP-PFM-SEC-017-10 --- # CRM Authorization Model ## Authorization Boundary Customer requests use Platform identity and authorization, followed by CRM’s operation and record guards. Application entry also depends on an active workspace licence and application access. Public health routes disclose service health rather than customer records. Contact-role reads declare portal access; that declaration still requires the named permission and does not grant it to every portal member. Trusted task service calls use the invoking service’s cloud identity and function grant. The task service route is unavailable over ordinary HTTP. Its declared task keys describe the work being delegated; trusted invocation does not borrow a person’s grants. Portal contact matching and login transfer remain coordinated with Platform Security. CRM declares no staff-only permission group. Rhythm staff enter customer work through Platform’s explicit customer-access mechanisms. An HQ staff role alone does not authorize customer console work. Platform retains responsibility for staff grants, their validity, separation and audit. ## Scopes CRM’s ordinary permissions apply at workspace scope. A customer-wide assignment can supply authority across that customer’s workspaces through Platform evaluation. Each CRM operation still acts in the authorized workspace named by its execution context. Record reach is an additional check on live history and record-scoped merge inspection. Organizational affiliations, contact roles, regions and task queues describe customer information or work routing; they do not create an organizational-unit permission scope. The CRM declaration supplies no such scope. Supported narrower grants and their evaluation remain Platform’s responsibility. Cached authorization has a bounded freshness window. Platform documents a sixty-second gateway decision lifetime and signed-context expiry with an additional thirty-second allowance. A requested flush does not establish immediate eviction. Role changes therefore require the Platform propagation contract rather than an assumption of instant CRM refusal. ## Roles The five role rows project Platform’s shipped customer roles onto CRM’s permission catalogue. CRM defines no separate built-in roles or policies. Administrator and Power User receive the application administrator tier; their different customer security and export authority lives in Platform. Standard User receives the user and reader tiers, and Read Only receives the reader tier. Portal Member receives no CRM grant from its built-in policy. Customers can compose their own roles and policies through Platform. Assignments determine scope and validity, and applicable denies take precedence over allows. The matrix describes the shipped role baseline before those assignments, conditions and denies are evaluated. Actor descriptions identify responsibilities rather than additional grant definitions. ## Permission Catalogue The structured catalogue lists each actual key with its declared tier, consuming operations, surfaces and rule references for further restrictions. A declared key with no local operation remains visible as a declaration; it supplies no evidence of an implemented action. Query execution and presentation-definition administration cross into Platform under CRM-owned keys. The service contracts also contain combined permission declarations and a public-health marker. Those entries are retained as non-grantable declaration references for literal contract coverage. Their component keys carry the entitlement; the reference itself is neither published nor assignable. Evaluated keys can narrow a response or authorize a conditional action without being required for initial route entry. ## Role Entitlement Matrix Every row below is an actual permission key. Yes means the shipped CRM tier permits the key before scope, conditions and denies. The two administrator-tier columns do not imply equal authority outside CRM. | Permission | Administrator | Power User | Standard User | Read Only | Portal Member | |---|---|---|---|---|---| | `crm.activities.bulk` | Yes | Yes | — | — | — | | `crm.activities.create` | Yes | Yes | Yes | — | — | | `crm.activities.delete` | Yes | Yes | Yes | — | — | | `crm.activities.history` | Yes | Yes | Yes | Yes | — | | `crm.activities.query` | Yes | Yes | Yes | Yes | — | | `crm.activities.read` | Yes | Yes | Yes | Yes | — | | `crm.activities.update` | Yes | Yes | Yes | — | — | | `crm.activity-types.bulk` | Yes | Yes | — | — | — | | `crm.activity-types.create` | Yes | Yes | — | — | — | | `crm.activity-types.delete` | Yes | Yes | — | — | — | | `crm.activity-types.read` | Yes | Yes | Yes | Yes | — | | `crm.activity-types.update` | Yes | Yes | — | — | — | | `crm.address-types.bulk` | Yes | Yes | — | — | — | | `crm.address-types.create` | Yes | Yes | — | — | — | | `crm.address-types.delete` | Yes | Yes | — | — | — | | `crm.address-types.read` | Yes | Yes | Yes | Yes | — | | `crm.address-types.update` | Yes | Yes | — | — | — | | `crm.affiliation-types.bulk` | Yes | Yes | — | — | — | | `crm.affiliation-types.create` | Yes | Yes | Yes | — | — | | `crm.affiliation-types.delete` | Yes | Yes | — | — | — | | `crm.affiliation-types.read` | Yes | Yes | Yes | Yes | — | | `crm.affiliation-types.set-default` | Yes | Yes | — | — | — | | `crm.affiliation-types.update` | Yes | Yes | Yes | — | — | | `crm.application.access` | Yes | Yes | Yes | Yes | — | | `crm.contact-layouts.bulk` | Yes | Yes | — | — | — | | `crm.contact-layouts.create` | Yes | Yes | — | — | — | | `crm.contact-layouts.delete` | Yes | Yes | — | — | — | | `crm.contact-layouts.read` | Yes | Yes | Yes | Yes | — | | `crm.contact-layouts.update` | Yes | Yes | — | — | — | | `crm.contact-roles.bulk` | Yes | Yes | — | — | — | | `crm.contact-roles.create` | Yes | Yes | Yes | — | — | | `crm.contact-roles.delete` | Yes | Yes | — | — | — | | `crm.contact-roles.lock` | Yes | Yes | — | — | — | | `crm.contact-roles.read` | Yes | Yes | Yes | Yes | — | | `crm.contact-roles.unlock` | Yes | Yes | — | — | — | | `crm.contact-roles.update` | Yes | Yes | Yes | — | — | | `crm.contact-types.bulk` | Yes | Yes | — | — | — | | `crm.contact-types.create` | Yes | Yes | Yes | — | — | | `crm.contact-types.delete` | Yes | Yes | — | — | — | | `crm.contact-types.read` | Yes | Yes | Yes | Yes | — | | `crm.contact-types.update` | Yes | Yes | Yes | — | — | | `crm.contacts.archive` | Yes | Yes | — | — | — | | `crm.contacts.bulk` | Yes | Yes | — | — | — | | `crm.contacts.create` | Yes | Yes | Yes | — | — | | `crm.contacts.create-despite-duplicate-block` | Yes | Yes | — | — | — | | `crm.contacts.delete` | Yes | Yes | — | — | — | | `crm.contacts.history` | Yes | Yes | Yes | Yes | — | | `crm.contacts.lock` | Yes | Yes | — | — | — | | `crm.contacts.merge` | Yes | Yes | — | — | — | | `crm.contacts.query` | Yes | Yes | Yes | Yes | — | | `crm.contacts.read` | Yes | Yes | Yes | Yes | — | | `crm.contacts.unlock` | Yes | Yes | — | — | — | | `crm.contacts.update` | Yes | Yes | Yes | — | — | | `crm.duplicates.configure` | Yes | Yes | — | — | — | | `crm.duplicates.read` | Yes | Yes | Yes | — | — | | `crm.duplicates.review` | Yes | Yes | Yes | — | — | | `crm.merges.read` | Yes | Yes | Yes | — | — | | `crm.organization-layouts.bulk` | Yes | Yes | — | — | — | | `crm.organization-layouts.create` | Yes | Yes | — | — | — | | `crm.organization-layouts.delete` | Yes | Yes | — | — | — | | `crm.organization-layouts.read` | Yes | Yes | Yes | Yes | — | | `crm.organization-layouts.update` | Yes | Yes | — | — | — | | `crm.organization-types.bulk` | Yes | Yes | — | — | — | | `crm.organization-types.create` | Yes | Yes | Yes | — | — | | `crm.organization-types.delete` | Yes | Yes | — | — | — | | `crm.organization-types.read` | Yes | Yes | Yes | Yes | — | | `crm.organization-types.update` | Yes | Yes | Yes | — | — | | `crm.organizations.archive` | Yes | Yes | — | — | — | | `crm.organizations.bulk` | Yes | Yes | — | — | — | | `crm.organizations.create` | Yes | Yes | Yes | — | — | | `crm.organizations.create-despite-duplicate-block` | Yes | Yes | — | — | — | | `crm.organizations.delete` | Yes | Yes | — | — | — | | `crm.organizations.history` | Yes | Yes | Yes | Yes | — | | `crm.organizations.lock` | Yes | Yes | — | — | — | | `crm.organizations.merge` | Yes | Yes | — | — | — | | `crm.organizations.query` | Yes | Yes | Yes | Yes | — | | `crm.organizations.read` | Yes | Yes | Yes | Yes | — | | `crm.organizations.unlock` | Yes | Yes | — | — | — | | `crm.organizations.update` | Yes | Yes | Yes | — | — | | `crm.phone-number-types.bulk` | Yes | Yes | — | — | — | | `crm.phone-number-types.create` | Yes | Yes | — | — | — | | `crm.phone-number-types.delete` | Yes | Yes | — | — | — | | `crm.phone-number-types.read` | Yes | Yes | Yes | Yes | — | | `crm.phone-number-types.update` | Yes | Yes | — | — | — | | `crm.regions.bulk` | Yes | Yes | — | — | — | | `crm.regions.create` | Yes | Yes | Yes | — | — | | `crm.regions.delete` | Yes | Yes | — | — | — | | `crm.regions.read` | Yes | Yes | Yes | Yes | — | | `crm.regions.recalculate` | Yes | Yes | — | — | — | | `crm.regions.update` | Yes | Yes | Yes | — | — | | `crm.task-queues.bulk` | Yes | Yes | — | — | — | | `crm.task-queues.create` | Yes | Yes | — | — | — | | `crm.task-queues.delete` | Yes | Yes | — | — | — | | `crm.task-queues.read` | Yes | Yes | Yes | Yes | — | | `crm.task-queues.update` | Yes | Yes | — | — | — | | `crm.task-types.bulk` | Yes | Yes | — | — | — | | `crm.task-types.create` | Yes | Yes | — | — | — | | `crm.task-types.delete` | Yes | Yes | — | — | — | | `crm.task-types.read` | Yes | Yes | Yes | Yes | — | | `crm.task-types.update` | Yes | Yes | — | — | — | | `crm.tasks.bulk` | Yes | Yes | — | — | — | | `crm.tasks.create` | Yes | Yes | Yes | — | — | | `crm.tasks.delete` | Yes | Yes | — | — | — | | `crm.tasks.query` | Yes | Yes | Yes | Yes | — | | `crm.tasks.read` | Yes | Yes | Yes | Yes | — | | `crm.tasks.update` | Yes | Yes | Yes | — | — | ## Protected Actions Record combination requires the read and merge pair for the plan’s record type. Admitting a request through any route-level key does not satisfy that pair. Participant selection, plan freshness, locks and merge validation remain capability-owned guards. No second approver is established by the examined declarations; a confirmation control is not a separate approval role. Creation past a duplicate block requires the sensitive override key for the record kind and a reason recorded with the creation. Record lock and unlock actions carry separate administrator keys and require a version and reason. Protected system records remain protected even when the caller holds those keys. The ordinary-lock exceptions for other CRM records remain findings. Role-offered work requires task update authority and confirmation that the claimant holds the offered role when the task is outside a queue. Queued work follows queue claim guards even when a role is also named. Closing state, existing holders and locks can refuse authorized task work. Regional imports require both regional bulk and update authority, while workspace-wide recalculation requires its dedicated administrator key. History and merge outcomes have distinct access boundaries. Live record history includes record reach; deleted history uses its history permission. Retained merge outcomes use the user-tier merge-read key, while a record-scoped view can expose a narrower result under that record’s read authority. CRM settings reads filter sections by authority, and settings writes require authority for every requested section. ## Guards Distinguished From Permissions Permissions establish whether a caller may attempt the work. Guards establish whether the target and proposed change are valid now. The catalogue references capability rules for locks, versions, state, workspace references and role-holder checks instead of defining those rules again. A permission never repairs a stale draft or makes a protected record removable. A console visibility alias can admit a page more broadly than its API permits an action. The exact server key and handler guards decide the request. Task ownership and queue responsibility do not confer task permissions, and organizational contact roles do not confer security roles. ## What People See When Refused Missing authentication or an invalid protected identity produces an authentication refusal. Missing grants produce a forbidden response; application-access and licence failures carry client-readable refusal codes. Platform’s refusal metadata identifies the cause and required keys without identifying another person. An inaccessible record is handled within the workspace boundary without exposing another workspace’s information. Once record access is established, a merged identity can return a gone response pointing to its survivor. Stale versions, locks and inapplicable lifecycle actions produce conflict or validation feedback. CRM settings can omit unreadable sections rather than return their contents. The console hides or disables permission-dependent actions where its guards do so, and otherwise presents service feedback. Existing screen findings record alias mismatches and generic task-claim conflict feedback. No uniform screen message or complete CRM access-refusal audit coverage is established by these declarations.