--- id: CAP-MBR-STR-019 title: Authorize structure and configuration work feature: FEAT-MBR-STR-06 product_area: membership module: structure revision: 1 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: [] purpose: Rhythm separates staff reading from administration and confines each action to the licensed workspace. outcomes: - Staff operations require the published authority for their concern. - Workspace and application checks protect access to membership configuration. concepts: - CON-MBR-STR-006 actors: - ACT-MBR-001 - ACT-MBR-002 surfaces: - api - console preconditions: [] postconditions: [] permissions: - key: membership.structure.read where_checked: api scope: tenant - key: membership.structure.manage where_checked: api scope: tenant - key: membership.programs.read where_checked: api scope: tenant - key: membership.programs.manage where_checked: api scope: tenant - key: membership.configuration.read where_checked: api scope: tenant - key: membership.configuration.manage where_checked: api scope: tenant - key: membership.application.access where_checked: api scope: tenant rules: - id: BR-CAP-MBR-STR-019-01 proved_by: [ATS-MBR-STR-001-13, ATS-MBR-STR-002-16, ATS-MBR-STR-003-10, ATS-MBR-STR-004-10, ATS-MBR-STR-005-10, ATS-MBR-STR-006-12, ATS-MBR-STR-007-10, ATS-MBR-STR-008-09, ATS-MBR-STR-019-01, ATS-MBR-STR-019-07, TST-MBR-STR-084, TST-MBR-STR-100, TST-MBR-STR-103] statement: >- Structure reads require structure-read permission, and structure mutations require structure-manage permission. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-membership:tests/unit/route-authorization.spec.ts#route authorization: every Membership operation names its permission › requires membership.structure.read of every structure read and membership.structure.manage of every change origin: none - id: BR-CAP-MBR-STR-019-02 proved_by: [ATS-MBR-STR-009-10, ATS-MBR-STR-010-06, ATS-MBR-STR-011-08, ATS-MBR-STR-012-15, ATS-MBR-STR-013-09, ATS-MBR-STR-014-04, ATS-MBR-STR-015-13, ATS-MBR-STR-017-06, ATS-MBR-STR-018-15, ATS-MBR-STR-019-02, ATS-MBR-STR-019-08, TST-MBR-STR-028] statement: >- Programs and program unit requirements use program authority, while types, packages, reasons and policy sets use configuration authority. kind: permission enforced_at: - api must_prove: true provenance: observed source: 'services-membership:modules/configuration/aws/api/configuration.routes.ts:configurationModuleRoutes' origin: none - id: BR-CAP-MBR-STR-019-03 proved_by: [ATS-MBR-STR-019-03, TST-MBR-STR-028, TST-MBR-STR-084] statement: >- Manage permissions are administrator-tier workspace permissions, so an officer’s unit-scoped grant does not authorize these operations. kind: permission enforced_at: - api must_prove: true provenance: observed source: 'services-membership:aws/membership.service.ts:STRUCTURE_PERMISSIONS' origin: none - id: BR-CAP-MBR-STR-019-04 proved_by: [ATS-MBR-STR-016-12, ATS-MBR-STR-019-04, TST-MBR-STR-101] statement: >- Workspace data operations require Membership application access, a Membership licence and an available workspace. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-membership:tests/e2e/terms-api.e2e.spec.ts#the terms API, end to end in process › refuses a caller who holds no key in the tenant origin: none - id: BR-CAP-MBR-STR-019-05 proved_by: [ATS-MBR-STR-019-05, TST-MBR-STR-006, TST-MBR-STR-029, TST-MBR-STR-085] statement: Database row isolation confines structure and configuration records to the caller’s workspace. kind: permission enforced_at: - database must_prove: true provenance: test source: >- services-membership:modules/structure/tests/integration/services/persistence/organizational-units.integration.spec.ts#organizational units in the database › row-level security › shows another tenant none of the units origin: none - id: BR-CAP-MBR-STR-019-06 proved_by: [] statement: >- Route permission references resolve to published catalogue keys and each published key has a route consumer. kind: invariant enforced_at: - api must_prove: false provenance: test source: >- services-membership:tests/unit/route-authorization.spec.ts#route authorization: every Membership operation names its permission › is allowed or evaluates only keys the published catalog defines origin: none - id: BR-CAP-MBR-STR-019-07 proved_by: [ATS-MBR-STR-019-06] statement: >- The console’s Membership permission vocabulary differs from the service catalogue, preventing direct equivalence without a verified mapping. kind: permission enforced_at: - console must_prove: true provenance: observed source: 'react-console:lib/authz/permissions.ts:82' origin: none scenarios: - id: SC-CAP-MBR-STR-019-01 given: A staff caller holds structure-reading authority only. when: The caller requests a unit list and then a relocation. then: Reading succeeds and the mutation returns an access refusal. provenance: test source: >- services-membership:tests/e2e/structure-api.e2e.spec.ts#the structure API, end to end in process › refuses a reader a change, 403 edge_cases: - id: SC-CAP-MBR-STR-019-02 given: An officer has membership authority limited to Atlanta. when: The officer attempts to replace Atlanta’s name. then: The request lacks the workspace administration permission and fails. provenance: test source: >- services-membership:tests/acceptance/structure/MBR-ACC-0025.acceptance.ts#MBR-ACC-0025 one structure change, seven people constraints: [] depends_on: [] related: - CAP-MBR-STR-005 - CAP-MBR-STR-018 journeys: [] open_questions: [] evidence: - >- services-membership: Examination of the permission catalogue, structure and configuration routes and the route authorization guard. - >- services-membership: Examination of structure and terms end-to-end, row-level security tests, acceptance journeys MBR-ACC-0025, 0026, 0088, 0089. - 'react-console: Review of the console permission names.' - 'react-console:lib/authz/permissions.ts' - 'services-membership:aws/membership.service.ts' - 'services-membership:modules/configuration/aws/api/configuration.routes.ts' - >- services-membership:modules/structure/tests/integration/services/persistence/organizational-units.integration.spec.ts - 'services-membership:tests/e2e/terms-api.e2e.spec.ts' - 'services-membership:tests/unit/route-authorization.spec.ts' controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-004, TC-MON-001, TC-MON-003, TC-MON-004, TC-PI-001, TC-SEC-001, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003] exercised_by: [FAS-MBR-STR-06-01, FAS-MBR-STR-06-02, FAS-MBR-STR-06-03, FAS-MBR-STR-06-04, FAS-MBR-STR-06-05] suites: [TST-MBR-STR-006, TST-MBR-STR-028, TST-MBR-STR-029, TST-MBR-STR-084, TST-MBR-STR-085, TST-MBR-STR-100, TST-MBR-STR-101, TST-MBR-STR-103] --- # Authorize structure and configuration work ## Purpose Rhythm separates staff reading from administration and confines each action to the licensed workspace. ## How It Works A request reaches the operation under the authority of its caller. Structure, program and configuration concerns each distinguish reading from management. Those permissions apply across a workspace rather than to one chapter. An officer’s local membership authority therefore does not grant administration of the structure. Application access and workspace admission are separate checks. A licence or workspace availability failure can block an otherwise permitted request. Database isolation provides a further workspace boundary. Public health checks describe the service without exposing workspace records. The console uses a different Membership permission vocabulary today. The product should reconcile that vocabulary with the service before adding administration screens. ## Relationships - All structure and configuration capabilities rely on these authority boundaries. - Platform owns permission evaluation, licensing and workspace admission.