---
id: ADR-MBR-MEM-010
title: Evaluate Officer Reach Through Member Units
product_area: membership
module: memberships
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Officer-capable permission evaluation uses dated membership units and
  ancestry, with object-level checks before revealing inaccessible records.
constrains:
  - DOM-MBR-MEM-001
  - DOM-MBR-MEM-003
  - SVC-MBR-MEM-memberships
  - SVC-MBR-MEM-applications
  - WF-MBR-MEM-009
  - WF-MBR-MEM-021
  - WF-MBR-MEM-022
  - WF-MBR-MEM-023
origin: >-
  The membership architecture's committees and authorization chapter (section
  4), as the scope phase record states it
alternatives:
  - option: Separate officer endpoints with their own logic
    why_not: >-
      Separate officer implementations would duplicate membership behaviour and
      its validation.
  - option: Answer forbidden for an out-of-scope read
    why_not: A distinct forbidden response can disclose an otherwise hidden membership.
consequences:
  - Scope predicates restrict candidate records before keyset paging.
  - Each request evaluates current grants so expired authority stops applying.
  - >-
    History remains staff-only, and an existing refusal-wording finding limits
    the intended concealment guarantee.
supersedes: []
evidence:
  - >-
    services-membership at 5994c270: modules/memberships/services/access/*.ts;
    services/persistence/visibility-chains.ts; docs/migrations/scope/README.md
---

# Evaluate Officer Reach Through Member Units

## Context

Officers administer people reached through their units and descendants, while staff may hold workspace-wide authority. Shared operations need record-specific reach checks.

## Decision

Officer-capable permission evaluation uses dated membership units and ancestry, with object-level checks before revealing inaccessible records.

## Alternatives Considered

Separate officer endpoints with their own logic: Separate officer implementations would duplicate membership behaviour and its validation.

Answer forbidden for an out-of-scope read: A distinct forbidden response can disclose an otherwise hidden membership.

## Consequences

Scope predicates restrict candidate records before keyset paging. Each request evaluates current grants so expired authority stops applying. History remains staff-only, and an existing refusal-wording finding limits the intended concealment guarantee.