--- id: SVC-CRM-ENT-configuration-types title: Classification Types Service Module product_area: crm module: entities repository: services-crm source_module: modules/configuration-types revision: 1 status: draft design_intent: proposed implementation_evidence: observed inference: [] source_sha: services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f owns: [] does_not_own: - >- Entities owns the contact, organization, relationship and role classifications behind these hosted routes; this function introduces no independent record owner. - >- CRM Data Jobs owns the classification import operations hosted on these collection paths. - Platform persists the organization type’s owned communication template. operations: - operation_id: getConfigurationTypesHealth intent: Return availability and build identity for the classification route host. access: public permission: 'none: public health route' realises: [] published_to_submissions: 'not published: reports deployment health and captures no business request.' - operation_id: createOrganizationType intent: >- Add an organization classification with role policy, notification options and separately persisted notice content. access: console permission: crm.organization-types.create realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-012 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: listOrganizationTypes intent: >- Retrieve the paged workspace organization types catalogue in its supported order. access: console permission: crm.organization-types.read realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-012 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: reorderOrganizationTypes intent: Persist a complete new order for organization types atomically. access: console permission: crm.organization-types.update realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: getOrganizationType intent: Retrieve the selected workspace organization type. access: console permission: crm.organization-types.read realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-012 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: updateOrganizationType intent: >- Replace the organization type configuration using its submitted read version. access: console permission: crm.organization-types.update realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-012 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: patchOrganizationType intent: >- Apply only requested organization type changes with a version precondition. access: console permission: crm.organization-types.update realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-012 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: deleteOrganizationType intent: >- Remove the organization type only when its locks and references permit deletion. access: console permission: crm.organization-types.delete realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-012 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: createContactRole intent: Add a workspace contact role using its validated configuration fields. access: console permission: crm.contact-roles.create realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-011 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: listContactRoles intent: >- Retrieve the paged workspace contact roles catalogue in its supported order. access: portal permission: crm.contact-roles.read realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-011 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: reorderContactRoles intent: Persist a complete new order for contact roles atomically. access: console permission: crm.contact-roles.update realises: - CAP-CRM-ENT-017 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: getContactRole intent: Retrieve the selected workspace contact role. access: portal permission: crm.contact-roles.read realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-011 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: updateContactRole intent: Replace the contact role configuration using its submitted read version. access: console permission: crm.contact-roles.update realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-011 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: patchContactRole intent: Apply only requested contact role changes with a version precondition. access: console permission: crm.contact-roles.update realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-011 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: lockContactRole intent: 'Set the contact role customer lock through the reasoned, versioned action.' access: console permission: crm.contact-roles.lock realises: - CAP-CRM-ENT-015 - CAP-CRM-ENT-017 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: unlockContactRole intent: Release the contact role lock through the audited versioned action. access: console permission: crm.contact-roles.unlock realises: - CAP-CRM-ENT-015 - CAP-CRM-ENT-017 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: listContactRoleLockChanges intent: 'Retrieve role lock audit entries with actor, time and reason.' access: console permission: crm.contact-roles.read realises: - CAP-CRM-ENT-015 - CAP-CRM-ENT-017 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: deleteContactRole intent: >- Delete an unlocked contact role with no role-period or compliance-rule references. access: console permission: crm.contact-roles.delete realises: - CAP-CRM-ENT-017 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: createContactType intent: Add a workspace contact type using its validated configuration fields. access: console permission: crm.contact-types.create realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: listContactTypes intent: >- Retrieve the paged workspace contact types catalogue in its supported order. access: console permission: crm.contact-types.read realises: - CAP-CRM-ENT-018 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: reorderContactTypes intent: Persist a complete new order for contact types atomically. access: console permission: crm.contact-types.update realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: getContactType intent: Retrieve the selected workspace contact type. access: console permission: crm.contact-types.read realises: - CAP-CRM-ENT-018 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: updateContactType intent: Replace the contact type configuration using its submitted read version. access: console permission: crm.contact-types.update realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: patchContactType intent: Apply only requested contact type changes with a version precondition. access: console permission: crm.contact-types.update realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: deleteContactType intent: >- Remove the contact type only when its locks and references permit deletion. access: console permission: crm.contact-types.delete realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: createAffiliationType intent: Add a relationship classification and its default contact-point mappings. access: console permission: crm.affiliation-types.create realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-006 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: listAffiliationTypes intent: >- Retrieve the paged workspace affiliation types catalogue in its supported order. access: console permission: crm.affiliation-types.read realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-006 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: getAffiliationType intent: Retrieve the selected workspace affiliation type. access: console permission: crm.affiliation-types.read realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-006 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: updateAffiliationType intent: >- Replace the affiliation type configuration using its submitted read version. access: console permission: crm.affiliation-types.update realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-006 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: patchAffiliationType intent: Apply only requested affiliation type changes with a version precondition. access: console permission: crm.affiliation-types.update realises: - CAP-CRM-ENT-017 - CAP-CRM-ENT-006 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: deleteAffiliationType intent: Delete an unused affiliation type that is not the workspace default. access: console permission: crm.affiliation-types.delete realises: - CAP-CRM-ENT-017 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: createAddressType intent: Add a workspace address type using its validated configuration fields. access: console permission: crm.address-types.create realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: listAddressTypes intent: >- Retrieve the paged workspace address types catalogue in its supported order. access: console permission: crm.address-types.read realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: reorderAddressTypes intent: Persist a complete new order for address types atomically. access: console permission: crm.address-types.update realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: getAddressType intent: Retrieve the selected workspace address type. access: console permission: crm.address-types.read realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: updateAddressType intent: Replace the address type configuration using its submitted read version. access: console permission: crm.address-types.update realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: patchAddressType intent: Apply only requested address type changes with a version precondition. access: console permission: crm.address-types.update realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: deleteAddressType intent: >- Remove the address type only when its locks and references permit deletion. access: console permission: crm.address-types.delete realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: createPhoneNumberType intent: >- Add a workspace phone number type using its validated configuration fields. access: console permission: crm.phone-number-types.create realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: listPhoneNumberTypes intent: >- Retrieve the paged workspace phone number types catalogue in its supported order. access: console permission: crm.phone-number-types.read realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: reorderPhoneNumberTypes intent: Persist a complete new order for phone number types atomically. access: console permission: crm.phone-number-types.update realises: - CAP-CRM-ENT-018 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: getPhoneNumberType intent: Retrieve the selected workspace phone number type. access: console permission: crm.phone-number-types.read realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: >- not published: retrieves or renders existing information rather than accepting a capture. - operation_id: updatePhoneNumberType intent: >- Replace the phone number type configuration using its submitted read version. access: console permission: crm.phone-number-types.update realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: patchPhoneNumberType intent: >- Apply only requested phone number type changes with a version precondition. access: console permission: crm.phone-number-types.update realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' - operation_id: deletePhoneNumberType intent: >- Remove the phone number type only when its locks and references permit deletion. access: console permission: crm.phone-number-types.delete realises: - CAP-CRM-ENT-018 - CAP-CRM-ENT-005 published_to_submissions: 'not published: maintains administrator-controlled workspace configuration.' events: [] jobs: [] integrations: - system: Platform communication templates direction: outbound contract: >- After CRM type persistence, mutate or clear the owned notice template through Platform’s IAM interface; deletion cleanup happens after commit. - system: Platform layouts direction: inbound contract: >- Validate type overrides against workspace-local Platform forms and layouts for the matching record purpose and slot. consistency: - rule: >- Classification rows and their owned policy or mapping rows commit together under the submitted version. kind: transactional compensation: Rollback removes all database changes in the classification transaction. - rule: >- A catalogue reorder submits every required identity and commits all positions together. kind: transactional compensation: Validation or persistence failure leaves the prior order intact. - rule: The type commits before its owned template mutation. kind: eventual compensation: >- A failed template write attempts deletion or versioned restore, which can also fail. Failed template cleanup after deletion is logged without reversal. - rule: >- References prevent deleting catalogue entries still used by the protected dependency kinds. kind: transactional compensation: >- The deletion transaction fails and retains the catalogue record; notification-role arrays lack equivalent protection. evidence: - >- services-crm at 7ea48a41: modules/configuration-types/aws/api/configuration-types.routes.ts, modules/configuration-types/aws/configuration-types.module.ts; modules/entities/aws/api/{organization-types,contact-roles, contact-types,affiliation-types,address-types,phone-number-types,collection-types}.routes.ts (expanded with tsx); modules/entities/services/persistence/{organization-types,contact-roles,contact-types,affiliation-types,collection-types}.ts; aws/crm.service.ts. - >- rhythm-v2-docs: specs/crm/entities/FINDINGS.md (OQ-CRM-ENT-002 decided 2026-10-22: B; FND-CRM-ENT-016). controls: - TC-AZ-001 - TC-AZ-002 - TC-AZ-003 - TC-AZ-004 - TC-AZ-005 - TC-AZ-006 - TC-DAT-001 - TC-DAT-003 - TC-DAT-004 - TC-IAM-001 - TC-IAM-005 - TC-IAM-006 - TC-LOG-001 - TC-LOG-002 - TC-LOG-003 - TC-LOG-004 - TC-LOG-005 - TC-MON-001 - TC-MON-002 - TC-PI-001 - TC-PI-002 - TC-PI-003 - TC-PI-004 - TC-PI-005 - TC-TEN-001 - TC-TEN-002 - TC-TEN-003 narrative: status: verified review: NARRATIVE-REVIEW-2026-10-23 narrative_sources: - section: What This Service Is For provenance: observed source: >- services-crm:modules/entities/aws/api/contact-types.routes.ts; services-crm:modules/entities/aws/api/organization-types.routes.ts; services-crm:modules/entities/aws/api/contact-roles.routes.ts; services-crm:modules/entities/aws/api/affiliation-types.routes.ts; services-crm:modules/entities/aws/api/collection-types.routes.ts - section: Boundary provenance: observed source: >- services-crm:modules/entities/aws/api/contact-types.routes.ts; services-crm:modules/entities/aws/api/organization-types.routes.ts; services-crm:modules/entities/aws/api/contact-roles.routes.ts; services-crm:modules/entities/aws/api/affiliation-types.routes.ts; services-crm:modules/entities/aws/api/collection-types.routes.ts - section: What It Owns provenance: observed source: >- services-crm:modules/entities/aws/api/contact-types.routes.ts; services-crm:modules/entities/aws/api/organization-types.routes.ts; services-crm:modules/entities/aws/api/contact-roles.routes.ts; services-crm:modules/entities/aws/api/affiliation-types.routes.ts; services-crm:modules/entities/aws/api/collection-types.routes.ts - section: Operations in Words provenance: observed source: >- services-crm:modules/entities/aws/api/contact-types.routes.ts; services-crm:modules/entities/aws/api/organization-types.routes.ts; services-crm:modules/entities/aws/api/contact-roles.routes.ts; services-crm:modules/entities/aws/api/affiliation-types.routes.ts; services-crm:modules/entities/aws/api/collection-types.routes.ts - section: Permissions provenance: documented source: 'rhythm-v2-docs:specs/crm/AUTHORIZATION.md#Role Entitlement Matrix' - section: Events and Jobs provenance: observed source: >- services-crm:modules/entities/aws/api/contact-types.routes.ts; services-crm:modules/entities/aws/api/organization-types.routes.ts; services-crm:modules/entities/aws/api/contact-roles.routes.ts; services-crm:modules/entities/aws/api/affiliation-types.routes.ts; services-crm:modules/entities/aws/api/collection-types.routes.ts - section: Consistency Guarantees provenance: observed source: >- services-crm:modules/entities/aws/api/contact-types.routes.ts; services-crm:modules/entities/aws/api/organization-types.routes.ts; services-crm:modules/entities/aws/api/contact-roles.routes.ts; services-crm:modules/entities/aws/api/affiliation-types.routes.ts; services-crm:modules/entities/aws/api/collection-types.routes.ts - section: What This Service Is For provenance: inferred source: >- services-crm at 7ea48a41: modules/configuration-types/aws/api/configuration-types.routes.ts, modules/configuration-types/aws/configuration-types.module.ts; modules/entities/aws/api/{organization-types,contact-roles, contact-types,affiliation-types,address-types,phone-number-types,collection-types}.routes.ts (expanded with tsx); modules/entities/services/persistence/{organization-types,contact-roles,contact-types,affiliation-types,collection-types}.ts; aws/crm.service.ts.; rhythm-v2-docs: specs/crm/entities/FINDINGS.md (OQ-CRM-ENT-002 decided 2026-10-22: B; FND-CRM-ENT-016). note: >- The explicitly labeled rationale interprets ownership and transaction boundaries; existing implementation gaps remain findings. - section: Consistency Guarantees provenance: inferred source: >- services-crm at 7ea48a41: modules/configuration-types/aws/api/configuration-types.routes.ts, modules/configuration-types/aws/configuration-types.module.ts; modules/entities/aws/api/{organization-types,contact-roles, contact-types,affiliation-types,address-types,phone-number-types,collection-types}.routes.ts (expanded with tsx); modules/entities/services/persistence/{organization-types,contact-roles,contact-types,affiliation-types,collection-types}.ts; aws/crm.service.ts.; rhythm-v2-docs: specs/crm/entities/FINDINGS.md (OQ-CRM-ENT-002 decided 2026-10-22: B; FND-CRM-ENT-016). note: >- The explicitly labeled rationale interprets ownership and transaction boundaries; existing implementation gaps remain findings. --- # Classification Types Service Module ## What This Service Is For The classification host serves the configuration vocabulary staff use throughout person and organization work. Contact and organization types shape presentation, affiliation types define kinds of ties and sharing defaults, contact roles define responsibility meaning, and address or phone types define contact-point purposes. The separate route host does not introduce a second product owner. Our reading is that one configuration surface makes definitions reusable while preserving their different effects. An association can define Chapter, Billing Contact and Work Address once and use them across many records. Ownership remains with Entities, and Platform continues to own notice content and presentation definitions referenced by that vocabulary. ## Boundary The host exposes permissioned catalogue operations and a public health response. Most catalogue routes use the console channel; contact-role reads also declare the portal access channel. That channel declaration does not give Portal Member a CRM grant: callers still need the named permission under Platform’s evaluated execution context. Entities owns the catalogues and their policy or mapping children. Platform owns form and layout definitions, file management, security evaluation and the organization type’s notice template. Bulk orchestration belongs to the Data Job Engine and CRM job handlers, rather than being implied by these individual catalogue operations. ## What It Owns This host has no separate domain-object owner entries because it serves catalogue definitions belonging to Entities. Contact and organization classifications hold their presentation assignments; organization types additionally hold role policy and notice configuration. Affiliation types hold sharing mappings, and roles and contact-point types supply reusable local vocabulary. Ownership means callers use these operation and persistence boundaries to change a definition, rather than write its storage directly or treat the hosting function as another module. Platform holds the composed notice template and the referenced forms and layouts. Catalogue locks, references and supported inactivity continue to apply even when another record screen consumes the definitions. ## Operations in Words ### getConfigurationTypesHealth Operations tooling uses the public classification-host health route to identify the available deployment. No record grant is required, and the response does not expose classification administration data. This health check is separate from permissioned catalogue reads and does not establish that Platform template writes are functioning. Permission: none; the public response is limited to host health information. Access channel: public. The dispatcher enforces route authority independently of console visibility. ### createOrganizationType Catalogue administrators or other callers holding the create grant add organization type with role restrictions, coverage bounds, notice settings and per-slot presentation assignments. The route validates identity and record shape; an occupied identity or invalid reference refuses creation. Notice content is validated before CRM persistence and written to Platform afterward, with attempted compensation on later failure. Permission: `crm.organization-types.create` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### listOrganizationTypes Catalogue readers and consuming selectors request a cursor-paged organization types list. Saved display positions precede remaining entries in name order. Invalid cursor or scope inputs and missing read authority are refused. Inactive definitions can remain readable even when consuming new-choice pickers omit them. Permission: `crm.organization-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### reorderOrganizationTypes A catalogue updater supplies the complete ordered identity list for organization types. All positions commit together, affecting later catalogue choices. Missing, duplicated or foreign identities and persistence errors refuse the whole reorder, preserving the previous order. The update grant controls this action; dragging a row on screen does not bypass completeness or workspace checks. Permission: `crm.organization-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### getOrganizationType A configuration editor or consuming reader retrieves one organization type definition with role restrictions, coverage bounds, notice settings and per-slot presentation assignments. The request uses the workspace identity and can project supported fields. Missing read authority or an absent definition is refused rather than returning another workspace’s configuration. Owned notice content is read from Platform-backed template storage and remains distinct from the CRM policy row. Permission: `crm.organization-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### updateOrganizationType A catalogue updater replaces the definition at its submitted read version, including role restrictions, coverage bounds, notice settings and per-slot presentation assignments. Stale reads, mutation locks and invalid record or reference values refuse the write. Platform notice changes follow the CRM transaction; compensation can fail, and existing organization assessments await another trigger or reprocess. Permission: `crm.organization-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### patchOrganizationType A catalogue updater applies version-tested directives to selected fields, including role restrictions, coverage bounds, notice settings and per-slot presentation assignments. Stale reads, mutation locks and invalid record or reference values refuse the write. Platform notice changes follow the CRM transaction; compensation can fail, and existing organization assessments await another trigger or reprocess. Permission: `crm.organization-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### deleteOrganizationType A catalogue delete operator removes an unused organization type. Lock and protected dependency checks can refuse it so existing values retain their definition. Organization references block removal; Platform template cleanup follows CRM commit and a cleanup failure is logged without restoring the type. Permission: `crm.organization-types.delete` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### createContactRole Catalogue administrators or other callers holding the create grant add contact role with responsibility name, description, availability and automatic-assignment settings. The route validates identity and record shape; an occupied identity or invalid reference refuses creation. The created definition becomes available to consuming choices according to its availability and order. Permission: `crm.contact-roles.create` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### listContactRoles Catalogue readers and consuming selectors request a cursor-paged contact roles list. Saved display positions precede remaining entries in name order. Invalid cursor or scope inputs and missing read authority are refused. Inactive definitions can remain readable even when consuming new-choice pickers omit them. Permission: `crm.contact-roles.read` (Administrator, Power User, Standard User, Read Only). Access channel: portal. The dispatcher enforces route authority independently of console visibility. ### reorderContactRoles A catalogue updater supplies the complete ordered identity list for contact roles. All positions commit together, affecting later catalogue choices. Missing, duplicated or foreign identities and persistence errors refuse the whole reorder, preserving the previous order. The update grant controls this action; dragging a row on screen does not bypass completeness or workspace checks. Permission: `crm.contact-roles.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### getContactRole A configuration editor or consuming reader retrieves one contact role definition with responsibility name, description, availability and automatic-assignment settings. The request uses the workspace identity and can project supported fields. Missing read authority or an absent definition is refused rather than returning another workspace’s configuration. Reading the definition alone does not authorize editing existing records that use it. Permission: `crm.contact-roles.read` (Administrator, Power User, Standard User, Read Only). Access channel: portal. The dispatcher enforces route authority independently of console visibility. ### updateContactRole A catalogue updater replaces the definition at its submitted read version, including responsibility name, description, availability and automatic-assignment settings. Stale reads, mutation locks and invalid record or reference values refuse the write. Automatic-setting changes do not create security authority for role holders; dedicated lock administration has its own action. Permission: `crm.contact-roles.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### patchContactRole A catalogue updater applies version-tested directives to selected fields, including responsibility name, description, availability and automatic-assignment settings. Stale reads, mutation locks and invalid record or reference values refuse the write. Automatic-setting changes do not create security authority for role holders; dedicated lock administration has its own action. Permission: `crm.contact-roles.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### lockContactRole An authorized lock operator sets or strengthens the customer restriction with a current read version and required explanation. The dedicated operation can change a full customer lock, but cannot change Rhythm protection. Invalid reasons, lock values, absent subjects or stale versions are refused. The committed audit records actual changed restrictions rather than every unchanged request. Permission: `crm.contact-roles.lock` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### unlockContactRole An authorized unlock operator releases the contact role’s owner restriction using its current version and a nonblank explanation. This operation has no nested-element selection: address and phone element unlocking belongs to contact and organization actions. A stale version or Rhythm protection refuses release. A changed restriction advances the role and records its dedicated lock audit; an unchanged request does not manufacture a lock change. Permission: `crm.contact-roles.unlock` (Administrator, Power User). Access channel: console. The dispatcher checks this authority when the request arrives. ### listContactRoleLockChanges A reader inspects the subject’s lock audit with actor, time, explanation and before-and-after restrictions. These entries explain dedicated safeguard changes rather than all ordinary profile corrections. The corresponding read grant is required; malformed paging or absent subject context can be refused. Reading an audit does not grant lock or unlock authority. Permission: `crm.contact-roles.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### deleteContactRole A catalogue delete operator removes an unused contact role. Lock and protected dependency checks can refuse it so existing values retain their definition. Role periods and compliance-rule references block removal. Recipient-role arrays lack equivalent dependency protection, which remains a finding. Permission: `crm.contact-roles.delete` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### createContactType Catalogue administrators or other callers holding the create grant add contact type with classification name, availability, description and per-slot presentation assignments. The route validates identity and record shape; an occupied identity or invalid reference refuses creation. The created definition becomes available to consuming choices according to its availability and order. Permission: `crm.contact-types.create` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### listContactTypes Catalogue readers and consuming selectors request a cursor-paged contact types list. Saved display positions precede remaining entries in name order. Invalid cursor or scope inputs and missing read authority are refused. Inactive definitions can remain readable even when consuming new-choice pickers omit them. Permission: `crm.contact-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### reorderContactTypes A catalogue updater supplies the complete ordered identity list for contact types. All positions commit together, affecting later catalogue choices. Missing, duplicated or foreign identities and persistence errors refuse the whole reorder, preserving the previous order. The update grant controls this action; dragging a row on screen does not bypass completeness or workspace checks. Permission: `crm.contact-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### getContactType A configuration editor or consuming reader retrieves one contact type definition with classification name, availability, description and per-slot presentation assignments. The request uses the workspace identity and can project supported fields. Missing read authority or an absent definition is refused rather than returning another workspace’s configuration. Reading the definition alone does not authorize editing existing records that use it. Permission: `crm.contact-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### updateContactType A catalogue updater replaces the definition at its submitted read version, including classification name, availability, description and per-slot presentation assignments. Stale reads, mutation locks and invalid record or reference values refuse the write. Existing references retain meaning, and classification mutation does not change the person or organization identity. Permission: `crm.contact-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### patchContactType A catalogue updater applies version-tested directives to selected fields, including classification name, availability, description and per-slot presentation assignments. Stale reads, mutation locks and invalid record or reference values refuse the write. Existing references retain meaning, and classification mutation does not change the person or organization identity. Permission: `crm.contact-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### deleteContactType A catalogue delete operator removes an unused contact type. Lock and protected dependency checks can refuse it so existing values retain their definition. Contacts that still reference the classification block removal, including preserved records whose labels remain meaningful. Permission: `crm.contact-types.delete` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### createAffiliationType Catalogue administrators or other callers holding the create grant add affiliation type with relationship name, availability, description and supported default contact-point mappings. The route validates identity and record shape; an occupied identity or invalid reference refuses creation. Default mappings require compatible local types and unambiguous destinations. Permission: `crm.affiliation-types.create` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### listAffiliationTypes Catalogue readers and consuming selectors request a cursor-paged affiliation types list. This catalogue is alphabetical and has no reorder operation. Invalid cursor or scope inputs and missing read authority are refused. Inactive definitions can remain readable even when consuming new-choice pickers omit them. Permission: `crm.affiliation-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### getAffiliationType A configuration editor or consuming reader retrieves one affiliation type definition with relationship name, availability, description and supported default contact-point mappings. The request uses the workspace identity and can project supported fields. Missing read authority or an absent definition is refused rather than returning another workspace’s configuration. Reading the definition alone does not authorize editing existing records that use it. Permission: `crm.affiliation-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### updateAffiliationType A catalogue updater replaces the definition at its submitted read version, including relationship name, availability, description and supported default contact-point mappings. Stale reads, mutation locks and invalid record or reference values refuse the write. Changed defaults apply through later eligible actions and do not rewrite every existing person. Permission: `crm.affiliation-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### patchAffiliationType A catalogue updater applies version-tested directives to selected fields, including relationship name, availability, description and supported default contact-point mappings. Stale reads, mutation locks and invalid record or reference values refuse the write. Changed defaults apply through later eligible actions and do not rewrite every existing person. Permission: `crm.affiliation-types.update` (Administrator, Power User, Standard User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### deleteAffiliationType A catalogue delete operator removes an unused affiliation type. Lock and protected dependency checks can refuse it so existing values retain their definition. Any referencing affiliation or workspace default selection blocks removal; deactivation preserves existing references when the type is being retired from new choices. Permission: `crm.affiliation-types.delete` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### createAddressType Catalogue administrators or other callers holding the create grant add address type with purpose name, applicability and saved order, without an editable inactive choice. The route validates identity and record shape; an occupied identity or invalid reference refuses creation. The created definition becomes available to consuming choices according to its availability and order. Permission: `crm.address-types.create` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### listAddressTypes Catalogue readers and consuming selectors request a cursor-paged address types list. Saved display positions precede remaining entries in name order. Invalid cursor or scope inputs and missing read authority are refused. Applicability filtering distinguishes choices usable by contacts or organizations. Permission: `crm.address-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### reorderAddressTypes A catalogue updater supplies the complete ordered identity list for address types. All positions commit together, affecting later catalogue choices. Missing, duplicated or foreign identities and persistence errors refuse the whole reorder, preserving the previous order. The update grant controls this action; dragging a row on screen does not bypass completeness or workspace checks. Permission: `crm.address-types.update` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### getAddressType A configuration editor or consuming reader retrieves one address type definition with purpose name, applicability and saved order, without an editable inactive choice. The request uses the workspace identity and can project supported fields. Missing read authority or an absent definition is refused rather than returning another workspace’s configuration. Reading the definition alone does not authorize editing existing records that use it. Permission: `crm.address-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### updateAddressType A catalogue updater replaces the definition at its submitted read version, including purpose name, applicability and saved order, without an editable inactive choice. Stale reads, mutation locks and invalid record or reference values refuse the write. Existing references retain meaning, and classification mutation does not change the person or organization identity. Permission: `crm.address-types.update` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### patchAddressType A catalogue updater applies version-tested directives to selected fields, including purpose name, applicability and saved order, without an editable inactive choice. Stale reads, mutation locks and invalid record or reference values refuse the write. Existing references retain meaning, and classification mutation does not change the person or organization identity. Permission: `crm.address-types.update` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### deleteAddressType A catalogue delete operator removes an unused address type. Lock and protected dependency checks can refuse it so existing values retain their definition. Contact and organization details and supported mapping references prevent deleting a purpose still in use. Permission: `crm.address-types.delete` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### createPhoneNumberType Catalogue administrators or other callers holding the create grant add phone number type with purpose name, applicability and saved order, without an editable inactive choice. The route validates identity and record shape; an occupied identity or invalid reference refuses creation. The created definition becomes available to consuming choices according to its availability and order. Permission: `crm.phone-number-types.create` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### listPhoneNumberTypes Catalogue readers and consuming selectors request a cursor-paged phone number types list. Saved display positions precede remaining entries in name order. Invalid cursor or scope inputs and missing read authority are refused. Applicability filtering distinguishes choices usable by contacts or organizations. Permission: `crm.phone-number-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### reorderPhoneNumberTypes A catalogue updater supplies the complete ordered identity list for phone number types. All positions commit together, affecting later catalogue choices. Missing, duplicated or foreign identities and persistence errors refuse the whole reorder, preserving the previous order. The update grant controls this action; dragging a row on screen does not bypass completeness or workspace checks. Permission: `crm.phone-number-types.update` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### getPhoneNumberType A configuration editor or consuming reader retrieves one phone number type definition with purpose name, applicability and saved order, without an editable inactive choice. The request uses the workspace identity and can project supported fields. Missing read authority or an absent definition is refused rather than returning another workspace’s configuration. Reading the definition alone does not authorize editing existing records that use it. Permission: `crm.phone-number-types.read` (Administrator, Power User, Standard User, Read Only). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### updatePhoneNumberType A catalogue updater replaces the definition at its submitted read version, including purpose name, applicability and saved order, without an editable inactive choice. Stale reads, mutation locks and invalid record or reference values refuse the write. Existing references retain meaning, and classification mutation does not change the person or organization identity. Permission: `crm.phone-number-types.update` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### patchPhoneNumberType A catalogue updater applies version-tested directives to selected fields, including purpose name, applicability and saved order, without an editable inactive choice. Stale reads, mutation locks and invalid record or reference values refuse the write. Existing references retain meaning, and classification mutation does not change the person or organization identity. Permission: `crm.phone-number-types.update` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ### deletePhoneNumberType A catalogue delete operator removes an unused phone number type. Lock and protected dependency checks can refuse it so existing values retain their definition. Contact and organization details and supported mapping references prevent deleting a purpose still in use. Permission: `crm.phone-number-types.delete` (Administrator, Power User). Access channel: console. The dispatcher enforces route authority independently of console visibility. ## Permissions The CRM authorization model is the source of built-in grants. Administrator and Power User receive the administrative operations listed here; Standard User and Read Only receive narrower grants according to the table. A business Contact Role such as Billing Contact grants none of these security permissions, and Portal Member has no built-in CRM grants. | Permission | What it protects | Built-in roles | Checked at | |---|---|---|---| | `crm.address-types.create` | Create address classifications. | Administrator, Power User | createAddressType | | `crm.address-types.delete` | Remove address classifications. | Administrator, Power User | deleteAddressType | | `crm.address-types.read` | Read address classifications. | Administrator, Power User, Standard User, Read Only | listAddressTypes, getAddressType | | `crm.address-types.update` | Maintain address classifications. | Administrator, Power User | reorderAddressTypes, updateAddressType, patchAddressType | | `crm.affiliation-types.create` | Create affiliation classifications. | Administrator, Power User, Standard User | createAffiliationType | | `crm.affiliation-types.delete` | Remove affiliation classifications. | Administrator, Power User | deleteAffiliationType | | `crm.affiliation-types.read` | Read affiliation classifications. | Administrator, Power User, Standard User, Read Only | listAffiliationTypes, getAffiliationType | | `crm.affiliation-types.update` | Maintain affiliation classifications. | Administrator, Power User, Standard User | updateAffiliationType, patchAffiliationType | | `crm.contact-roles.create` | Create organizational contact roles. | Administrator, Power User, Standard User | createContactRole | | `crm.contact-roles.delete` | Remove organizational contact roles. | Administrator, Power User | deleteContactRole | | `crm.contact-roles.lock` | Apply record locks to organizational contact roles. | Administrator, Power User | lockContactRole | | `crm.contact-roles.read` | Read organizational contact roles. | Administrator, Power User, Standard User, Read Only | listContactRoles, getContactRole, listContactRoleLockChanges | | `crm.contact-roles.unlock` | Release record locks on organizational contact roles. | Administrator, Power User | unlockContactRole | | `crm.contact-roles.update` | Maintain organizational contact roles. | Administrator, Power User, Standard User | reorderContactRoles, updateContactRole, patchContactRole | | `crm.contact-types.create` | Create contact classifications. | Administrator, Power User, Standard User | createContactType | | `crm.contact-types.delete` | Remove contact classifications. | Administrator, Power User | deleteContactType | | `crm.contact-types.read` | Read contact classifications. | Administrator, Power User, Standard User, Read Only | listContactTypes, getContactType | | `crm.contact-types.update` | Maintain contact classifications. | Administrator, Power User, Standard User | reorderContactTypes, updateContactType, patchContactType | | `crm.organization-types.create` | Create organization classifications. | Administrator, Power User, Standard User | createOrganizationType | | `crm.organization-types.delete` | Remove organization classifications. | Administrator, Power User | deleteOrganizationType | | `crm.organization-types.read` | Read organization classifications. | Administrator, Power User, Standard User, Read Only | listOrganizationTypes, getOrganizationType | | `crm.organization-types.update` | Maintain organization classifications. | Administrator, Power User, Standard User | reorderOrganizationTypes, updateOrganizationType, patchOrganizationType | | `crm.phone-number-types.create` | Create phone classifications. | Administrator, Power User | createPhoneNumberType | | `crm.phone-number-types.delete` | Remove phone classifications. | Administrator, Power User | deletePhoneNumberType | | `crm.phone-number-types.read` | Read phone classifications. | Administrator, Power User, Standard User, Read Only | listPhoneNumberTypes, getPhoneNumberType | | `crm.phone-number-types.update` | Maintain phone classifications. | Administrator, Power User | reorderPhoneNumberTypes, updatePhoneNumberType, patchPhoneNumberType | A route permission is only the entry decision. Version comparison, archive, customer restrictions, Rhythm protection, valid references and dependencies can still refuse an authorized actor. History evaluates record-read authority as well as history authority. Settings and effective-definition handlers check the particular requested section or kind, preventing an alternative-grant route gate from exposing everything. ## Events and Jobs This classification host declares no independent produced event stream or scheduled job. Its catalogue writes do not acquire the contact and organization history guarantee simply because those records have revisions. Ordinary reordering and policy administration return their synchronous result; updating organization policy does not trigger immediate reevaluation of all existing organizations. The organization-type workflow calls Platform synchronously for template validation and mutation after the local type commit. The template is not stored as another CRM copy. If administration requires refreshed organization assessments, the record service’s explicit reprocess initiates durable asynchronous work. Individual catalogue operations remain distinct from bulk orchestration. ## Consistency Guarantees The guarantees below describe the verified persistence and handoff boundaries. Transactional means the named local writes share a commit; eventual means later work can remain pending. Our reading is that this distinction is essential when interpreting an error or a saved record, because a rollback does not undo every prepared file or external request object. **transactional boundary.** Classification rows and their owned policy or mapping rows commit together under the submitted version. Recovery: Rollback removes all database changes in the classification transaction. **transactional boundary.** A catalogue reorder submits every required identity and commits all positions together. Recovery: Validation or persistence failure leaves the prior order intact. **eventual boundary.** The type commits before its owned template mutation. Recovery: A failed template write attempts deletion or versioned restore, which can also fail. Failed template cleanup after deletion is logged without reversal. **transactional boundary.** References prevent deleting catalogue entries still used by the protected dependency kinds. Recovery: The deletion transaction fails and retains the catalogue record; notification-role arrays lack equivalent protection.