---
id: ADR-CRM-REG-013
title: Every Regional Reference Stays Inside Its Workspace
product_area: crm
module: regions
revision: 2
status: proposed
design_intent: confirmed
source_sha:
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Business regional rows and new references remain workspace-specific, while tolerated legacy references and
  shared event-outbox infrastructure qualify universal isolation claims.
constrains:
  - DOM-CRM-REG-001
  - DOM-CRM-REG-002
  - DOM-CRM-REG-003
  - DOM-CRM-REG-004
  - SVC-CRM-REG-regions
origin: >-
  Andrew’s requirement for the port (behaviour changes, item 3), cited in
  services-crm:docs/migrations/crm-regions/README.md#Behaviour changes
alternatives:
  - option: Enforce reference ownership only in application checks.
    why_not: >-
      Database keys cover write paths beyond one API caller and prevent committing new foreign-workspace
      references.
  - option: Delete referencing records automatically with their region.
    why_not: The recorded port requirement preserves referencing records by refusing removal of a used region.
consequences:
  - Region removal fails while records or rules still use its definition.
  - New references to missing local regions are refused.
  - Older regional references retained when constraints were introduced remain tolerated.
supersedes: []
evidence:
  - >-
    services-crm at a8d1364f: modules/regions/db/*.table.ts; services/persistence/regions.ts (regionRefusal);
    aws/api/regions.routes.ts (toWriteInput, tenantOf); docs/row-level-security.md.
---

# Every Regional Reference Stays Inside Its Workspace

## Context

The port requires local regional references and refusal of deletion while a region is used. Captured delivery infrastructure also needs cross-workspace dispatch access.

## Decision

Business operations use the signed execution workspace, and composite keys constrain newly written regional and address-type references. Existing contact and organization references can remain unvalidated. Captured event rows are shared dispatcher infrastructure rather than ordinary workspace-readable business records.

## Alternatives Considered

Enforce reference ownership only in application checks. Database keys cover write paths beyond one API caller and prevent committing new foreign-workspace references.

Delete referencing records automatically with their region. The recorded port requirement preserves referencing records by refusing removal of a used region.

## Consequences

Region removal fails while records or rules still use its definition. New references to missing local regions are refused. Older regional references retained when constraints were introduced remain tolerated.