---
id: ADR-CRM-ENT-011
title: Keep Customer Locks and Rhythm Protection Apart
product_area: crm
module: entities
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-crm: 7ea48a414c42eade10d60753b8bcc323b1dd726f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Dedicated customer lock actions require administrator permission, a current
  version and an audited reason; the legacy contact-role ordinary-write path is
  an exception; rhythm protection is independent and cannot be lifted by
  customer permissions.
constrains:
  - STATE-CRM-ENT-007
  - DOM-CRM-ENT-033
  - SVC-CRM-ENT-entities
  - SVC-CRM-ENT-configuration-types
origin: 'D-08 (Andrew, 2026-10-19, Modified Option 1); CRM-M1 plan A17 and A18; E-14'
alternatives:
  - option: Let general saves establish full locks.
    why_not: >-
      That would let ordinary editors freeze records outside the narrowly
      authorized release flow. Contacts and organizations reject such writes.
  - option: Combine customer locks with Rhythm protection.
    why_not: >-
      A customer unlock must not release a system safeguard that the product
      depends on.
consequences:
  - >-
    Contacts, organizations and roles have dedicated lock actions; other
    classifications can enforce locks without a supported release action.
  - >-
    Pinned seed code creates no protected entries, but deployed operator data
    was not examined.
  - >-
    The ordinary role delete-lock exception is explicit in approved planning;
    the examination corrects the draft’s universal dedicated-action claim.
evidence:
  - >-
    services-crm at 7ea48a41: docs/record-locks.md;
    modules/entities/services/persistence/record-locks.ts
---
# Keep Customer Locks and Rhythm Protection Apart

## Context

Customer locking controls permitted record work, while Rhythm protection prevents customer operations from removing system safeguards. These are separate constraints with different authorities.

## Decision

Dedicated customer lock actions require administrator permission, a current version and an audited reason; the legacy contact-role ordinary-write path is an exception; rhythm protection is independent and cannot be lifted by customer permissions.

## Alternatives Considered

Let general saves establish full locks. That would let ordinary editors freeze records outside the narrowly authorized release flow. Contacts and organizations reject such writes.

Combine customer locks with Rhythm protection. A customer unlock must not release a system safeguard that the product depends on.

## Consequences

Dedicated actions are audited and versioned. The ordinary role-save exception is already explicit in approved planning; the examination corrects the draft’s broader claim. Missing release operations for other catalogue locks also remain unresolved.

Contacts, organizations and roles have dedicated lock actions; other classifications can enforce locks without a supported release action. Pinned seed code creates no protected entries, but deployed operator data was not examined. The ordinary role delete-lock exception is explicit in approved planning; the examination corrects the draft’s universal dedicated-action claim.