---
id: ADR-MBR-STR-015
title: Keep Setup Permissions at Workspace Scope
product_area: membership
module: structure
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Structure, program and configuration routes use workspace-level setup permissions and Membership access; a
  unit-scoped grant alone does not authorize administration.
constrains:
  - SVC-MBR-STR-structure
  - SVC-MBR-STR-configuration
  - SVC-MBR-STR-terms
  - DOM-MBR-STR-006
  - RESP-MBR
origin: >-
  services-membership:aws/membership.service.ts (STRUCTURE_PERMISSIONS: the structure is the workspace's
  configuration; neither key is scoped to a unit)
alternatives:
  - option: Allow officers to edit their unit's details and links.
    why_not: >-
      A scoped write capability would need field restrictions and an authorization contract that the current
      routes do not provide.
  - option: Use one permission for all setup changes.
    why_not: 'That would remove the current separation between structural, program and offering administrators.'
consequences:
  - Three read-and-manage pairs separate the setup concerns.
  - Officer self-service requires a new capability and scoped contract.
  - Existing console permission vocabulary needs verified mapping before administration screens rely on it.
supersedes: []
evidence:
  - 'services-membership at 5994c270: aws/membership.service.ts; tests/unit/route-authorization.spec.ts'
---

# Keep Setup Permissions at Workspace Scope

## Context

Memberships supports unit-scoped officer work, but association setup uses workspace administration authority. The permission catalogue gives these activities distinct scopes.

## Decision

This record describes the published setup keys. It does not bar a person who is an officer from acting when that person separately holds the required workspace authority.

## Alternatives Considered

Allow officers to edit their unit's details and links. A scoped write capability would need field restrictions and an authorization contract that the current routes do not provide. Use one permission for all setup changes. That would remove the current separation between structural, program and offering administrators.

## Consequences

Three read-and-manage pairs separate the setup concerns. Officer self-service requires a new capability and scoped contract. Existing console permission vocabulary needs verified mapping before administration screens rely on it.