---
id: AUTH-PFM
title: Platform Authorization Model
product_area: platform
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
source_sha:
  rhythm-v2-docs: cd10cc78ca5b27f476de773abc747115fed86231
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
scopes:
  - name: platform
    meaning: Rhythm staff authority applies to system operations and does not itself authorize customer console or portal work.
  - name: customer
    meaning: A customer assignment reaches that customer’s workspaces through operations that admit the membership.
  - name: workspace
    meaning: An assignment reaches one workspace within the membership’s customer or an admitted staff-entry grant.
  - name: record
    meaning: Resource type and identity narrow authority inside a workspace; each consuming service enforces record reach.
scope_evidence:
  provenance: observed
  source:
    - 'services-platform:modules/security/db/security-roles.table.ts:SCOPE_TYPES'
    - 'services-platform:modules/security/db/security-assignments.table.ts:securityAssignments'
    - 'services-platform:modules/security/authorizer/grants/possible-grant.ts:platformScopeCounts'
  note: >-
    Organizational-unit access is a consumer resource scope, not a fifth stored assignment type; no generic
    organizational-unit grant is established here.
roles:
  - id: ROLE-PFM-001
    name: Administrator
    who: A customer administrator assigned the built-in role.
    grants: [committees.committees.read, crm.activities.bulk, crm.activities.delete, crm.activities.update, crm.activity-types.bulk, crm.activity-types.update, crm.address-types.bulk, crm.address-types.delete, crm.address-types.update, crm.application.access, crm.contact-layouts.create, crm.contact-layouts.delete, crm.contact-layouts.read, crm.contact-layouts.update, crm.contact-roles.bulk, crm.contact-roles.delete, crm.contact-roles.update, crm.contact-types.bulk, crm.contact-types.delete, crm.contact-types.update, crm.contacts.bulk, crm.contacts.delete, crm.contacts.query, crm.contacts.read, crm.contacts.update, crm.organization-types.bulk, crm.organization-types.delete, crm.organization-types.update, crm.organizations.bulk, crm.organizations.delete, crm.organizations.read, crm.organizations.update, crm.phone-number-types.bulk, crm.phone-number-types.delete, crm.phone-number-types.update, crm.regions.bulk, crm.regions.update, platform.application.access, platform.association-types.create, platform.association-types.delete, platform.association-types.read, platform.association-types.update, platform.associations.create, platform.associations.delete, platform.associations.read, platform.associations.update, platform.attention.manage, platform.attention.read, platform.attention.read-others, platform.attention.resolve-manually, platform.attention.use, platform.audit-events.read, platform.communication-messages.read, platform.communication-messages.read-content, platform.communication-messages.update, platform.communication-suppressions.create, platform.communication-suppressions.read, platform.communication-suppressions.update, platform.communication-templates.create, platform.communication-templates.delete, platform.communication-templates.publish, platform.communication-templates.read, platform.communication-templates.test-send, platform.communication-templates.update, platform.custom-fields.bulk, platform.custom-fields.create, platform.custom-fields.delete, platform.custom-fields.read, platform.custom-fields.update, platform.custom-objects.create, platform.custom-objects.delete, platform.custom-objects.read, platform.custom-objects.update, platform.custom-records.create, platform.custom-records.delete, platform.custom-records.export, platform.custom-records.history, platform.custom-records.publish, platform.custom-records.query, platform.custom-records.read, platform.custom-records.update, platform.customers.read, platform.customers.update, platform.data-exports.download, platform.data-exports.execute, platform.data-exports.manage, platform.data-exports.read, platform.data-jobs.upload, platform.eligibility-bindings.manage, platform.eligibility.population, platform.eligibility.publish, platform.eligibility.read, platform.eligibility.retire, platform.eligibility.write, platform.explorer-views.manage, platform.explorer-views.share, platform.explorer-views.use, platform.extension-bindings.manage, platform.extension-handlers.manage, platform.extension-handlers.test, platform.extension-invocations.read, platform.extension-points.read, platform.extension-rules.manage, platform.field-labels.update, platform.files.upload, platform.integration-credentials.manage, platform.integration-executions.operate, platform.integration-executions.read, platform.integrations.invoke, platform.integrations.manage, platform.integrations.read, platform.jobs.read, platform.layouts.create, platform.layouts.delete, platform.layouts.read, platform.layouts.update, platform.llm-usage.read, platform.metadata.read, platform.notifications.manage, platform.notifications.use, platform.queries.generate, platform.queries.read, platform.query-schedules.external-recipients, platform.query-schedules.manage, platform.query-schedules.use, platform.quick-search-settings.read, platform.quick-search-settings.rebuild, platform.quick-search-settings.update, platform.quick-search.read, platform.record-views.create, platform.record-views.read, platform.reports.manage, platform.reports.read, platform.reports.share, platform.reports.use, platform.responsibilities.delegate-own, platform.responsibilities.manage, platform.responsibilities.read, platform.saved-queries.manage, platform.saved-queries.read, platform.saved-queries.share, platform.saved-queries.use, platform.security-access.explain, platform.security-access.manage, platform.security-policies.manage, platform.security-policies.read, platform.security-roles.manage, platform.security-roles.read, platform.snapshots.read, platform.staff-access.manage, platform.staff-access.read, platform.tenant-applications.read, platform.tenants.bulk, platform.tenants.read, platform.tenants.update, platform.users.bulk, platform.users.change-password, platform.users.create, platform.users.delete, platform.users.manage-identities, platform.users.manage-passwords, platform.users.read, platform.users.update, platform.workflow-actions.automation-manage, platform.workflow-actions.calendars-manage, platform.workflow-actions.registry-read, platform.workflow-actions.registry-register, platform.workflow-actions.runs-read, platform.workflow-actions.runs-resolve, platform.workflow-actions.templates-manage]
    product_key: 'role:administrator'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
  - id: ROLE-PFM-002
    name: Power User
    who: A customer colleague entrusted with application administration.
    grants: [committees.committees.read, crm.activities.bulk, crm.activities.delete, crm.activities.update, crm.activity-types.bulk, crm.activity-types.update, crm.address-types.bulk, crm.address-types.delete, crm.address-types.update, crm.application.access, crm.contact-layouts.create, crm.contact-layouts.delete, crm.contact-layouts.read, crm.contact-layouts.update, crm.contact-roles.bulk, crm.contact-roles.delete, crm.contact-roles.update, crm.contact-types.bulk, crm.contact-types.delete, crm.contact-types.update, crm.contacts.bulk, crm.contacts.delete, crm.contacts.query, crm.contacts.read, crm.contacts.update, crm.organization-types.bulk, crm.organization-types.delete, crm.organization-types.update, crm.organizations.bulk, crm.organizations.delete, crm.organizations.read, crm.organizations.update, crm.phone-number-types.bulk, crm.phone-number-types.delete, crm.phone-number-types.update, crm.regions.bulk, crm.regions.update, platform.application.access, platform.association-types.create, platform.association-types.delete, platform.association-types.read, platform.association-types.update, platform.associations.create, platform.associations.delete, platform.associations.read, platform.associations.update, platform.attention.manage, platform.attention.read, platform.attention.read-others, platform.attention.resolve-manually, platform.attention.use, platform.audit-events.read, platform.communication-messages.read, platform.communication-messages.read-content, platform.communication-messages.update, platform.communication-suppressions.create, platform.communication-suppressions.read, platform.communication-suppressions.update, platform.communication-templates.create, platform.communication-templates.delete, platform.communication-templates.publish, platform.communication-templates.read, platform.communication-templates.test-send, platform.communication-templates.update, platform.custom-fields.bulk, platform.custom-fields.create, platform.custom-fields.delete, platform.custom-fields.read, platform.custom-fields.update, platform.custom-objects.create, platform.custom-objects.delete, platform.custom-objects.read, platform.custom-objects.update, platform.custom-records.create, platform.custom-records.delete, platform.custom-records.export, platform.custom-records.history, platform.custom-records.publish, platform.custom-records.query, platform.custom-records.read, platform.custom-records.update, platform.customers.read, platform.customers.update, platform.data-jobs.upload, platform.eligibility-bindings.manage, platform.eligibility.population, platform.eligibility.publish, platform.eligibility.read, platform.eligibility.retire, platform.eligibility.write, platform.explorer-views.manage, platform.explorer-views.share, platform.explorer-views.use, platform.extension-bindings.manage, platform.extension-handlers.manage, platform.extension-handlers.test, platform.extension-invocations.read, platform.extension-points.read, platform.extension-rules.manage, platform.field-labels.update, platform.files.upload, platform.integration-credentials.manage, platform.integration-executions.operate, platform.integration-executions.read, platform.integrations.invoke, platform.integrations.manage, platform.integrations.read, platform.jobs.read, platform.layouts.create, platform.layouts.delete, platform.layouts.read, platform.layouts.update, platform.llm-usage.read, platform.metadata.read, platform.notifications.manage, platform.notifications.use, platform.queries.generate, platform.queries.read, platform.query-schedules.external-recipients, platform.query-schedules.manage, platform.query-schedules.use, platform.quick-search-settings.read, platform.quick-search-settings.rebuild, platform.quick-search-settings.update, platform.quick-search.read, platform.record-views.create, platform.record-views.read, platform.reports.manage, platform.reports.read, platform.reports.share, platform.reports.use, platform.responsibilities.delegate-own, platform.responsibilities.manage, platform.responsibilities.read, platform.saved-queries.manage, platform.saved-queries.read, platform.saved-queries.share, platform.saved-queries.use, platform.snapshots.read, platform.tenant-applications.read, platform.tenants.bulk, platform.tenants.read, platform.tenants.update, platform.users.bulk, platform.users.change-password, platform.users.create, platform.users.delete, platform.users.manage-identities, platform.users.manage-passwords, platform.users.read, platform.users.update, platform.workflow-actions.automation-manage, platform.workflow-actions.calendars-manage, platform.workflow-actions.registry-read, platform.workflow-actions.registry-register, platform.workflow-actions.runs-read, platform.workflow-actions.runs-resolve, platform.workflow-actions.templates-manage]
    product_key: 'role:power-user'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
  - id: ROLE-PFM-003
    name: Standard User
    who: A customer colleague carrying everyday application authority.
    grants: [committees.committees.read, crm.activities.delete, crm.activities.update, crm.application.access, crm.contact-layouts.read, crm.contact-roles.update, crm.contact-types.update, crm.contacts.query, crm.contacts.read, crm.contacts.update, crm.organization-types.update, crm.organizations.read, crm.organizations.update, crm.regions.update, platform.application.access, platform.association-types.read, platform.associations.create, platform.associations.delete, platform.associations.read, platform.associations.update, platform.attention.read, platform.attention.use, platform.communication-messages.read, platform.communication-messages.update, platform.communication-suppressions.read, platform.communication-templates.read, platform.custom-fields.read, platform.custom-objects.read, platform.custom-records.create, platform.custom-records.history, platform.custom-records.query, platform.custom-records.read, platform.custom-records.update, platform.customers.read, platform.eligibility-bindings.manage, platform.eligibility.population, platform.eligibility.read, platform.explorer-views.share, platform.explorer-views.use, platform.extension-points.read, platform.files.upload, platform.integration-executions.read, platform.integrations.read, platform.jobs.read, platform.layouts.read, platform.metadata.read, platform.notifications.use, platform.queries.generate, platform.queries.read, platform.query-schedules.use, platform.quick-search-settings.read, platform.quick-search.read, platform.record-views.create, platform.record-views.read, platform.reports.read, platform.reports.share, platform.reports.use, platform.responsibilities.delegate-own, platform.responsibilities.read, platform.saved-queries.read, platform.saved-queries.share, platform.saved-queries.use, platform.snapshots.read, platform.tenant-applications.read, platform.tenants.read, platform.users.change-password, platform.users.read, platform.workflow-actions.registry-read, platform.workflow-actions.runs-read]
    product_key: 'role:standard-user'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
  - id: ROLE-PFM-004
    name: Read Only
    who: A customer colleague assigned readership without ordinary authoring authority.
    grants: [committees.committees.read, crm.application.access, crm.contact-layouts.read, crm.contacts.query, crm.contacts.read, crm.organizations.read, platform.application.access, platform.association-types.read, platform.associations.read, platform.attention.read, platform.communication-messages.read, platform.communication-suppressions.read, platform.communication-templates.read, platform.custom-fields.read, platform.custom-objects.read, platform.custom-records.history, platform.custom-records.query, platform.custom-records.read, platform.customers.read, platform.eligibility.read, platform.explorer-views.use, platform.extension-points.read, platform.integration-executions.read, platform.integrations.read, platform.jobs.read, platform.layouts.read, platform.metadata.read, platform.notifications.use, platform.queries.read, platform.quick-search-settings.read, platform.quick-search.read, platform.record-views.create, platform.record-views.read, platform.reports.read, platform.responsibilities.read, platform.saved-queries.read, platform.snapshots.read, platform.tenant-applications.read, platform.tenants.read, platform.users.read, platform.workflow-actions.registry-read, platform.workflow-actions.runs-read]
    product_key: 'role:read-only'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
  - id: ROLE-PFM-005
    name: Portal Member
    who: A person registered in one workspace’s portal.
    grants: [platform.users.change-password, platform.users.read]
    product_key: 'role:portal-member'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
  - id: ROLE-PFM-006
    name: Support Representative
    who: Rhythm staff who investigate customer issues and coordinate a deletion hold.
    grants: [hq.audit.read, hq.custom-query-tables.read, hq.customers.read, hq.data-exports.read, hq.jobs.read, hq.licensing.read, hq.llm-usage.read, hq.queries.read, hq.roles.read, hq.service-principals.read, hq.snapshots.read, hq.staff.read, hq.tenant-access.read, hq.tenant-access.request, hq.tenants.read, platform.tenants.deletion-hold, platform.tenants.deletion-read]
    product_key: 'role:rhythm-support'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
  - id: ROLE-PFM-007
    name: Software Engineer
    who: Rhythm staff who investigate issues and author tailored datasets.
    grants: [hq.audit.read, hq.custom-query-tables.assign, hq.custom-query-tables.author, hq.custom-query-tables.publish, hq.custom-query-tables.read, hq.customers.read, hq.data-exports.read, hq.jobs.read, hq.licensing.read, hq.llm-usage.read, hq.queries.read, hq.roles.read, hq.service-principals.read, hq.snapshots.read, hq.staff.read, hq.tenant-access.read, hq.tenant-access.request, hq.tenants.read, platform.tenants.deletion-read]
    product_key: 'role:rhythm-engineer'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
  - id: ROLE-PFM-008
    name: Rhythm Administrator
    who: Rhythm staff assigned platform administration.
    grants: [hq.audit.read, hq.capacity.manage, hq.custom-query-tables.assign, hq.custom-query-tables.author, hq.custom-query-tables.publish, hq.custom-query-tables.read, hq.customers.create, hq.customers.delete, hq.customers.read, hq.customers.update, hq.data-exports.operate, hq.data-exports.read, hq.data-runs.manage, hq.emergency-access.use, hq.integrations.operate, hq.integrations.publish, hq.jobs.read, hq.jobs.retry, hq.licensing.manage, hq.licensing.read, hq.llm-usage.manage, hq.llm-usage.read, hq.llm-usage.read-evidence, hq.notifications.operate, hq.notifications.read, hq.queries.read, hq.roles.manage, hq.roles.read, hq.service-principals.manage, hq.service-principals.read, hq.snapshots.manage, hq.snapshots.read, hq.staff.disable, hq.staff.invite, hq.staff.read, hq.staff.update, hq.tenant-access.read, hq.tenant-access.request, hq.tenants.activate, hq.tenants.provision, hq.tenants.read, hq.tenants.update, platform.communications.request, platform.eligibility.reconcile, platform.notifications.publish, platform.tenants.deletion-cancel, platform.tenants.deletion-hold, platform.tenants.deletion-read, platform.tenants.deletion-request, platform.tenants.manage-commercial-link, platform.tenants.manage-status, platform.tenants.onboard]
    product_key: 'role:rhythm-administrator'
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
    note: Grants show concrete catalogue entries consumed by Platform artifacts; other application grants remain in their owning authorization models.
permissions:
  - key: '<application>.<dataset>.query (the owner''s key, e.g. crm.contacts.query)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-001-know-which-data-can-be-queried-and-what-each-dataset-holds.md#permissions']
  - key: <application>.<dataset>.query (the owner's key)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-002-02, BR-CAP-PFM-QRY-003-10, BR-CAP-PFM-QRY-006-01, BR-CAP-PFM-QRY-006-02, BR-CAP-PFM-QRY-006-04, BR-CAP-PFM-QRY-006-05, BR-CAP-PFM-QRY-006-06, BR-CAP-PFM-QRY-006-08, BR-CAP-PFM-QRY-006-12, BR-CAP-PFM-QRY-006-13, BR-CAP-PFM-QRY-006-15, BR-CAP-PFM-QRY-007-05, BR-CAP-PFM-QRY-008-04, BR-CAP-PFM-QRY-008-08, BR-CAP-PFM-QRY-009-05, BR-CAP-PFM-QRY-009-06, BR-CAP-PFM-QRY-009-10, BR-CAP-PFM-QRY-009-11, BR-CAP-PFM-QRY-010-05, BR-CAP-PFM-QRY-010-07, BR-CAP-PFM-QRY-014-07, BR-CAP-PFM-QRY-014-09, BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-002-ask-a-question-of-the-workspace-s-data-and-see-only-what.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-003-have-a-query-written-from-a-plain-english-request.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-006-keep-and-share-saved-queries-without-widening-anyone-s.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-007-run-a-saved-query-with-the-values-it-asks-for-as-the-person.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-008-start-a-query-from-a-recipe-rhythm-ships.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-009-keep-and-share-the-explorer-views-a-person-works-from.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-010-walk-a-list-record-by-record-and-act-on-every-record-it.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-014-take-a-query-s-whole-result-away-as-a-csv-or-excel-file.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-017-choose-what-quick-search-finds-records-by-and-keep-the.md#permissions']
  - key: <application>.<records>.read where the owner declares it (e.g. crm.organizations.read)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-001-know-which-data-can-be-queried-and-what-each-dataset-holds.md#permissions']
  - key: committees.committees.read
    intent: Inspect committees within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-committees:aws/committees.service.ts', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-008-record-that-a-person-opened-a-record.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: configuration.access
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-007-move-into-a-settings-area-and-back-to-my-work.md#permissions']
  - key: configuration.applications.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-CSH-015-07, BR-CAP-PFM-CSH-017-08, BR-CAP-PFM-CSH-017-09, BR-CAP-PFM-CSH-017-12]
    kind: console-entitlement
    derived_from: [platform.tenant-applications.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-015-say-plainly-when-a-page-belongs-to-an-application-the.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-017-see-which-applications-the-organization-has-and-why-one-is.md#permissions']
  - key: configuration.responsibilities.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    derived_from: [platform.responsibilities.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-005-reach-my-own-pages-help-and-sign-out-from-the-user-menu.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-007-move-into-a-settings-area-and-back-to-my-work.md#permissions']
  - key: console.access
    intent: Present console entry after the loaded context identifies an available application.
    operations: []
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-CSH-009-08, BR-CAP-PFM-CSH-014-10, BR-CAP-PFM-CSH-015-07]
    kind: console-entitlement
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-002-give-each-page-the-room-it-needs.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-004-start-the-day-from-the-workspace-home.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-006-find-my-way-through-the-applications-menu.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-009-open-any-console-page-from-its-address.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-014-offer-exactly-the-applications-the-workspace-and-the-person.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-015-say-plainly-when-a-page-belongs-to-an-application-the.md#permissions']
  - key: console.quick-search
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-CSH-003-05]
    kind: console-entitlement
    derived_from: [platform.quick-search.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-003-act-from-the-keyboard.md#permissions']
  - key: console.system
    intent: Present staff destinations when the evaluated context identifies Rhythm staff.
    operations: []
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-CSH-014-10]
    kind: console-entitlement
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-013-work-in-rhythm-hq-or-in-a-workspace-never-both-at-once.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-014-offer-exactly-the-applications-the-workspace-and-the-person.md#permissions']
  - key: crm.activities.bulk
    intent: Apply counted bulk changes to activities within the caller’s applicable scope.
    operations: [applyActivitiesDataJob, cancelActivitiesDataJob, getActivitiesDataJob, listActivitiesDataJobRejections, listActivitiesDataJobResults, listActivitiesDataJobs, pauseActivitiesDataJob, readActivitiesBySourceKey, resumeActivitiesDataJob, retryActivitiesDataJob, revalidateActivitiesDataJobConflicts, submitActivitiesDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-007-delete-records-in-bulk-only-after-a-counted-typed-approval.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-012-load-records-from-another-system-by-its-own-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.activities.bulk and one of crm.activities.update or crm.activities.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyActivitiesDataJob, cancelActivitiesDataJob, getActivitiesDataJob, listActivitiesDataJobRejections, listActivitiesDataJobResults, listActivitiesDataJobs, pauseActivitiesDataJob, readActivitiesBySourceKey, resumeActivitiesDataJob, retryActivitiesDataJob, revalidateActivitiesDataJobConflicts, submitActivitiesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.activities.delete
    intent: Remove activities within the caller’s applicable scope.
    operations: [applyActivitiesDataJob, cancelActivitiesDataJob, getActivitiesDataJob, listActivitiesDataJobRejections, listActivitiesDataJobResults, listActivitiesDataJobs, pauseActivitiesDataJob, readActivitiesBySourceKey, resumeActivitiesDataJob, retryActivitiesDataJob, revalidateActivitiesDataJobConflicts, submitActivitiesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-007-delete-records-in-bulk-only-after-a-counted-typed-approval.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.activities.update
    intent: Revise activities within the caller’s applicable scope.
    operations: [applyActivitiesDataJob, cancelActivitiesDataJob, getActivitiesDataJob, listActivitiesDataJobRejections, listActivitiesDataJobResults, listActivitiesDataJobs, pauseActivitiesDataJob, readActivitiesBySourceKey, resumeActivitiesDataJob, retryActivitiesDataJob, revalidateActivitiesDataJobConflicts, submitActivitiesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.activity-types.bulk
    intent: Apply counted bulk changes to activity types within the caller’s applicable scope.
    operations: [applyActivityTypesDataJob, cancelActivityTypesDataJob, getActivityTypesDataJob, listActivityTypesDataJobRejections, listActivityTypesDataJobResults, listActivityTypesDataJobs, pauseActivityTypesDataJob, readActivityTypesBySourceKey, resumeActivityTypesDataJob, retryActivityTypesDataJob, revalidateActivityTypesDataJobConflicts, submitActivityTypesDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-012-load-records-from-another-system-by-its-own-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.activity-types.bulk and crm.activity-types.update
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyActivityTypesDataJob, cancelActivityTypesDataJob, getActivityTypesDataJob, listActivityTypesDataJobRejections, listActivityTypesDataJobResults, listActivityTypesDataJobs, pauseActivityTypesDataJob, readActivityTypesBySourceKey, resumeActivityTypesDataJob, retryActivityTypesDataJob, revalidateActivityTypesDataJobConflicts, submitActivityTypesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.activity-types.update
    intent: Revise activity types within the caller’s applicable scope.
    operations: [applyActivityTypesDataJob, cancelActivityTypesDataJob, getActivityTypesDataJob, listActivityTypesDataJobRejections, listActivityTypesDataJobResults, listActivityTypesDataJobs, pauseActivityTypesDataJob, readActivityTypesBySourceKey, resumeActivityTypesDataJob, retryActivityTypesDataJob, revalidateActivityTypesDataJobConflicts, submitActivityTypesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.address-types.bulk
    intent: Apply counted bulk changes to address types within the caller’s applicable scope.
    operations: [applyAddressTypesDataJob, cancelAddressTypesDataJob, getAddressTypesDataJob, listAddressTypesDataJobRejections, listAddressTypesDataJobResults, listAddressTypesDataJobs, pauseAddressTypesDataJob, readAddressTypesBySourceKey, resumeAddressTypesDataJob, retryAddressTypesDataJob, revalidateAddressTypesDataJobConflicts, submitAddressTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.address-types.bulk and one of crm.address-types.update or crm.address-types.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyAddressTypesDataJob, cancelAddressTypesDataJob, getAddressTypesDataJob, listAddressTypesDataJobRejections, listAddressTypesDataJobResults, listAddressTypesDataJobs, pauseAddressTypesDataJob, readAddressTypesBySourceKey, resumeAddressTypesDataJob, retryAddressTypesDataJob, revalidateAddressTypesDataJobConflicts, submitAddressTypesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.address-types.delete
    intent: Remove address types within the caller’s applicable scope.
    operations: [applyAddressTypesDataJob, cancelAddressTypesDataJob, getAddressTypesDataJob, listAddressTypesDataJobRejections, listAddressTypesDataJobResults, listAddressTypesDataJobs, pauseAddressTypesDataJob, readAddressTypesBySourceKey, resumeAddressTypesDataJob, retryAddressTypesDataJob, revalidateAddressTypesDataJobConflicts, submitAddressTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.address-types.update
    intent: Revise address types within the caller’s applicable scope.
    operations: [applyAddressTypesDataJob, cancelAddressTypesDataJob, getAddressTypesDataJob, listAddressTypesDataJobRejections, listAddressTypesDataJobResults, listAddressTypesDataJobs, pauseAddressTypesDataJob, readAddressTypesBySourceKey, resumeAddressTypesDataJob, retryAddressTypesDataJob, revalidateAddressTypesDataJobConflicts, submitAddressTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.application.access
    intent: Authorize access application within the caller’s applicable scope.
    operations: []
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-CSH-014-10]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-014-offer-exactly-the-applications-the-workspace-and-the-person.md#permissions']
  - key: crm.contact-layouts.create
    intent: Add contact layouts within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: crm.contact-layouts.delete
    intent: Remove contact layouts within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: crm.contact-layouts.read
    intent: Inspect contact layouts within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: 'crm.contact-layouts.read, .create, .update, .delete and the other purpose owners'' administration keys'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: crm.contact-layouts.update
    intent: Revise contact layouts within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: crm.contact-roles.bulk
    intent: Apply counted bulk changes to contact roles within the caller’s applicable scope.
    operations: [applyContactRolesDataJob, cancelContactRolesDataJob, getContactRolesDataJob, listContactRolesDataJobRejections, listContactRolesDataJobResults, listContactRolesDataJobs, pauseContactRolesDataJob, readContactRolesBySourceKey, resumeContactRolesDataJob, retryContactRolesDataJob, revalidateContactRolesDataJobConflicts, submitContactRolesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contact-roles.bulk and one of crm.contact-roles.update or crm.contact-roles.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyContactRolesDataJob, cancelContactRolesDataJob, getContactRolesDataJob, listContactRolesDataJobRejections, listContactRolesDataJobResults, listContactRolesDataJobs, pauseContactRolesDataJob, readContactRolesBySourceKey, resumeContactRolesDataJob, retryContactRolesDataJob, revalidateContactRolesDataJobConflicts, submitContactRolesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contact-roles.delete
    intent: Remove contact roles within the caller’s applicable scope.
    operations: [applyContactRolesDataJob, cancelContactRolesDataJob, getContactRolesDataJob, listContactRolesDataJobRejections, listContactRolesDataJobResults, listContactRolesDataJobs, pauseContactRolesDataJob, readContactRolesBySourceKey, resumeContactRolesDataJob, retryContactRolesDataJob, revalidateContactRolesDataJobConflicts, submitContactRolesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contact-roles.update
    intent: Revise contact roles within the caller’s applicable scope.
    operations: [applyContactRolesDataJob, cancelContactRolesDataJob, getContactRolesDataJob, listContactRolesDataJobRejections, listContactRolesDataJobResults, listContactRolesDataJobs, pauseContactRolesDataJob, readContactRolesBySourceKey, resumeContactRolesDataJob, retryContactRolesDataJob, revalidateContactRolesDataJobConflicts, submitContactRolesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contact-types.bulk
    intent: Apply counted bulk changes to contact types within the caller’s applicable scope.
    operations: [applyContactTypesDataJob, cancelContactTypesDataJob, getContactTypesDataJob, listContactTypesDataJobRejections, listContactTypesDataJobResults, listContactTypesDataJobs, pauseContactTypesDataJob, readContactTypesBySourceKey, resumeContactTypesDataJob, retryContactTypesDataJob, revalidateContactTypesDataJobConflicts, submitContactTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-015-read-back-what-a-load-wrote-by-the-producer-s-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contact-types.bulk and one of crm.contact-types.update or crm.contact-types.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyContactTypesDataJob, cancelContactTypesDataJob, getContactTypesDataJob, listContactTypesDataJobRejections, listContactTypesDataJobResults, listContactTypesDataJobs, pauseContactTypesDataJob, readContactTypesBySourceKey, resumeContactTypesDataJob, retryContactTypesDataJob, revalidateContactTypesDataJobConflicts, submitContactTypesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contact-types.delete
    intent: Remove contact types within the caller’s applicable scope.
    operations: [applyContactTypesDataJob, cancelContactTypesDataJob, getContactTypesDataJob, listContactTypesDataJobRejections, listContactTypesDataJobResults, listContactTypesDataJobs, pauseContactTypesDataJob, readContactTypesBySourceKey, resumeContactTypesDataJob, retryContactTypesDataJob, revalidateContactTypesDataJobConflicts, submitContactTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contact-types.update
    intent: Revise contact types within the caller’s applicable scope.
    operations: [applyContactTypesDataJob, cancelContactTypesDataJob, getContactTypesDataJob, listContactTypesDataJobRejections, listContactTypesDataJobResults, listContactTypesDataJobs, pauseContactTypesDataJob, readContactTypesBySourceKey, resumeContactTypesDataJob, retryContactTypesDataJob, revalidateContactTypesDataJobConflicts, submitContactTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contacts.bulk
    intent: Apply counted bulk changes to contacts within the caller’s applicable scope.
    operations: [applyContactDataJob, cancelContactDataJob, getContactDataJob, listContactDataJobMappingTargets, listContactDataJobRejections, listContactDataJobResults, listContactDataJobs, pauseContactDataJob, readContactsBySourceKey, resumeContactDataJob, retryContactDataJob, revalidateContactDataJobConflicts, rollbackContactDataJob, submitContactDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-002-preview-what-a-job-will-do-and-approve-exactly-that.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-003-apply-every-good-record-and-set-aside-every-bad-one.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-004-pause-resume-cancel-or-retry-a-job-safely.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-005-follow-a-job-and-trace-every-change-it-made.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-006-never-overwrite-a-colleague-s-edit-made-during-a-bulk-change.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-007-delete-records-in-bulk-only-after-a-counted-typed-approval.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-008-put-a-bulk-change-back-without-losing-later-edits.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-009-update-or-delete-selected-records-from-a-list-in-one-dialog.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-012-load-records-from-another-system-by-its-own-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-013-map-a-spreadsheet-s-columns-onto-a-record-s-typed-details.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-014-run-large-files-without-starving-anyone-else.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-015-read-back-what-a-load-wrote-by-the-producer-s-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contacts.bulk and one of crm.contacts.update or crm.contacts.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyContactDataJob, cancelContactDataJob, getContactDataJob, listContactDataJobMappingTargets, listContactDataJobRejections, listContactDataJobResults, listContactDataJobs, pauseContactDataJob, readContactsBySourceKey, resumeContactDataJob, retryContactDataJob, revalidateContactDataJobConflicts, rollbackContactDataJob, submitContactDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contacts.delete
    intent: Remove contacts within the caller’s applicable scope.
    operations: [applyContactDataJob, cancelContactDataJob, getContactDataJob, listContactDataJobMappingTargets, listContactDataJobRejections, listContactDataJobResults, listContactDataJobs, pauseContactDataJob, readContactsBySourceKey, resumeContactDataJob, retryContactDataJob, revalidateContactDataJobConflicts, rollbackContactDataJob, submitContactDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-007-delete-records-in-bulk-only-after-a-counted-typed-approval.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.contacts.query
    intent: Query contacts within the caller’s applicable scope.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-ELG-011-02, BR-CAP-PFM-ELG-011-08, BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-011-see-who-a-rule-covers-and-what-a-change-would-do.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-001-know-which-data-can-be-queried-and-what-each-dataset-holds.md#permissions']
  - key: crm.contacts.read
    intent: Inspect contacts within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-003-01, BR-CAP-PFM-ELG-003-03, BR-CAP-PFM-ELG-003-04, BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07, BR-CAP-PFM-QRY-016-04]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-003-test-a-rule-on-real-people-before-relying-on-it.md#permissions', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-008-record-that-a-person-opened-a-record.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-016-find-contacts-and-organizations-as-one-types.md#permissions']
  - key: 'crm.contacts.read (the record type''s own permission, for contacts and organizations alike)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-016-04]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-016-find-contacts-and-organizations-as-one-types.md#permissions']
  - key: 'crm.contacts.read, crm.organizations.read, committees.committees.read, platform.custom-records.read (consumption)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: crm.contacts.update
    intent: Revise contacts within the caller’s applicable scope.
    operations: [applyContactDataJob, cancelContactDataJob, getContactDataJob, listContactDataJobMappingTargets, listContactDataJobRejections, listContactDataJobResults, listContactDataJobs, pauseContactDataJob, readContactsBySourceKey, resumeContactDataJob, retryContactDataJob, revalidateContactDataJobConflicts, rollbackContactDataJob, submitContactDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-002-preview-what-a-job-will-do-and-approve-exactly-that.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-003-apply-every-good-record-and-set-aside-every-bad-one.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-006-never-overwrite-a-colleague-s-edit-made-during-a-bulk-change.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-008-put-a-bulk-change-back-without-losing-later-edits.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-012-load-records-from-another-system-by-its-own-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-013-map-a-spreadsheet-s-columns-onto-a-record-s-typed-details.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organization-types.bulk
    intent: Apply counted bulk changes to organization types within the caller’s applicable scope.
    operations: [applyOrganizationTypesDataJob, cancelOrganizationTypesDataJob, getOrganizationTypesDataJob, listOrganizationTypesDataJobRejections, listOrganizationTypesDataJobResults, listOrganizationTypesDataJobs, pauseOrganizationTypesDataJob, readOrganizationTypesBySourceKey, resumeOrganizationTypesDataJob, retryOrganizationTypesDataJob, revalidateOrganizationTypesDataJobConflicts, submitOrganizationTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organization-types.bulk and one of crm.organization-types.update or crm.organization-types.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyOrganizationTypesDataJob, cancelOrganizationTypesDataJob, getOrganizationTypesDataJob, listOrganizationTypesDataJobRejections, listOrganizationTypesDataJobResults, listOrganizationTypesDataJobs, pauseOrganizationTypesDataJob, readOrganizationTypesBySourceKey, resumeOrganizationTypesDataJob, retryOrganizationTypesDataJob, revalidateOrganizationTypesDataJobConflicts, submitOrganizationTypesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organization-types.delete
    intent: Remove organization types within the caller’s applicable scope.
    operations: [applyOrganizationTypesDataJob, cancelOrganizationTypesDataJob, getOrganizationTypesDataJob, listOrganizationTypesDataJobRejections, listOrganizationTypesDataJobResults, listOrganizationTypesDataJobs, pauseOrganizationTypesDataJob, readOrganizationTypesBySourceKey, resumeOrganizationTypesDataJob, retryOrganizationTypesDataJob, revalidateOrganizationTypesDataJobConflicts, submitOrganizationTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organization-types.update
    intent: Revise organization types within the caller’s applicable scope.
    operations: [applyOrganizationTypesDataJob, cancelOrganizationTypesDataJob, getOrganizationTypesDataJob, listOrganizationTypesDataJobRejections, listOrganizationTypesDataJobResults, listOrganizationTypesDataJobs, pauseOrganizationTypesDataJob, readOrganizationTypesBySourceKey, resumeOrganizationTypesDataJob, retryOrganizationTypesDataJob, revalidateOrganizationTypesDataJobConflicts, submitOrganizationTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organizations.bulk
    intent: Apply counted bulk changes to organizations within the caller’s applicable scope.
    operations: [applyOrganizationDataJob, cancelOrganizationDataJob, getOrganizationDataJob, listOrganizationDataJobMappingTargets, listOrganizationDataJobRejections, listOrganizationDataJobResults, listOrganizationDataJobs, pauseOrganizationDataJob, readOrganizationsBySourceKey, resumeOrganizationDataJob, retryOrganizationDataJob, revalidateOrganizationDataJobConflicts, rollbackOrganizationDataJob, submitOrganizationDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-002-preview-what-a-job-will-do-and-approve-exactly-that.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-004-pause-resume-cancel-or-retry-a-job-safely.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-005-follow-a-job-and-trace-every-change-it-made.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-007-delete-records-in-bulk-only-after-a-counted-typed-approval.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-008-put-a-bulk-change-back-without-losing-later-edits.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-009-update-or-delete-selected-records-from-a-list-in-one-dialog.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-012-load-records-from-another-system-by-its-own-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-013-map-a-spreadsheet-s-columns-onto-a-record-s-typed-details.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-014-run-large-files-without-starving-anyone-else.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-015-read-back-what-a-load-wrote-by-the-producer-s-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organizations.bulk and one of crm.organizations.update or crm.organizations.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyOrganizationDataJob, cancelOrganizationDataJob, getOrganizationDataJob, listOrganizationDataJobMappingTargets, listOrganizationDataJobRejections, listOrganizationDataJobResults, listOrganizationDataJobs, pauseOrganizationDataJob, readOrganizationsBySourceKey, resumeOrganizationDataJob, retryOrganizationDataJob, revalidateOrganizationDataJobConflicts, rollbackOrganizationDataJob, submitOrganizationDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organizations.delete
    intent: Remove organizations within the caller’s applicable scope.
    operations: [applyOrganizationDataJob, cancelOrganizationDataJob, getOrganizationDataJob, listOrganizationDataJobMappingTargets, listOrganizationDataJobRejections, listOrganizationDataJobResults, listOrganizationDataJobs, pauseOrganizationDataJob, readOrganizationsBySourceKey, resumeOrganizationDataJob, retryOrganizationDataJob, revalidateOrganizationDataJobConflicts, rollbackOrganizationDataJob, submitOrganizationDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-007-delete-records-in-bulk-only-after-a-counted-typed-approval.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.organizations.read
    intent: Inspect organizations within the caller’s applicable scope.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07, BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-008-record-that-a-person-opened-a-record.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-001-know-which-data-can-be-queried-and-what-each-dataset-holds.md#permissions']
  - key: crm.organizations.update
    intent: Revise organizations within the caller’s applicable scope.
    operations: [applyOrganizationDataJob, cancelOrganizationDataJob, getOrganizationDataJob, listOrganizationDataJobMappingTargets, listOrganizationDataJobRejections, listOrganizationDataJobResults, listOrganizationDataJobs, pauseOrganizationDataJob, readOrganizationsBySourceKey, resumeOrganizationDataJob, retryOrganizationDataJob, revalidateOrganizationDataJobConflicts, rollbackOrganizationDataJob, submitOrganizationDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08, BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-014-01, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-006-never-overwrite-a-colleague-s-edit-made-during-a-bulk-change.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-008-put-a-bulk-change-back-without-losing-later-edits.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-012-load-records-from-another-system-by-its-own-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-013-map-a-spreadsheet-s-columns-onto-a-record-s-typed-details.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.phone-number-types.bulk
    intent: Apply counted bulk changes to phone number types within the caller’s applicable scope.
    operations: [applyPhoneNumberTypesDataJob, cancelPhoneNumberTypesDataJob, getPhoneNumberTypesDataJob, listPhoneNumberTypesDataJobRejections, listPhoneNumberTypesDataJobResults, listPhoneNumberTypesDataJobs, pausePhoneNumberTypesDataJob, readPhoneNumberTypesBySourceKey, resumePhoneNumberTypesDataJob, retryPhoneNumberTypesDataJob, revalidatePhoneNumberTypesDataJobConflicts, submitPhoneNumberTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.phone-number-types.bulk and one of crm.phone-number-types.update or crm.phone-number-types.delete
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyPhoneNumberTypesDataJob, cancelPhoneNumberTypesDataJob, getPhoneNumberTypesDataJob, listPhoneNumberTypesDataJobRejections, listPhoneNumberTypesDataJobResults, listPhoneNumberTypesDataJobs, pausePhoneNumberTypesDataJob, readPhoneNumberTypesBySourceKey, resumePhoneNumberTypesDataJob, retryPhoneNumberTypesDataJob, revalidatePhoneNumberTypesDataJobConflicts, submitPhoneNumberTypesDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.phone-number-types.delete
    intent: Remove phone number types within the caller’s applicable scope.
    operations: [applyPhoneNumberTypesDataJob, cancelPhoneNumberTypesDataJob, getPhoneNumberTypesDataJob, listPhoneNumberTypesDataJobRejections, listPhoneNumberTypesDataJobResults, listPhoneNumberTypesDataJobs, pausePhoneNumberTypesDataJob, readPhoneNumberTypesBySourceKey, resumePhoneNumberTypesDataJob, retryPhoneNumberTypesDataJob, revalidatePhoneNumberTypesDataJobConflicts, submitPhoneNumberTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.phone-number-types.update
    intent: Revise phone number types within the caller’s applicable scope.
    operations: [applyPhoneNumberTypesDataJob, cancelPhoneNumberTypesDataJob, getPhoneNumberTypesDataJob, listPhoneNumberTypesDataJobRejections, listPhoneNumberTypesDataJobResults, listPhoneNumberTypesDataJobs, pausePhoneNumberTypesDataJob, readPhoneNumberTypesBySourceKey, resumePhoneNumberTypesDataJob, retryPhoneNumberTypesDataJob, revalidatePhoneNumberTypesDataJobConflicts, submitPhoneNumberTypesDataJob]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-010-retire-and-reactivate-configuration-items-in-bulk-from-their.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.regions.bulk
    intent: Apply counted bulk changes to regions within the caller’s applicable scope.
    operations: [applyRegionsDataJob, cancelRegionsDataJob, getRegionsDataJob, listRegionsDataJobRejections, listRegionsDataJobResults, listRegionsDataJobs, pauseRegionsDataJob, readRegionsBySourceKey, resumeRegionsDataJob, retryRegionsDataJob, revalidateRegionsDataJobConflicts, submitRegionsDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-012-load-records-from-another-system-by-its-own-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-015-read-back-what-a-load-wrote-by-the-producer-s-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.regions.bulk and crm.regions.update
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyRegionsDataJob, cancelRegionsDataJob, getRegionsDataJob, listRegionsDataJobRejections, listRegionsDataJobResults, listRegionsDataJobs, pauseRegionsDataJob, readRegionsBySourceKey, resumeRegionsDataJob, retryRegionsDataJob, revalidateRegionsDataJobConflicts, submitRegionsDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: crm.regions.update
    intent: Revise regions within the caller’s applicable scope.
    operations: [applyRegionsDataJob, cancelRegionsDataJob, getRegionsDataJob, listRegionsDataJobRejections, listRegionsDataJobResults, listRegionsDataJobs, pauseRegionsDataJob, readRegionsBySourceKey, resumeRegionsDataJob, retryRegionsDataJob, revalidateRegionsDataJobConflicts, submitRegionsDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-012-07, BR-CAP-PFM-DJE-012-10, BR-CAP-PFM-DJE-012-13, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-003-03, BR-CAP-PFM-DJE-003-11, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-DJE-006-01, BR-CAP-PFM-DJE-006-02, BR-CAP-PFM-DJE-006-03, BR-CAP-PFM-DJE-006-04, BR-CAP-PFM-DJE-006-05, BR-CAP-PFM-DJE-006-07, BR-CAP-PFM-DJE-006-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-crm:aws/crm.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md#operations']
  - key: data.jobs.control
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: console-entitlement
    derived_from: [crm.contacts.bulk, crm.organizations.bulk, crm.organization-types.bulk, crm.regions.bulk, crm.tasks.bulk, crm.activities.bulk, crm.contact-roles.bulk, crm.contact-types.bulk, crm.affiliation-types.bulk, crm.address-types.bulk, crm.phone-number-types.bulk, crm.task-types.bulk, crm.task-queues.bulk, crm.activity-types.bulk, crm.contact-layouts.bulk, crm.organization-layouts.bulk]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-004-pause-resume-cancel-or-retry-a-job-safely.md#permissions']
  - key: data.jobs.rollback
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-008-03, BR-CAP-PFM-DJE-008-08]
    kind: console-entitlement
    derived_from: [crm.contacts.bulk]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-008-put-a-bulk-change-back-without-losing-later-edits.md#permissions']
  - key: data.jobs.submit
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    derived_from: [crm.contacts.bulk, crm.organizations.bulk, crm.organization-types.bulk, crm.regions.bulk, crm.tasks.bulk, crm.activities.bulk, crm.contact-roles.bulk, crm.contact-types.bulk, crm.affiliation-types.bulk, crm.address-types.bulk, crm.phone-number-types.bulk, crm.task-types.bulk, crm.task-queues.bulk, crm.activity-types.bulk, crm.contact-layouts.bulk, crm.organization-layouts.bulk]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-009-update-or-delete-selected-records-from-a-list-in-one-dialog.md#permissions']
  - key: data.jobs.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-005-02]
    kind: console-entitlement
    derived_from: [crm.contacts.bulk, crm.organizations.bulk, crm.organization-types.bulk, crm.regions.bulk, crm.tasks.bulk, crm.activities.bulk, crm.contact-roles.bulk, crm.contact-types.bulk, crm.affiliation-types.bulk, crm.address-types.bulk, crm.phone-number-types.bulk, crm.task-types.bulk, crm.task-queues.bulk, crm.activity-types.bulk, crm.contact-layouts.bulk, crm.organization-layouts.bulk]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-007-move-into-a-settings-area-and-back-to-my-work.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-005-follow-a-job-and-trace-every-change-it-made.md#permissions']
  - key: 'each system dataset''s own key (hq.customers.read, hq.tenants.read, hq.jobs.read, hq.staff.read, hq.llm-usage.read)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-004-05, BR-CAP-PFM-QRY-004-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-004-let-rhythm-staff-query-every-customer-from-rhythm-hq.md#permissions']
  - key: hq.*
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: permission-pattern
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-013-work-in-rhythm-hq-or-in-a-workspace-never-both-at-once.md#permissions']
  - key: hq.audit.read
    intent: Inspect audit within the caller’s applicable scope.
    operations: [getHqEmergencyAccessReport]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-017-01, BR-CAP-PFM-SEC-017-02, BR-CAP-PFM-SEC-017-04, BR-CAP-PFM-SEC-017-07, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-SEC-017-14]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-access-requests.routes.ts:getHqEmergencyAccessReport', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md#permissions']
  - key: hq.capacity.manage
    intent: Administer capacity within the caller’s applicable scope.
    operations: [getCapacityStatePin, pinCapacityState, unpinCapacityState]
    surfaces: [api, hq, job]
    guarded_by: [BR-CAP-PFM-DJE-019-04, BR-CAP-PFM-DJE-019-05, BR-CAP-PFM-DJE-019-08, BR-CAP-PFM-DJE-019-09]
    kind: permission
    tier: user
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-019-hold-the-platform-s-protection-state-while-the-database-is.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-capacity.md#operations']
  - key: 'hq.capacity.manage (Rhythm staff, system scope)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [getCapacityStatePin, pinCapacityState, unpinCapacityState]
    surfaces: [hq]
    guarded_by: [BR-CAP-PFM-DJE-019-04, BR-CAP-PFM-DJE-019-05, BR-CAP-PFM-DJE-019-08, BR-CAP-PFM-DJE-019-09]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-capacity.md#operations']
  - key: hq.custom-query-tables.assign
    intent: Assign customer availability for tailored dataset definitions within the caller’s applicable scope.
    operations: [assignCustomQueryTable, pinCustomQueryTableAssignment, unassignCustomQueryTable]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-QRY-005-03, BR-CAP-PFM-QRY-005-08, BR-CAP-PFM-QRY-005-09, BR-CAP-PFM-QRY-005-10, BR-CAP-PFM-QRY-005-11, BR-CAP-PFM-QRY-005-12, BR-CAP-PFM-QRY-005-14, BR-CAP-PFM-QRY-005-15, BR-CAP-PFM-QRY-005-16]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:assignCustomQueryTable', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:pinCustomQueryTableAssignment', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:unassignCustomQueryTable', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-005-give-one-customer-a-staff-authored-custom-query-table.md#permissions']
  - key: hq.custom-query-tables.author
    intent: Author tailored dataset definitions within the caller’s applicable scope.
    operations: [analyzeCustomQueryTableDraft, createCustomQueryTable, previewCustomQueryTable, saveCustomQueryTableDraft, updateCustomQueryTable]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-QRY-005-03, BR-CAP-PFM-QRY-005-08, BR-CAP-PFM-QRY-005-09, BR-CAP-PFM-QRY-005-10, BR-CAP-PFM-QRY-005-11, BR-CAP-PFM-QRY-005-12, BR-CAP-PFM-QRY-005-14, BR-CAP-PFM-QRY-005-15, BR-CAP-PFM-QRY-005-16]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:createCustomQueryTable', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:updateCustomQueryTable', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:saveCustomQueryTableDraft', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:analyzeCustomQueryTableDraft', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:previewCustomQueryTable', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-005-give-one-customer-a-staff-authored-custom-query-table.md#permissions']
  - key: hq.custom-query-tables.publish
    intent: Release tailored dataset definitions within the caller’s applicable scope.
    operations: [deprecateCustomQueryTable, disableCustomQueryTable, publishCustomQueryTable, restoreCustomQueryTable, revalidateCustomQueryTables]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-QRY-005-03, BR-CAP-PFM-QRY-005-08, BR-CAP-PFM-QRY-005-09, BR-CAP-PFM-QRY-005-10, BR-CAP-PFM-QRY-005-11, BR-CAP-PFM-QRY-005-12, BR-CAP-PFM-QRY-005-14, BR-CAP-PFM-QRY-005-15, BR-CAP-PFM-QRY-005-16]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:revalidateCustomQueryTables', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:publishCustomQueryTable', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:lifecycleRoutes', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-005-give-one-customer-a-staff-authored-custom-query-table.md#permissions']
  - key: hq.custom-query-tables.read
    intent: Inspect tailored dataset definitions within the caller’s applicable scope.
    operations: [getCustomQueryTable, getCustomQueryTableUsage, getCustomQueryTableVersion, listCustomQueryTableAssignments, listCustomQueryTableEvents, listCustomQueryTableVersions, listCustomQueryTables]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-QRY-005-03, BR-CAP-PFM-QRY-005-08, BR-CAP-PFM-QRY-005-09, BR-CAP-PFM-QRY-005-10, BR-CAP-PFM-QRY-005-11, BR-CAP-PFM-QRY-005-12, BR-CAP-PFM-QRY-005-14, BR-CAP-PFM-QRY-005-15, BR-CAP-PFM-QRY-005-16]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:listCustomQueryTables', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:getCustomQueryTable', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:listCustomQueryTableVersions', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:getCustomQueryTableVersion', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:listCustomQueryTableAssignments', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:getCustomQueryTableUsage', 'services-platform:modules/queries/aws/api/custom-tables.routes.ts:listCustomQueryTableEvents', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-005-give-one-customer-a-staff-authored-custom-query-table.md#permissions']
  - key: hq.customers.create
    intent: Add customer administration records within the caller’s applicable scope.
    operations: [createCustomer, createHqCustomer]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-001-06, BR-CAP-PFM-SEC-001-13]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/customers/aws/api/customers.routes.ts:createCustomer', 'services-platform:modules/customers/aws/api/customers.routes.ts:createHqCustomer', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md#permissions']
  - key: hq.customers.delete
    intent: Remove customer administration records within the caller’s applicable scope.
    operations: [deleteCustomer]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-001-06, BR-CAP-PFM-SEC-001-13]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/customers/aws/api/customers.routes.ts:deleteCustomer', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md#permissions']
  - key: hq.customers.read
    intent: Inspect customer administration records within the caller’s applicable scope.
    operations: [getHqCustomer, listHqCustomers]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-001-06, BR-CAP-PFM-SEC-001-13, BR-CAP-PFM-QRY-004-05, BR-CAP-PFM-QRY-004-08]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/customers/aws/api/customers.routes.ts:listHqCustomers', 'services-platform:modules/customers/aws/api/customers.routes.ts:getHqCustomer', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-004-let-rhythm-staff-query-every-customer-from-rhythm-hq.md#permissions']
  - key: hq.customers.update
    intent: Revise customer administration records within the caller’s applicable scope.
    operations: [patchHqCustomer]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-001-06, BR-CAP-PFM-SEC-001-13]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/customers/aws/api/customers.routes.ts:patchHqCustomer', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md#permissions']
  - key: hq.data-exports.operate
    intent: Recover or resolve operational work for workspace data packages within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-018-take-a-complete-portable-export-of-the-workspace-s-data.md#permissions']
  - key: hq.data-exports.read
    intent: Inspect workspace data packages within the caller’s applicable scope.
    operations: [getHqDataExportCoverage, getHqDataExportEntitlements, getHqDataExportTenantCoverage, listHqDataExportExecutions]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:listHqDataExportExecutions', 'services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:getHqDataExportCoverage', 'services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:getHqDataExportTenantCoverage', 'services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:getHqDataExportEntitlements', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-018-take-a-complete-portable-export-of-the-workspace-s-data.md#permissions']
  - key: hq.data-runs.manage
    intent: Administer data runs within the caller’s applicable scope.
    operations: [cancelDataRun, enterHqTenantLoading, getDataRun, getHqTenantReset, listDataRunSteps, listDataRuns, pauseDataRun, registerDataRun, resetHqTenant, resumeDataRun, startDataRun]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-DJE-016-02, BR-CAP-PFM-DJE-016-05, BR-CAP-PFM-DJE-016-07, BR-CAP-PFM-DJE-016-09, BR-CAP-PFM-DJE-017-01, BR-CAP-PFM-SEC-003-04, BR-CAP-PFM-SEC-003-05, BR-CAP-PFM-SEC-003-13, BR-CAP-PFM-SEC-003-14, BR-CAP-PFM-TNL-011-03, BR-CAP-PFM-TNL-012-03]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-016-load-a-migration-package-into-a-new-workspace-in-dependency.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-017-empty-a-loading-workspace-to-load-it-again-and-open-it-only.md#permissions', 'services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts:enterHqTenantLoading', 'services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts:resetHqTenant', 'services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts:getHqTenantReset', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-003-provision-a-workspace-and-bring-it-into-service.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-012-empty-a-loading-workspace-so-it-can-be-loaded-again.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: 'hq.data-runs.manage (Rhythm staff, system scope)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [listDataRunSteps, listDataRuns, pauseDataRun, registerDataRun]
    surfaces: [hq]
    guarded_by: [BR-CAP-PFM-DJE-016-02, BR-CAP-PFM-DJE-016-05, BR-CAP-PFM-DJE-016-07, BR-CAP-PFM-DJE-016-09]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: 'hq.data-runs.manage (Rhythm staff, system scope); the Platform step keys are evaluated for in-process datasets'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [cancelDataRun, getDataRun, resumeDataRun, startDataRun]
    surfaces: [hq]
    guarded_by: [BR-CAP-PFM-DJE-016-02, BR-CAP-PFM-DJE-016-05, BR-CAP-PFM-DJE-016-07, BR-CAP-PFM-DJE-016-09, BR-CAP-PFM-DJE-017-01]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: hq.emergency-access.use
    intent: Establish recorded emergency customer entry under staff authority.
    operations: [endHqOwnAccessGrant, endHqStaffMemberAccessGrant, listHqOwnAccessGrants, openHqEmergencyAccess]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-017-01, BR-CAP-PFM-SEC-017-02, BR-CAP-PFM-SEC-017-04, BR-CAP-PFM-SEC-017-07, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-SEC-017-14]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-staff-access.routes.ts:openHqEmergencyAccess', 'services-platform:modules/security/aws/api/hq-staff-access.routes.ts:listHqOwnAccessGrants', 'services-platform:modules/security/aws/api/hq-staff-access.routes.ts:endHqOwnAccessGrant', 'services-platform:modules/security/aws/api/hq-staff-access.routes.ts:endHqStaffMemberAccessGrant', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md#permissions']
  - key: hq.integrations.operate
    intent: Recover or resolve operational work for integrations within the caller’s applicable scope.
    operations: [listIntegrationEventsEverywhere, listIntegrationExecutionsNeedingAttention, listStaffIntegrationCatalog, resetIntegrationCircuit]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-INT-001-04, BR-CAP-PFM-INT-001-06, BR-CAP-PFM-INT-001-07, BR-CAP-PFM-INT-001-10, BR-CAP-PFM-INT-001-11]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-001-offer-integrations-to-the-customers-who-may-use-them.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-011-review-and-operate-calls-by-hand.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-015-deliver-integration-events-to-rhythm-applications.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: hq.integrations.operate (Rhythm staff only)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [listIntegrationEventsEverywhere, listIntegrationExecutionsNeedingAttention, listStaffIntegrationCatalog, resetIntegrationCircuit]
    surfaces: [hq]
    guarded_by: [BR-CAP-PFM-INT-001-04, BR-CAP-PFM-INT-001-06, BR-CAP-PFM-INT-001-07, BR-CAP-PFM-INT-001-10, BR-CAP-PFM-INT-001-11]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: hq.integrations.publish
    intent: Release integrations within the caller’s applicable scope.
    operations: [deprecateIntegrationVersion, listIntegrationPlatformSecrets, publishIntegrationVersion, putIntegrationPlatformSecret, registerIntegrationEventConsumer, registerIntegrationVersion, retireIntegrationVersion, setIntegrationAvailability]
    surfaces: [api, hq, job, service]
    guarded_by: [BR-CAP-PFM-INT-001-04, BR-CAP-PFM-INT-001-06, BR-CAP-PFM-INT-001-07, BR-CAP-PFM-INT-001-10, BR-CAP-PFM-INT-001-11]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-001-offer-integrations-to-the-customers-who-may-use-them.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-015-deliver-integration-events-to-rhythm-applications.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: hq.integrations.publish (Rhythm staff only)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [deprecateIntegrationVersion, listIntegrationPlatformSecrets, publishIntegrationVersion, putIntegrationPlatformSecret, retireIntegrationVersion, setIntegrationAvailability]
    surfaces: [hq]
    guarded_by: [BR-CAP-PFM-INT-001-04, BR-CAP-PFM-INT-001-06, BR-CAP-PFM-INT-001-07, BR-CAP-PFM-INT-001-10, BR-CAP-PFM-INT-001-11]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: hq.integrations.publish (service caller)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [registerIntegrationEventConsumer, registerIntegrationVersion]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-INT-001-04, BR-CAP-PFM-INT-001-06, BR-CAP-PFM-INT-001-07, BR-CAP-PFM-INT-001-10, BR-CAP-PFM-INT-001-11]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: hq.jobs.read
    intent: Inspect jobs within the caller’s applicable scope.
    operations: [countJobsInHq, getJobInHq, listJobEventsInHq, listJobKindsInHq, listJobsInHq]
    surfaces: [api, console, service]
    guarded_by: [BR-CAP-PFM-OPS-007-03, BR-CAP-PFM-QRY-004-05, BR-CAP-PFM-QRY-004-08]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-jobs.md#operations', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-006-watch-every-job-of-the-platform-from-rhythm-hq.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-004-let-rhythm-staff-query-every-customer-from-rhythm-hq.md#permissions']
  - key: hq.jobs.retry
    intent: Authorize retry jobs within the caller’s applicable scope.
    operations: []
    surfaces: [console, job]
    guarded_by: [BR-CAP-PFM-OPS-004-04]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-004-run-a-failed-job-again-or-stop-one-that-is-running.md#permissions']
  - key: hq.licensing.manage
    intent: Administer licensing within the caller’s applicable scope.
    operations: [createTenantLicenceOverride, resumeTenantApplication, retryTenantApplicationProvisioning, revokeTenantLicenceOverride, suspendTenantApplication, syncHubspotCompanyLicensing]
    surfaces: [api, console, job, service]
    guarded_by: [BR-CAP-PFM-OPS-012-13, BR-CAP-PFM-OPS-012-19, BR-CAP-PFM-OPS-011-01, BR-CAP-PFM-OPS-011-02, BR-CAP-PFM-OPS-011-05, BR-CAP-PFM-OPS-011-06, BR-CAP-PFM-OPS-011-07, BR-CAP-PFM-OPS-011-10, BR-CAP-PFM-OPS-015-02, BR-CAP-PFM-OPS-015-03, BR-CAP-PFM-OPS-015-05, BR-CAP-PFM-OPS-015-07, BR-CAP-PFM-OPS-015-08, BR-CAP-PFM-OPS-015-09, BR-CAP-PFM-OPS-015-10, BR-CAP-PFM-OPS-013-01, BR-CAP-PFM-OPS-013-05, BR-CAP-PFM-OPS-013-06]
    kind: permission
    tier: user
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-licensing.md#operations', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-011-grant-or-withhold-an-application-for-a-workspace-by-rhythm-s.md#permissions', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-012-license-workspaces-from-their-hubspot-contracts.md#permissions', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-013-review-a-workspace-s-licensing-in-rhythm-hq.md#permissions', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-015-bring-an-application-into-service-for-a-workspace-and-keep-it.md#permissions']
  - key: hq.licensing.read
    intent: Inspect licensing within the caller’s applicable scope.
    operations: [getHubspotCompanyLicensing, getLicenceSyncHealth, getTenantLicensing]
    surfaces: [api, console, job, service]
    guarded_by: [BR-CAP-PFM-OPS-013-01, BR-CAP-PFM-OPS-013-05, BR-CAP-PFM-OPS-013-06, BR-CAP-PFM-OPS-012-13, BR-CAP-PFM-OPS-012-19]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-licensing.md#operations', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-012-license-workspaces-from-their-hubspot-contracts.md#permissions', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-013-review-a-workspace-s-licensing-in-rhythm-hq.md#permissions']
  - key: hq.llm-usage.manage
    intent: Administer AI allowance and usage information within the caller’s applicable scope.
    operations: [createHqTenantLlmUsageAdjustment, grantHqTenantLlmUsageOverride, previewHqTenantLlmUsageLimits, previewHqTenantLlmUsageOverride, putHqTenantLlmUsageLimits, revokeHqTenantLlmUsageOverride]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-LLM-013-03, BR-CAP-PFM-LLM-013-04, BR-CAP-PFM-LLM-013-05, BR-CAP-PFM-LLM-013-07, BR-CAP-PFM-LLM-013-09, BR-CAP-PFM-LLM-013-10, BR-CAP-PFM-LLM-015-02, BR-CAP-PFM-LLM-014-03, BR-CAP-PFM-LLM-014-04, BR-CAP-PFM-LLM-014-06, BR-CAP-PFM-LLM-014-07, BR-CAP-PFM-LLM-011-02, BR-CAP-PFM-LLM-011-07]
    kind: permission
    tier: user
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-011-inspect-one-organization-s-ai-usage-and-requests.md#permissions', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-013-set-what-ai-an-organization-may-use-and-how-much.md#permissions', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-014-grant-and-revoke-temporary-ai-capacity.md#permissions', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-015-correct-what-an-organization-was-charged-for-ai.md#permissions']
  - key: hq.llm-usage.read
    intent: Inspect AI allowance and usage information within the caller’s applicable scope.
    operations: [explainHqTenantLlmUsageInvocation, getHqLlmUsageBreakdown, getHqLlmUsageCatalog, getHqLlmUsageRates, getHqLlmUsageSummary, getHqLlmUsageTrend, getHqTenantLlmUsage, getHqTenantLlmUsageExecution, getHqTenantLlmUsageInvocation, getHqTenantLlmUsageLimits, listHqLlmUsageExecutions, listHqLlmUsageTenants, listHqTenantLlmUsageAdjustments, listHqTenantLlmUsageAudit, listHqTenantLlmUsageCrossings, listHqTenantLlmUsageExecutions, listHqTenantLlmUsageInvocations, listHqTenantLlmUsageOverrides, listHqTenantLlmUsagePeriods]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-LLM-010-01, BR-CAP-PFM-LLM-010-11, BR-CAP-PFM-LLM-005-02, BR-CAP-PFM-LLM-005-03, BR-CAP-PFM-LLM-005-04, BR-CAP-PFM-LLM-005-10, BR-CAP-PFM-LLM-011-02, BR-CAP-PFM-LLM-011-07, BR-CAP-PFM-LLM-013-03, BR-CAP-PFM-LLM-013-04, BR-CAP-PFM-LLM-013-05, BR-CAP-PFM-LLM-013-07, BR-CAP-PFM-LLM-013-09, BR-CAP-PFM-LLM-013-10, BR-CAP-PFM-LLM-014-03, BR-CAP-PFM-LLM-014-04, BR-CAP-PFM-LLM-014-06, BR-CAP-PFM-LLM-014-07, BR-CAP-PFM-LLM-015-02, BR-CAP-PFM-LLM-008-05, BR-CAP-PFM-LLM-012-03, BR-CAP-PFM-LLM-012-07, BR-CAP-PFM-LLM-012-08, BR-CAP-PFM-QRY-004-05, BR-CAP-PFM-QRY-004-08]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-005-declare-and-publish-ai-operations-and-their-prices.md#permissions', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-010-see-ai-usage-and-spend-across-every-organization.md#permissions', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-011-inspect-one-organization-s-ai-usage-and-requests.md#permissions', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-012-explain-why-an-ai-request-was-refused-or-failed.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-004-let-rhythm-staff-query-every-customer-from-rhythm-hq.md#permissions']
  - key: hq.llm-usage.read-evidence
    intent: Read captured model content with an active workspace-entry grant and completed audit.
    operations: [getHqTenantLlmUsageInvocationEvidence]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-LLM-016-01, BR-CAP-PFM-LLM-016-02, BR-CAP-PFM-LLM-016-05]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-016-read-a-captured-prompt-or-response-under-an-access-grant.md#permissions']
  - key: hq.notifications.operate
    intent: Recover or resolve operational work for staff notices within the caller’s applicable scope.
    operations: [retryHqNotificationDelivery]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-NOT-012-02]
    kind: permission
    tier: user
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-012-support-a-customers-notifications-from-rhythm-hq.md#permissions']
  - key: hq.notifications.read
    intent: Inspect staff notices within the caller’s applicable scope.
    operations: [listHqNotificationDeadLetters, listHqNotificationDefinitions, listHqTenantNotificationHistory, listHqTenantNotificationRequests]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-NOT-001-02, BR-CAP-PFM-NOT-001-10, BR-CAP-PFM-NOT-012-02]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-001-register-the-kinds-of-notification-an-application-can-send.md#permissions', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-012-support-a-customers-notifications-from-rhythm-hq.md#permissions']
  - key: hq.queries.read
    intent: Inspect queries within the caller’s applicable scope.
    operations: [createSystemQueryRecipeDraft, describeSystemQueryDataset, getSystemQueryRecipe, listSystemQueryDatasets, listSystemQueryRecipes, runSystemDatasetQuery, validateSystemDatasetQuery]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-QRY-004-05, BR-CAP-PFM-QRY-004-08]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/system-queries.routes.ts:listSystemQueryDatasets', 'services-platform:modules/queries/aws/api/system-queries.routes.ts:describeSystemQueryDataset', 'services-platform:modules/queries/aws/api/system-queries.routes.ts:runSystemDatasetQuery', 'services-platform:modules/queries/aws/api/system-queries.routes.ts:validateSystemDatasetQuery', 'services-platform:modules/queries/aws/api/system-queries.routes.ts:listSystemQueryRecipes', 'services-platform:modules/queries/aws/api/system-queries.routes.ts:getSystemQueryRecipe', 'services-platform:modules/queries/aws/api/system-queries.routes.ts:createSystemQueryRecipeDraft', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-004-let-rhythm-staff-query-every-customer-from-rhythm-hq.md#permissions']
  - key: hq.roles.manage
    intent: Authorize assignment of the Rhythm Administrator role during staff invitation.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-016-03, BR-CAP-PFM-SEC-016-04, BR-CAP-PFM-SEC-016-09, BR-CAP-PFM-SEC-016-10]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md#permissions']
  - key: hq.roles.read
    intent: Inspect roles within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-016-03, BR-CAP-PFM-SEC-016-04, BR-CAP-PFM-SEC-016-09, BR-CAP-PFM-SEC-016-10]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md#permissions']
  - key: hq.service-principals.manage
    intent: Administer registered machine identities within the caller’s applicable scope.
    operations: [resumeHqServicePrincipal, suspendHqServicePrincipal]
    surfaces: [api, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-018-02, BR-CAP-PFM-SEC-018-03]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-service-principals.routes.ts:suspendHqServicePrincipal', 'services-platform:modules/security/aws/api/hq-service-principals.routes.ts:resumeHqServicePrincipal', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-018-stop-and-restart-another-service-s-calls-into-rhythm.md#permissions']
  - key: hq.service-principals.read
    intent: Inspect registered machine identities within the caller’s applicable scope.
    operations: [listHqServicePrincipals]
    surfaces: [api, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-018-02, BR-CAP-PFM-SEC-018-03]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-service-principals.routes.ts:listHqServicePrincipals', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-018-stop-and-restart-another-service-s-calls-into-rhythm.md#permissions']
  - key: hq.snapshots.manage
    intent: Administer snapshots within the caller’s applicable scope.
    operations: [deleteSnapshotPolicyInHq, putSnapshotPolicyInHq, requestSnapshotBackfillInHq, requestSnapshotRunInHq]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-QRY-019-01, BR-CAP-PFM-QRY-019-04, BR-CAP-PFM-QRY-019-05, BR-CAP-PFM-QRY-019-06, BR-CAP-PFM-QRY-019-08, BR-CAP-PFM-QRY-019-10, BR-CAP-PFM-QRY-019-11]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:requestSnapshotRunInHq', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:requestSnapshotBackfillInHq', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:putSnapshotPolicyInHq', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:deleteSnapshotPolicyInHq', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-019-keep-monthly-snapshots-of-each-workspace-and-show-which.md#permissions']
  - key: hq.snapshots.read
    intent: Inspect snapshots within the caller’s applicable scope.
    operations: [getSnapshotPeriodStatusInHq, getSnapshotRunInHq, listOverdueSnapshotRunsInHq, listSnapshotPoliciesInHq, listSnapshotRunsInHq]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-QRY-019-01, BR-CAP-PFM-QRY-019-04, BR-CAP-PFM-QRY-019-05, BR-CAP-PFM-QRY-019-06, BR-CAP-PFM-QRY-019-08, BR-CAP-PFM-QRY-019-10, BR-CAP-PFM-QRY-019-11]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:listSnapshotRunsInHq', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:getSnapshotRunInHq', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:getSnapshotPeriodStatusInHq', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:listOverdueSnapshotRunsInHq', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:listSnapshotPoliciesInHq', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-019-keep-monthly-snapshots-of-each-workspace-and-show-which.md#permissions']
  - key: hq.staff.disable
    intent: Disable a reachable Rhythm staff membership.
    operations: [reinstateHqStaff, revokeHqStaff, suspendHqStaff]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-016-03, BR-CAP-PFM-SEC-016-04, BR-CAP-PFM-SEC-016-09, BR-CAP-PFM-SEC-016-10]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:suspendHqStaff', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:reinstateHqStaff', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:revokeHqStaff', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md#permissions']
  - key: hq.staff.invite
    intent: Invite a colleague into one of Rhythm’s permitted staff roles.
    operations: [inviteHqStaff, resendHqStaffInvitation]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-016-03, BR-CAP-PFM-SEC-016-04, BR-CAP-PFM-SEC-016-09, BR-CAP-PFM-SEC-016-10]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:inviteHqStaff', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:resendHqStaffInvitation', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md#permissions']
  - key: hq.staff.read
    intent: Inspect Rhythm staff memberships within the caller’s applicable scope.
    operations: [getHqStaffMember, listHqRoles, listHqStaff]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-016-03, BR-CAP-PFM-SEC-016-04, BR-CAP-PFM-SEC-016-09, BR-CAP-PFM-SEC-016-10, BR-CAP-PFM-QRY-004-05, BR-CAP-PFM-QRY-004-08]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:listHqStaff', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:getHqStaffMember', 'services-platform:modules/security/aws/api/hq-staff.routes.ts:listHqRoles', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-004-let-rhythm-staff-query-every-customer-from-rhythm-hq.md#permissions']
  - key: hq.staff.update
    intent: Revise Rhythm staff memberships within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-016-03, BR-CAP-PFM-SEC-016-04, BR-CAP-PFM-SEC-016-09, BR-CAP-PFM-SEC-016-10]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md#permissions']
  - key: hq.tenant-access.read
    intent: Inspect Rhythm staff workspace-entry requests within the caller’s applicable scope.
    operations: [listHqStaffMemberAccessGrants]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-017-01, BR-CAP-PFM-SEC-017-02, BR-CAP-PFM-SEC-017-04, BR-CAP-PFM-SEC-017-07, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-SEC-017-14]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-staff-access.routes.ts:listHqStaffMemberAccessGrants', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md#permissions']
  - key: hq.tenant-access.request
    intent: Ask the customer to approve scoped and time-bounded Rhythm staff entry.
    operations: [listHqTenantAccessRequests, requestHqTenantAccess, withdrawHqTenantAccessRequest]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-017-01, BR-CAP-PFM-SEC-017-02, BR-CAP-PFM-SEC-017-04, BR-CAP-PFM-SEC-017-07, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-SEC-017-14]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-access-requests.routes.ts:requestHqTenantAccess', 'services-platform:modules/security/aws/api/hq-access-requests.routes.ts:listHqTenantAccessRequests', 'services-platform:modules/security/aws/api/hq-access-requests.routes.ts:withdrawHqTenantAccessRequest', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md#permissions']
  - key: hq.tenants.activate
    intent: Open a workspace after initial loading meets its readiness guards.
    operations: [activateHqTenant]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-DJE-017-01, BR-CAP-PFM-SEC-003-04, BR-CAP-PFM-SEC-003-05, BR-CAP-PFM-SEC-003-13, BR-CAP-PFM-SEC-003-14, BR-CAP-PFM-TNL-011-03]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-017-empty-a-loading-workspace-to-load-it-again-and-open-it-only.md#permissions', 'services-platform:modules/tenants/aws/api/hq-tenant-loading.routes.ts:activateHqTenant', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-003-provision-a-workspace-and-bring-it-into-service.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md#permissions']
  - key: hq.tenants.provision
    intent: Request or recover coordinated preparation of a customer workspace.
    operations: [createTenant, initializeTenant, retryTenantProvisioning]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-OPS-004-04, BR-CAP-PFM-SEC-003-04, BR-CAP-PFM-SEC-003-05, BR-CAP-PFM-SEC-003-13, BR-CAP-PFM-SEC-003-14, BR-CAP-PFM-TNL-004-02, BR-CAP-PFM-TNL-004-04, BR-CAP-PFM-TNL-003-01, BR-CAP-PFM-TNL-003-02, BR-CAP-PFM-TNL-003-03, BR-CAP-PFM-TNL-009-02]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-004-run-a-failed-job-again-or-stop-one-that-is-running.md#permissions', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:createTenant', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:retryTenantProvisioning', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:initializeTenant', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-003-provision-a-workspace-and-bring-it-into-service.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-001-ask-for-a-new-workspace-and-have-every-application-build-it.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-002-open-a-new-workspace-only-when-every-application-reports-it.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-003-follow-a-provisioning-retry-it-and-hear-how-it-ended.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-004-give-a-new-customer-its-first-administrator-and-its-own-e.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-009-bring-every-existing-workspace-up-to-the-current-baseline.md#permissions']
  - key: hq.tenants.read
    intent: Inspect workspace administration records within the caller’s applicable scope.
    operations: [getHqTenant, getHqTenantEmailSender, getTenantProvisioning, listHqTenantRoles, listHqTenants, listMyHqTenantShortcuts, pinMyHqTenantShortcut, recordMyHqTenantShortcutOpened, unpinMyHqTenantShortcut]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-017-01, BR-CAP-PFM-SEC-017-02, BR-CAP-PFM-SEC-017-04, BR-CAP-PFM-SEC-017-07, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-SEC-017-14, BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14, BR-CAP-PFM-SEC-003-04, BR-CAP-PFM-SEC-003-05, BR-CAP-PFM-SEC-003-13, BR-CAP-PFM-SEC-003-14, BR-CAP-PFM-TNL-003-01, BR-CAP-PFM-TNL-003-02, BR-CAP-PFM-TNL-003-03, BR-CAP-PFM-QRY-004-05, BR-CAP-PFM-QRY-004-08]
    kind: permission
    tier: read
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/hq-tenant-roles.routes.ts:listHqTenantRoles', 'services-platform:modules/tenants/aws/api/hq-tenant-shortcuts.routes.ts:listMyHqTenantShortcuts', 'services-platform:modules/tenants/aws/api/hq-tenant-shortcuts.routes.ts:pinMyHqTenantShortcut', 'services-platform:modules/tenants/aws/api/hq-tenant-shortcuts.routes.ts:unpinMyHqTenantShortcut', 'services-platform:modules/tenants/aws/api/hq-tenant-shortcuts.routes.ts:recordMyHqTenantShortcutOpened', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:getTenantProvisioning', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:listHqTenants', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:getHqTenant', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:getHqTenantEmailSender', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-003-provision-a-workspace-and-bring-it-into-service.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-003-follow-a-provisioning-retry-it-and-hear-how-it-ended.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-004-let-rhythm-staff-query-every-customer-from-rhythm-hq.md#permissions']
  - key: hq.tenants.update
    intent: Revise workspace administration records within the caller’s applicable scope.
    operations: [deleteTenant, patchHqTenant]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14, BR-CAP-PFM-TNL-018-03, BR-CAP-PFM-TNL-018-05]
    kind: permission
    tier: user
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:deleteTenant', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-018-keep-a-lasting-record-of-a-deleted-workspace-and-stop-it.md#permissions', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:patchHqTenant']
  - key: hq.tenants.update (a status change also evaluates platform.tenants.manage-status)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [patchHqTenant]
    surfaces: [hq]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/tenants/aws/api/tenants.routes.ts:patchHqTenant']
  - key: IAM invocation of platform_metadata_registration (no permission key)
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: []
    surfaces: [job]
    guarded_by: [BR-CAP-PFM-MTD-001-06, BR-CAP-PFM-MTD-001-09]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-001-keep-platform-s-catalogue-of-record-types-equal-to-what-each.md#permissions']
  - key: maintenance.access
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-007-move-into-a-settings-area-and-back-to-my-work.md#permissions']
  - key: maintenance.scheduled-jobs.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-OPS-005-02, BR-CAP-PFM-OPS-005-08]
    kind: console-entitlement
    derived_from: [platform.jobs.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-005-see-what-ran-for-a-workspace-and-across-the-organization.md#permissions']
  - key: none
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [getAuditHealth, getJobsHealth, getLicensingHealth]
    surfaces: [public]
    guarded_by: []
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-audit.md#operations', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-jobs.md#operations', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-licensing.md#operations']
  - key: 'none: a session cookie must be present'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [createAgentConversation (POST /api/agent/conversations), createAgentProject (POST /api/agent/projects), 'deleteAgentConversation (DELETE /api/agent/conversations/{id})', 'deleteAgentProject (DELETE /api/agent/projects/{id})', 'getAgentConversation (GET /api/agent/conversations/{id})', listAgentConversations (GET /api/agent/conversations), 'postAgentConversationMessages (POST /api/agent/conversations/{id}/messages)', 'updateAgentConversation (PATCH /api/agent/conversations/{id})', 'updateAgentProject (PATCH /api/agent/projects/{id})']
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-LLM-019-07, BR-CAP-PFM-LLM-019-10, BR-CAP-PFM-LLM-020-01, BR-CAP-PFM-LLM-020-06]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-console-agent.md#operations']
  - key: 'none: a session cookie must be present; no AI permission or organization AI switch is checked'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [listAgentProjects (GET /api/agent/projects)]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-LLM-019-07, BR-CAP-PFM-LLM-019-10]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-console-agent.md#operations']
  - key: 'none: an in-process call'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [providerFor, withLlmExecution]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-LLM-006-07]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations']
  - key: 'none: an in-process call; the consumer authorises its own caller'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [runOperation]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-LLM-001-04, BR-CAP-PFM-LLM-001-09, BR-CAP-PFM-LLM-001-11, BR-CAP-PFM-LLM-004-05, BR-CAP-PFM-LLM-007-10, BR-CAP-PFM-LLM-013-03, BR-CAP-PFM-LLM-013-04, BR-CAP-PFM-LLM-013-05, BR-CAP-PFM-LLM-013-07, BR-CAP-PFM-LLM-013-09, BR-CAP-PFM-LLM-013-10]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations']
  - key: 'none: authenticated by the HubSpot signature over the request bytes'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [receiveHubspotWebhook]
    surfaces: [public]
    guarded_by: [BR-CAP-PFM-OPS-012-13, BR-CAP-PFM-OPS-012-19]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-licensing.md#operations']
  - key: 'none: database function executable only by the CRM and Platform application roles'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [platform.apply_endpoint_deletion]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-MTD-019-06]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations']
  - key: 'none: database function run in CRM''s merge transaction as CRM''s application role'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [platform.merge_apply_contacts, platform.merge_apply_organizations, platform.merge_plan_contacts, platform.merge_plan_organizations]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-MTD-019-06]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations']
  - key: 'none: IAM invocation of platform_metadata_registration by an owner''s deploy role'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [registerApplication]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-MTD-001-06, BR-CAP-PFM-MTD-001-09]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations']
  - key: 'none: IAM invoke grant platform-queries-registration-invoke'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [registerQueryApplication]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: IAM invoke grant platform-query-recipes-registration-invoke'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [registerQueryRecipes]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-008-04, BR-CAP-PFM-QRY-008-08]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: IAM invoke grant to the accounting role'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [pageSavedQueryRecordIds]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-007-05]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: IAM invoke grant to the CRM role on the live alias'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [handleQuickSearchChangeEvents]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/quick-search/aws/api/quick-search.routes.ts (imported), aws/logic/*.ts, services/**, registry/record-types.ts, db/*.table.ts; docs/quick-search.md; docs/proposals/quick-search.md (approved 2026-10-09)']
  - key: 'none: IAM invoke grant to the marketing role'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [marketingRecordIds]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-007-05]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: invoked by CloudFormation during CRM''s own deployment'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [reconcileBaseline]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-TNL-009-02]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-crm:modules/tenant-lifecycle/services/lifecycle/baseline-reconciliation.ts:baselineReconciliationResponse']
  - key: 'none: invoked by its schedule'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [runLlmReconciliation]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-LLM-009-02, BR-CAP-PFM-LLM-008-05, BR-CAP-PFM-LLM-010-01, BR-CAP-PFM-LLM-010-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations']
  - key: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [describe, export, initialize, inventory, provision, purge, reset, verifyProvisioned]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-TNL-017-03, BR-CAP-PFM-TNL-017-06, BR-CAP-PFM-TNL-017-13, BR-CAP-PFM-TNL-010-02, BR-CAP-PFM-TNL-012-03, BR-CAP-PFM-TNL-009-02]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-commerce:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS', 'services-committees:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS', 'services-crm:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS', 'services-marketing:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS', 'services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS', 'services-submissions:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS', 'services-websites:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS']
  - key: 'none: invoked by the lifecycle jobs'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [dataExportsLifecycleParticipants, quickSearchLifecycleParticipant, snapshotsLifecycleParticipant]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10, BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06, BR-CAP-PFM-QRY-019-01, BR-CAP-PFM-QRY-019-04, BR-CAP-PFM-QRY-019-05, BR-CAP-PFM-QRY-019-06, BR-CAP-PFM-QRY-019-08, BR-CAP-PFM-QRY-019-10, BR-CAP-PFM-QRY-019-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/data-exports/aws/api/*.routes.ts (imported), aws/logic/data-exports-api.lambda.ts, services/**, db/*.table.ts, data-exports.settings.ts; docs/data-exports.md; docs/proposals/tenant-data-export/ (decisions of 2026-10-18)', 'services-platform at ad3f6a6: modules/quick-search/aws/api/quick-search.routes.ts (imported), aws/logic/*.ts, services/**, registry/record-types.ts, db/*.table.ts; docs/quick-search.md; docs/proposals/quick-search.md (approved 2026-10-09)', 'services-platform at ad3f6a6: modules/snapshots/aws/api/snapshots.routes.ts (imported), aws/logic/*.ts, aws/snapshots.configuration.ts, services/**, db/*.table.ts; @rhythmsoftware/macroservice-snapshots; docs/snapshots/README.md; docs/proposals/snapshot-architecture.md (approved 2026-10-15)']
  - key: 'none: invoked by the workspace lifecycle job'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: ['llmParticipant (provision, verifyProvisioned, purge, inventory)']
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-LLM-004-05]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations']
  - key: 'none: invoked only by the queries API after the generation row commits'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [runQueryGeneration]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-003-10]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: invoked over IAM by a deploy role holding the registration invoke policy; the declared service name is not compared with the caller'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [registerServiceExtensions]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-INT-016-01, BR-CAP-PFM-INT-016-02, BR-CAP-PFM-INT-016-03, BR-CAP-PFM-INT-016-04, BR-CAP-PFM-INT-016-05]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations']
  - key: 'none: public health route'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [getCapacityHealth, getDataJobsHealth, getExtensionsHealth, getIntegrationsHealth, getWorkflowActionsHealth]
    surfaces: [public]
    guarded_by: []
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-capacity.md#operations', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations']
  - key: 'none: public health route (the operation name follows the get<Module>Health pattern of the shared health route)'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [getAttentionHealth, getEligibilityHealth, getResponsibilitiesHealth]
    surfaces: [public]
    guarded_by: [BR-CAP-PFM-ELG-016-04, BR-CAP-PFM-ELG-016-07, BR-CAP-PFM-ELG-016-08, BR-CAP-PFM-ELG-016-10, BR-CAP-PFM-ELG-016-12, BR-CAP-PFM-ELG-012-05, BR-CAP-PFM-ELG-013-02, BR-CAP-PFM-ELG-013-04, BR-CAP-PFM-ELG-013-05, BR-CAP-PFM-ELG-013-08]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform:modules/attention/aws/api/attention.routes.ts:healthRoute', 'services-platform:modules/eligibility/aws/api/eligibility.routes.ts:healthRoute', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:healthRoute']
  - key: 'none: public route'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [downloadQueryExportByLink, getCommunicationsHealth, getDataExportsHealth, getExplorerHealth, getNotificationsHealth, getQueriesHealth, getQuickSearchHealth, getSnapshotsHealth]
    surfaces: [public]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10, BR-CAP-PFM-QRY-014-07, BR-CAP-PFM-QRY-014-09, BR-CAP-PFM-QRY-016-04]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations', 'services-platform:modules/data-exports/aws/api/data-exports.routes.ts:getDataExportsHealth', 'services-platform:modules/explorer/aws/api/explorer.routes.ts:healthRoute', 'services-platform:modules/queries/aws/api/queries.routes.ts:healthRoute', 'services-platform:modules/queries/aws/api/query-exports.routes.ts:downloadQueryExportByLink', 'services-platform:modules/quick-search/aws/api/quick-search.routes.ts:getQuickSearchHealth', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:healthRoute']
  - key: 'none: public route; the token, code or pool lookup is the whole authorization'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [acceptInvitation, beginGoogleAcceptance, completeGoogleAcceptance, confirmPortalPasswordReset, describePortalPool, getInvitationSummary, resendPortalVerification, signInPortalMember, signUpPortalMember, startPortalPasswordReset, verifyPortalEmail]
    surfaces: [public]
    guarded_by: [BR-CAP-PFM-SEC-019-05, BR-CAP-PFM-SEC-019-07, BR-CAP-PFM-SEC-005-01, BR-CAP-PFM-SEC-005-02, BR-CAP-PFM-SEC-005-03, BR-CAP-PFM-SEC-005-07, BR-CAP-PFM-SEC-005-09]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform:modules/security/aws/api/access.routes.ts:describePortalPool', 'services-platform:modules/security/aws/api/invitations.routes.ts:getInvitationSummary', 'services-platform:modules/security/aws/api/invitations.routes.ts:acceptInvitation', 'services-platform:modules/security/aws/api/invitations.routes.ts:beginGoogleAcceptance', 'services-platform:modules/security/aws/api/invitations.routes.ts:completeGoogleAcceptance', 'services-platform:modules/security/aws/api/portal-identity.routes.ts:signUpPortalMember', 'services-platform:modules/security/aws/api/portal-identity.routes.ts:signInPortalMember', 'services-platform:modules/security/aws/api/portal-identity.routes.ts:startPortalPasswordReset', 'services-platform:modules/security/aws/api/portal-identity.routes.ts:confirmPortalPasswordReset', 'services-platform:modules/security/aws/api/portal-identity.routes.ts:verifyPortalEmail', 'services-platform:modules/security/aws/api/portal-identity.routes.ts:resendPortalVerification']
  - key: 'none: public route; the unguessable endpoint token or the signed single-use state is the proof'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [completeIntegrationOauth, receiveIntegrationWebhook]
    surfaces: [public]
    guarded_by: [BR-CAP-PFM-INT-005-01, BR-CAP-PFM-INT-005-05, BR-CAP-PFM-INT-005-08, BR-CAP-PFM-INT-005-09, BR-CAP-PFM-INT-005-12, BR-CAP-PFM-INT-005-14, BR-CAP-PFM-INT-013-01]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: 'none: queue consumer'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [renderReportExport, runQueryExport, runScheduledDelivery]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-014-07, BR-CAP-PFM-QRY-014-09, BR-CAP-PFM-QRY-013-01, BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: release-time'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [reconcileCoverageAtActivation]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/data-exports/aws/api/*.routes.ts (imported), aws/logic/data-exports-api.lambda.ts, services/**, db/*.table.ts, data-exports.settings.ts; docs/data-exports.md; docs/proposals/tenant-data-export/ (decisions of 2026-10-18)']
  - key: 'none: scheduled'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [dispatchQueryExports, dispatchSchedules, dispatchSnapshotRuns, planSnapshotRuns, reconcileQueryGenerations, revalidateCustomQueryTablesNightly, runQuickSearchMaintenance]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-003-10, BR-CAP-PFM-QRY-014-07, BR-CAP-PFM-QRY-014-09, BR-CAP-PFM-QRY-013-01, BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15, BR-CAP-PFM-QRY-005-03, BR-CAP-PFM-QRY-005-08, BR-CAP-PFM-QRY-005-09, BR-CAP-PFM-QRY-005-10, BR-CAP-PFM-QRY-005-11, BR-CAP-PFM-QRY-005-12, BR-CAP-PFM-QRY-005-14, BR-CAP-PFM-QRY-005-15, BR-CAP-PFM-QRY-005-16, BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06, BR-CAP-PFM-QRY-019-01, BR-CAP-PFM-QRY-019-04, BR-CAP-PFM-QRY-019-05, BR-CAP-PFM-QRY-019-06, BR-CAP-PFM-QRY-019-08, BR-CAP-PFM-QRY-019-10, BR-CAP-PFM-QRY-019-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)', 'services-platform at ad3f6a6: modules/quick-search/aws/api/quick-search.routes.ts (imported), aws/logic/*.ts, services/**, registry/record-types.ts, db/*.table.ts; docs/quick-search.md; docs/proposals/quick-search.md (approved 2026-10-09)', 'services-platform at ad3f6a6: modules/snapshots/aws/api/snapshots.routes.ts (imported), aws/logic/*.ts, aws/snapshots.configuration.ts, services/**, db/*.table.ts; @rhythmsoftware/macroservice-snapshots; docs/snapshots/README.md; docs/proposals/snapshot-architecture.md (approved 2026-10-15)']
  - key: 'none: started only by a rebuild request'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [runQuickSearchRebuild]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/quick-search/aws/api/quick-search.routes.ts (imported), aws/logic/*.ts, services/**, registry/record-types.ts, db/*.table.ts; docs/quick-search.md; docs/proposals/quick-search.md (approved 2026-10-09)']
  - key: 'none: submitted only by the dispatcher'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [runSnapshot]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-019-01, BR-CAP-PFM-QRY-019-04, BR-CAP-PFM-QRY-019-05, BR-CAP-PFM-QRY-019-06, BR-CAP-PFM-QRY-019-08, BR-CAP-PFM-QRY-019-10, BR-CAP-PFM-QRY-019-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/snapshots/aws/api/snapshots.routes.ts (imported), aws/logic/*.ts, aws/snapshots.configuration.ts, services/**, db/*.table.ts; @rhythmsoftware/macroservice-snapshots; docs/snapshots/README.md; docs/proposals/snapshot-architecture.md (approved 2026-10-15)']
  - key: 'none: system execution only'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [evaluateSubjectPredicates]
    surfaces: [service]
    guarded_by: []
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: the deploy-time migration function'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [materializeLlmCatalog]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-LLM-005-02, BR-CAP-PFM-LLM-005-03, BR-CAP-PFM-LLM-005-04, BR-CAP-PFM-LLM-005-10]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations']
  - key: 'none: the execution context''s own grants decide'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [queryLayerInProcess]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-QRY-002-02, BR-CAP-PFM-QRY-010-05, BR-CAP-PFM-QRY-010-07]
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform at ad3f6a6: modules/queries/aws/api/*.routes.ts (route declarations, extracted by importing the route arrays), aws/logic/*.lambda.ts, aws/resources/*.ts, services/**, db/*.table.ts; aws/platform.service.ts (permission groups)']
  - key: 'none: the shared health route'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [health]
    surfaces: [public]
    guarded_by: []
    kind: non-permission-boundary
    provenance: documented
    source: ['services-platform:modules/customers/aws/api/customers.routes.ts:healthRoute', 'services-platform:modules/security/aws/api/users.routes.ts:healthRoute', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:healthRoute']
  - key: 'none: the shared health route (generated by the health-route factory as get<Module>Health)'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [getAssociationsHealth, getLayoutsHealth, getMetadataHealth]
    surfaces: [public]
    guarded_by: []
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations']
  - key: 'none: the shared health route, named explicitly'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [getCustomObjectsHealth, getFilesHealth]
    surfaces: [public]
    guarded_by: [BR-CAP-PFM-MTD-009-03, BR-CAP-PFM-MTD-009-05, BR-CAP-PFM-MTD-009-07, BR-CAP-PFM-MTD-009-11, BR-CAP-PFM-MTD-007-06, BR-CAP-PFM-MTD-007-07]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-files.md#operations']
  - key: objects.definitions.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    derived_from: [platform.custom-objects.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-008-find-the-organizations-own-record-types-in-the-menu.md#permissions']
  - key: objects.records.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    derived_from: [platform.custom-records.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-008-find-the-organizations-own-record-types-in-the-menu.md#permissions']
  - key: platform.application.access
    intent: Authorize access application within the caller’s applicable scope.
    operations: []
    surfaces: [api, console, portal]
    guarded_by: [BR-CAP-PFM-CSH-014-10, BR-CAP-PFM-SEC-007-04, BR-CAP-PFM-SEC-007-08, BR-CAP-PFM-SEC-007-13, BR-CAP-PFM-SEC-015-01, BR-CAP-PFM-SEC-015-02, BR-CAP-PFM-SEC-015-03, BR-CAP-PFM-SEC-015-07, BR-CAP-PFM-SEC-015-12]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-007-move-into-a-settings-area-and-back-to-my-work.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-014-offer-exactly-the-applications-the-workspace-and-the-person.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-007-know-what-i-may-do-in-a-workspace.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md#permissions']
  - key: platform.association-types.create
    intent: Add relationship definitions within the caller’s applicable scope.
    operations: [createAssociationType]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-017-04, BR-CAP-PFM-MTD-017-06, BR-CAP-PFM-MTD-009-03, BR-CAP-PFM-MTD-009-05, BR-CAP-PFM-MTD-009-07, BR-CAP-PFM-MTD-009-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-017-define-how-two-kinds-of-record-relate.md#permissions']
  - key: platform.association-types.delete
    intent: Remove relationship definitions within the caller’s applicable scope.
    operations: [deleteAssociationType]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-017-04, BR-CAP-PFM-MTD-017-06]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-017-define-how-two-kinds-of-record-relate.md#permissions']
  - key: platform.association-types.read
    intent: Inspect relationship definitions within the caller’s applicable scope.
    operations: [getAssociationType, listAssociationTypes]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-017-04, BR-CAP-PFM-MTD-017-06]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-017-define-how-two-kinds-of-record-relate.md#permissions']
  - key: platform.association-types.update
    intent: Revise relationship definitions within the caller’s applicable scope.
    operations: [updateAssociationType]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-017-04, BR-CAP-PFM-MTD-017-06]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-017-define-how-two-kinds-of-record-relate.md#permissions']
  - key: platform.associations.create
    intent: Add record relationships within the caller’s applicable scope.
    operations: [applyAssociationDataJob, cancelAssociationDataJob, createAssociation, getAssociationDataJob, listAssociationDataJobRejections, listAssociationDataJobResults, listAssociationDataJobs, pauseAssociationDataJob, resumeAssociationDataJob, retryAssociationDataJob, submitAssociationDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-MTD-018-06, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05, BR-CAP-PFM-MTD-016-02, BR-CAP-PFM-MTD-016-05]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-018-offer-a-product-area-s-records-to-the-engine.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-016-load-custom-records-and-their-links-from-a-file-again-and-again.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-018-link-records-to-one-another-dated-primary-and-in-force-until.md#permissions']
  - key: 'platform.associations.create, with platform.associations.update and the keys of the workspace''s other queued batches evaluated'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyAssociationDataJob, cancelAssociationDataJob, getAssociationDataJob, listAssociationDataJobRejections, listAssociationDataJobResults, listAssociationDataJobs, pauseAssociationDataJob, resumeAssociationDataJob, retryAssociationDataJob, submitAssociationDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-016-02, BR-CAP-PFM-MTD-016-05]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations']
  - key: platform.associations.delete
    intent: Remove record relationships within the caller’s applicable scope.
    operations: [deleteAssociation]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-018-06, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-018-link-records-to-one-another-dated-primary-and-in-force-until.md#permissions']
  - key: platform.associations.read
    intent: Inspect record relationships within the caller’s applicable scope.
    operations: [listRecordAssociations]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-018-06]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-018-link-records-to-one-another-dated-primary-and-in-force-until.md#permissions']
  - key: platform.associations.update
    intent: Revise record relationships within the caller’s applicable scope.
    operations: [applyAssociationDataJob, cancelAssociationDataJob, endAssociation, getAssociationDataJob, listAssociationDataJobRejections, listAssociationDataJobResults, listAssociationDataJobs, pauseAssociationDataJob, resumeAssociationDataJob, retryAssociationDataJob, submitAssociationDataJob, updateAssociation]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-MTD-018-06, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05, BR-CAP-PFM-MTD-016-02, BR-CAP-PFM-MTD-016-05]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-018-offer-a-product-area-s-records-to-the-engine.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-016-load-custom-records-and-their-links-from-a-file-again-and-again.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-018-link-records-to-one-another-dated-primary-and-in-force-until.md#permissions']
  - key: platform.attention.manage
    intent: Administer attention within the caller’s applicable scope.
    operations: [getAttentionDefinitionSettings, putAttentionDefinitionSettings]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-020-06, BR-CAP-PFM-ELG-020-07, BR-CAP-PFM-ELG-020-08, BR-CAP-PFM-ELG-019-06]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/attention/aws/api/attention.routes.ts:getAttentionDefinitionSettings', 'services-platform:modules/attention/aws/api/attention.routes.ts:putAttentionDefinitionSettings', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-020-tune-attention-for-the-organization-and-for-oneself.md#permissions']
  - key: platform.attention.read
    intent: Inspect attention within the caller’s applicable scope.
    operations: [listAttentionDefinitions]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-020-06, BR-CAP-PFM-ELG-020-07, BR-CAP-PFM-ELG-020-08]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/attention/aws/api/attention.routes.ts:listAttentionDefinitions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-020-tune-attention-for-the-organization-and-for-oneself.md#permissions']
  - key: platform.attention.read-others
    intent: Inspect another subject’s attention under the additional reached-record checks.
    operations: [listUserAttentionItems]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-017-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/attention/aws/api/attention.routes.ts:listUserAttentionItems', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-017-show-each-person-what-needs-them-and-why.md#permissions']
  - key: platform.attention.resolve-manually
    intent: Close an eligible attention occurrence with an attributed reason.
    operations: [resolveAttentionItem]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-ELG-016-04, BR-CAP-PFM-ELG-016-07, BR-CAP-PFM-ELG-016-08, BR-CAP-PFM-ELG-016-10, BR-CAP-PFM-ELG-016-12]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/attention/aws/api/attention.routes.ts:resolveAttentionItem', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-016-publish-the-conditions-that-need-someone-and-clear-them-when.md#permissions']
  - key: platform.attention.use
    intent: Inspect and respond to attention addressed to the caller.
    operations: [acknowledgeMyAttentionItem, dismissMyAttentionItem, getMyAttentionItem, getMyAttentionPreferences, getMyAttentionSummary, listAttentionItemsAboutRecord, listMyAttentionItems, putMyAttentionPreferences, snoozeMyAttentionItem, unsnoozeMyAttentionItem]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-ELG-017-11, BR-CAP-PFM-ELG-018-07, BR-CAP-PFM-ELG-020-06, BR-CAP-PFM-ELG-020-07, BR-CAP-PFM-ELG-020-08, BR-CAP-PFM-ELG-019-06]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/attention/aws/api/attention.routes.ts:getMyAttentionSummary', 'services-platform:modules/attention/aws/api/attention.routes.ts:listMyAttentionItems', 'services-platform:modules/attention/aws/api/attention.routes.ts:getMyAttentionItem', 'services-platform:modules/attention/aws/api/attention.routes.ts:acknowledgeMyAttentionItem', 'services-platform:modules/attention/aws/api/attention.routes.ts:snoozeMyAttentionItem', 'services-platform:modules/attention/aws/api/attention.routes.ts:unsnoozeMyAttentionItem', 'services-platform:modules/attention/aws/api/attention.routes.ts:dismissMyAttentionItem', 'services-platform:modules/attention/aws/api/attention.routes.ts:getMyAttentionPreferences', 'services-platform:modules/attention/aws/api/attention.routes.ts:putMyAttentionPreferences', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-017-show-each-person-what-needs-them-and-why.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-018-acknowledge-snooze-or-dismiss-an-item-within-its-class.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-019-escalate-and-remind-about-work-nobody-acts-on.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-020-tune-attention-for-the-organization-and-for-oneself.md#permissions', 'services-platform:modules/attention/aws/api/attention.routes.ts:listAttentionItemsAboutRecord']
  - key: platform.attention.use (evaluates the about objects' read keys)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [listAttentionItemsAboutRecord]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-ELG-017-11]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/attention/aws/api/attention.routes.ts:listAttentionItemsAboutRecord']
  - key: platform.audit-events.read
    intent: Inspect record activity history within the caller’s applicable scope.
    operations: [listUserRecordViews]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-OPS-009-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-audit.md#operations', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-009-look-back-over-the-records-a-person-opened.md#permissions']
  - key: platform.communication-messages.read
    intent: Inspect association message outcomes within the caller’s applicable scope.
    operations: [getCommunicationMessage, getCommunicationRequest, listCommunicationMessages, listCommunicationRequests]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-NOT-019-04, BR-CAP-PFM-NOT-019-06, BR-CAP-PFM-NOT-019-08, BR-CAP-PFM-NOT-019-09, BR-CAP-PFM-NOT-019-10, BR-CAP-PFM-NOT-019-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-019-record-what-became-of-each-e-mail.md#permissions']
  - key: platform.communication-messages.read-content
    intent: Inspect retained content for association message outcomes within the caller’s applicable scope.
    operations: [getCommunicationMessageContent]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-NOT-019-04, BR-CAP-PFM-NOT-019-06, BR-CAP-PFM-NOT-019-08, BR-CAP-PFM-NOT-019-09, BR-CAP-PFM-NOT-019-10, BR-CAP-PFM-NOT-019-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-019-record-what-became-of-each-e-mail.md#permissions']
  - key: platform.communication-messages.update
    intent: Revise association message outcomes within the caller’s applicable scope.
    operations: [cancelCommunicationMessage]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-NOT-018-01, BR-CAP-PFM-NOT-018-03, BR-CAP-PFM-NOT-018-05]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-018-deliver-association-e-mail-reliably-and-within-sending.md#permissions']
  - key: platform.communication-suppressions.create
    intent: Add recipient protection entries within the caller’s applicable scope.
    operations: [createCommunicationSuppression]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-NOT-020-02, BR-CAP-PFM-NOT-020-04, BR-CAP-PFM-NOT-020-09, BR-CAP-PFM-NOT-020-10, BR-CAP-PFM-NOT-020-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-020-protect-deliverability-and-the-associations-sending-address.md#permissions']
  - key: platform.communication-suppressions.read
    intent: Inspect recipient protection entries within the caller’s applicable scope.
    operations: [listCommunicationSuppressions]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-NOT-020-02, BR-CAP-PFM-NOT-020-04, BR-CAP-PFM-NOT-020-09, BR-CAP-PFM-NOT-020-10, BR-CAP-PFM-NOT-020-14]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-020-protect-deliverability-and-the-associations-sending-address.md#permissions']
  - key: platform.communication-suppressions.update
    intent: Revise recipient protection entries within the caller’s applicable scope.
    operations: [releaseCommunicationSuppression]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-NOT-020-02, BR-CAP-PFM-NOT-020-04, BR-CAP-PFM-NOT-020-09, BR-CAP-PFM-NOT-020-10, BR-CAP-PFM-NOT-020-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-020-protect-deliverability-and-the-associations-sending-address.md#permissions']
  - key: platform.communication-templates.create
    intent: Add association message templates within the caller’s applicable scope.
    operations: [createCommunicationTemplate]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-016-compose-the-e-mails-an-association-sends.md#permissions']
  - key: platform.communication-templates.delete
    intent: Remove association message templates within the caller’s applicable scope.
    operations: [archiveCommunicationTemplate]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-016-compose-the-e-mails-an-association-sends.md#permissions']
  - key: platform.communication-templates.publish
    intent: Release association message templates within the caller’s applicable scope.
    operations: [publishCommunicationTemplate]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-016-compose-the-e-mails-an-association-sends.md#permissions']
  - key: platform.communication-templates.read
    intent: Inspect association message templates within the caller’s applicable scope.
    operations: [getCommunicationReadiness, getCommunicationTemplate, getCommunicationTemplateVersion, listCommunicationPurposes, listCommunicationTemplateVersions, listCommunicationTemplates, previewCommunicationTemplate]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-016-compose-the-e-mails-an-association-sends.md#permissions']
  - key: platform.communication-templates.test-send
    intent: Send a controlled test of association message templates within the caller’s applicable scope.
    operations: [testSendCommunicationTemplate]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-016-compose-the-e-mails-an-association-sends.md#permissions']
  - key: platform.communication-templates.update
    intent: Revise association message templates within the caller’s applicable scope.
    operations: [updateCommunicationTemplate, validateCommunicationTemplate]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-016-compose-the-e-mails-an-association-sends.md#permissions']
  - key: platform.communications.request
    intent: Submit association message requests under the admitted service or staff identity.
    operations: [requestCommunication]
    surfaces: [api, hq, job]
    guarded_by: [BR-CAP-PFM-NOT-017-05, BR-CAP-PFM-NOT-017-11, BR-CAP-PFM-NOT-017-16]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-017-ask-platform-to-send-an-association-e-mail.md#permissions']
  - key: platform.custom-fields.bulk
    intent: Apply counted bulk changes to additional-field definitions within the caller’s applicable scope.
    operations: [applyCustomFieldDataJob, cancelCustomFieldDataJob, getCustomFieldDataJob, listCustomFieldDataJobRejections, listCustomFieldDataJobResults, listCustomFieldDataJobs, pauseCustomFieldDataJob, readCustomFieldsBySourceKey, resumeCustomFieldDataJob, retryCustomFieldDataJob, submitCustomFieldDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-016-02, BR-CAP-PFM-DJE-016-05, BR-CAP-PFM-DJE-016-07, BR-CAP-PFM-DJE-016-09, BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-001-submit-one-audited-job-that-changes-many-records.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-002-preview-what-a-job-will-do-and-approve-exactly-that.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-005-follow-a-job-and-trace-every-change-it-made.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-015-read-back-what-a-load-wrote-by-the-producer-s-keys.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-016-load-a-migration-package-into-a-new-workspace-in-dependency.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-018-offer-a-product-area-s-records-to-the-engine.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: platform.custom-fields.bulk and one of platform.custom-fields.create or platform.custom-fields.update
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyCustomFieldDataJob, cancelCustomFieldDataJob, getCustomFieldDataJob, listCustomFieldDataJobRejections, listCustomFieldDataJobResults, listCustomFieldDataJobs, pauseCustomFieldDataJob, readCustomFieldsBySourceKey, resumeCustomFieldDataJob, retryCustomFieldDataJob, submitCustomFieldDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: platform.custom-fields.create
    intent: Add additional-field definitions within the caller’s applicable scope.
    operations: [applyCustomFieldDataJob, cancelCustomFieldDataJob, createCustomField, getCustomFieldDataJob, listCustomFieldDataJobRejections, listCustomFieldDataJobResults, listCustomFieldDataJobs, pauseCustomFieldDataJob, readCustomFieldsBySourceKey, resumeCustomFieldDataJob, retryCustomFieldDataJob, submitCustomFieldDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-MTD-005-04, BR-CAP-PFM-MTD-005-06, BR-CAP-PFM-MTD-005-11, BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-018-offer-a-product-area-s-records-to-the-engine.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-003-offer-custom-fields-forms-and-layouts-only-on-the-record-types.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-005-add-the-workspace-s-own-fields-to-a-record-type-and-evolve.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: platform.custom-fields.delete
    intent: Remove additional-field definitions within the caller’s applicable scope.
    operations: [archiveCustomField, restoreCustomField]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-005-04, BR-CAP-PFM-MTD-005-06, BR-CAP-PFM-MTD-005-11, BR-CAP-PFM-MTD-006-05]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-005-add-the-workspace-s-own-fields-to-a-record-type-and-evolve.md#permissions']
  - key: platform.custom-fields.read
    intent: Inspect additional-field definitions within the caller’s applicable scope.
    operations: [getCustomField, getCustomFieldRules, listCustomFields]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-005-04, BR-CAP-PFM-MTD-005-06, BR-CAP-PFM-MTD-005-11, BR-CAP-PFM-MTD-006-05]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-005-add-the-workspace-s-own-fields-to-a-record-type-and-evolve.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-006-make-a-field-required-shown-unique-defaulted-or-exposed-by.md#permissions']
  - key: platform.custom-fields.update
    intent: Revise additional-field definitions within the caller’s applicable scope.
    operations: [applyCustomFieldDataJob, cancelCustomFieldDataJob, getCustomFieldDataJob, listCustomFieldDataJobRejections, listCustomFieldDataJobResults, listCustomFieldDataJobs, pauseCustomFieldDataJob, readCustomFieldsBySourceKey, resumeCustomFieldDataJob, retryCustomFieldDataJob, setCustomFieldRules, submitCustomFieldDataJob, updateCustomField]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-MTD-005-04, BR-CAP-PFM-MTD-005-06, BR-CAP-PFM-MTD-005-11, BR-CAP-PFM-MTD-006-05, BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-018-offer-a-product-area-s-records-to-the-engine.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-005-add-the-workspace-s-own-fields-to-a-record-type-and-evolve.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-006-make-a-field-required-shown-unique-defaulted-or-exposed-by.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: platform.custom-objects.create
    intent: Add custom register definitions within the caller’s applicable scope.
    operations: [createCustomApp, createCustomObject]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-009-03, BR-CAP-PFM-MTD-009-05, BR-CAP-PFM-MTD-009-07, BR-CAP-PFM-MTD-009-11, BR-CAP-PFM-MTD-010-02, BR-CAP-PFM-MTD-010-03, BR-CAP-PFM-MTD-010-08, BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-009-design-a-record-type-of-the-organization-s-own-and-bring-it.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-010-put-custom-objects-where-staff-look-for-them.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: platform.custom-objects.delete
    intent: Remove custom register definitions within the caller’s applicable scope.
    operations: [archiveCustomApp, archiveCustomObject, restoreCustomApp, restoreCustomObject]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-009-03, BR-CAP-PFM-MTD-009-05, BR-CAP-PFM-MTD-009-07, BR-CAP-PFM-MTD-009-11, BR-CAP-PFM-MTD-010-02, BR-CAP-PFM-MTD-010-03, BR-CAP-PFM-MTD-010-08, BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-009-design-a-record-type-of-the-organization-s-own-and-bring-it.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-010-put-custom-objects-where-staff-look-for-them.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: platform.custom-objects.read
    intent: Inspect custom register definitions within the caller’s applicable scope.
    operations: [getCustomApp, getCustomObject, listCustomApps, listCustomObjects]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-009-03, BR-CAP-PFM-MTD-009-05, BR-CAP-PFM-MTD-009-07, BR-CAP-PFM-MTD-009-11, BR-CAP-PFM-MTD-010-02, BR-CAP-PFM-MTD-010-03, BR-CAP-PFM-MTD-010-08, BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/design/contracts/SVC-PFM-CSH-console-shell.md#operations', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-008-find-the-organizations-own-record-types-in-the-menu.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-009-design-a-record-type-of-the-organization-s-own-and-bring-it.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-010-put-custom-objects-where-staff-look-for-them.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: 'platform.custom-objects.read, .create, .update, .delete (administration of custom object purposes)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: platform.custom-objects.update
    intent: Revise custom register definitions within the caller’s applicable scope.
    operations: [activateCustomObject, updateCustomApp, updateCustomObject]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-009-03, BR-CAP-PFM-MTD-009-05, BR-CAP-PFM-MTD-009-07, BR-CAP-PFM-MTD-009-11, BR-CAP-PFM-MTD-010-02, BR-CAP-PFM-MTD-010-03, BR-CAP-PFM-MTD-010-08, BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-009-design-a-record-type-of-the-organization-s-own-and-bring-it.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-010-put-custom-objects-where-staff-look-for-them.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: platform.custom-records.create
    intent: Add custom register entries within the caller’s applicable scope.
    operations: [applyCustomObjectRecordDataJob, cancelCustomObjectRecordDataJob, createCustomObjectRecord, getCustomObjectRecordDataJob, listCustomObjectRecordDataJobRejections, listCustomObjectRecordDataJobResults, listCustomObjectRecordDataJobs, pauseCustomObjectRecordDataJob, resumeCustomObjectRecordDataJob, retryCustomObjectRecordDataJob, submitCustomObjectRecordDataJob]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-MTD-012-02, BR-CAP-PFM-MTD-012-08, BR-CAP-PFM-MTD-012-11, BR-CAP-PFM-MTD-016-02, BR-CAP-PFM-MTD-016-05, BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-MTD-007-06, BR-CAP-PFM-MTD-007-07, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-018-offer-a-product-area-s-records-to-the-engine.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-012-keep-the-records-of-a-custom-object-validated-by-its-properties.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-016-load-custom-records-and-their-links-from-a-file-again-and-again.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.create (scoped to the object)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [createCustomObjectRecord]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-012-02, BR-CAP-PFM-MTD-012-08, BR-CAP-PFM-MTD-012-11, BR-CAP-PFM-MTD-007-06, BR-CAP-PFM-MTD-007-07, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: 'platform.custom-records.create, scoped by custom object, with platform.custom-records.update evaluated'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [applyCustomObjectRecordDataJob, cancelCustomObjectRecordDataJob, getCustomObjectRecordDataJob, listCustomObjectRecordDataJobRejections, listCustomObjectRecordDataJobResults, listCustomObjectRecordDataJobs, pauseCustomObjectRecordDataJob, resumeCustomObjectRecordDataJob, retryCustomObjectRecordDataJob, submitCustomObjectRecordDataJob]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations']
  - key: platform.custom-records.delete
    intent: Remove custom register entries within the caller’s applicable scope.
    operations: [archiveCustomObjectRecord, deleteCustomObjectRecord, restoreCustomObjectRecord]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-MTD-013-01, BR-CAP-PFM-MTD-013-03, BR-CAP-PFM-MTD-013-07, BR-CAP-PFM-MTD-013-08, BR-CAP-PFM-MTD-013-09, BR-CAP-PFM-MTD-019-06, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-013-publish-archive-restore-and-delete-custom-records-deliberately.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.delete (scoped to the object)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [archiveCustomObjectRecord, deleteCustomObjectRecord, restoreCustomObjectRecord]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-013-01, BR-CAP-PFM-MTD-013-03, BR-CAP-PFM-MTD-013-07, BR-CAP-PFM-MTD-013-08, BR-CAP-PFM-MTD-013-09, BR-CAP-PFM-MTD-019-06, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.export
    intent: Export custom register entries within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions']
  - key: platform.custom-records.history
    intent: Inspect retained changes to custom register entries within the caller’s applicable scope.
    operations: [getCustomObjectRecordRevision, listCustomObjectRecordHistory, listCustomObjectRecordHistoryActors]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-014-see-every-change-to-a-custom-record-and-who-made-it.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: 'platform.custom-records.history, with platform.custom-records.read reach while the record exists'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [getCustomObjectRecordRevision, listCustomObjectRecordHistory, listCustomObjectRecordHistoryActors]
    surfaces: [console]
    guarded_by: []
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.publish
    intent: Release custom register entries within the caller’s applicable scope.
    operations: [publishCustomObjectRecord]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-MTD-013-01, BR-CAP-PFM-MTD-013-03, BR-CAP-PFM-MTD-013-07, BR-CAP-PFM-MTD-013-08, BR-CAP-PFM-MTD-013-09, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-013-publish-archive-restore-and-delete-custom-records-deliberately.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.publish (scoped to the object)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [publishCustomObjectRecord]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-013-01, BR-CAP-PFM-MTD-013-03, BR-CAP-PFM-MTD-013-07, BR-CAP-PFM-MTD-013-08, BR-CAP-PFM-MTD-013-09, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.query
    intent: Query custom register entries within the caller’s applicable scope.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-001-know-which-data-can-be-queried-and-what-each-dataset-holds.md#permissions']
  - key: 'platform.custom-records.query (scoped to custom_object:<object key>)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-001-know-which-data-can-be-queried-and-what-each-dataset-holds.md#permissions']
  - key: platform.custom-records.read
    intent: Inspect custom register entries within the caller’s applicable scope.
    operations: [createConsoleForm, createConsolePageLayout, createPortalForm, createPortalPageLayout, deleteConsoleForm, deleteConsolePageLayout, deletePortalForm, deletePortalPageLayout, getConsoleForm, getConsolePageLayout, getCustomObjectRecord, getCustomObjectRecordRevision, getCustomObjectsNavigation, getPortalForm, getPortalPageLayout, listConsoleForms, listConsolePageLayouts, listCustomObjectRecordHistory, listCustomObjectRecordHistoryActors, listCustomObjectRecords, listPortalForms, listPortalPageLayouts, patchConsoleForm, patchConsolePageLayout, patchPortalForm, patchPortalPageLayout, updateConsoleForm, updateConsolePageLayout, updatePortalForm, updatePortalPageLayout]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-010-02, BR-CAP-PFM-MTD-010-03, BR-CAP-PFM-MTD-010-08, BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-MTD-012-02, BR-CAP-PFM-MTD-012-08, BR-CAP-PFM-MTD-012-11, BR-CAP-PFM-MTD-018-06, BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/design/contracts/SVC-PFM-CSH-console-shell.md#operations', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-008-find-the-organizations-own-record-types-in-the-menu.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-010-put-custom-objects-where-staff-look-for-them.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-012-keep-the-records-of-a-custom-object-validated-by-its-properties.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-014-see-every-change-to-a-custom-record-and-who-made-it.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions']
  - key: 'platform.custom-records.read (scoped by custom object, learnt from the rows)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [getCustomObjectsNavigation]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-010-02, BR-CAP-PFM-MTD-010-03, BR-CAP-PFM-MTD-010-08, BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.read (scoped to the object)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [getCustomObjectRecord, listCustomObjectRecords]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-012-02, BR-CAP-PFM-MTD-012-08, BR-CAP-PFM-MTD-012-11, BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-MTD-018-06]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.update
    intent: Revise custom register entries within the caller’s applicable scope.
    operations: [applyCustomObjectRecordDataJob, cancelCustomObjectRecordDataJob, getCustomObjectRecordDataJob, listCustomObjectRecordDataJobRejections, listCustomObjectRecordDataJobResults, listCustomObjectRecordDataJobs, pauseCustomObjectRecordDataJob, replaceCustomObjectRecord, resumeCustomObjectRecordDataJob, retryCustomObjectRecordDataJob, submitCustomObjectRecordDataJob, updateCustomObjectRecord]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-DJE-005-02, BR-CAP-PFM-DJE-018-01, BR-CAP-PFM-DJE-018-03, BR-CAP-PFM-DJE-018-07, BR-CAP-PFM-MTD-011-01, BR-CAP-PFM-MTD-011-02, BR-CAP-PFM-MTD-011-04, BR-CAP-PFM-MTD-011-07, BR-CAP-PFM-MTD-012-02, BR-CAP-PFM-MTD-012-08, BR-CAP-PFM-MTD-012-11, BR-CAP-PFM-MTD-016-02, BR-CAP-PFM-MTD-016-05, BR-CAP-PFM-DJE-001-08, BR-CAP-PFM-DJE-001-09, BR-CAP-PFM-DJE-002-02, BR-CAP-PFM-DJE-002-03, BR-CAP-PFM-DJE-004-01, BR-CAP-PFM-DJE-004-08, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-005-follow-a-job-and-trace-every-change-it-made.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-018-offer-a-product-area-s-records-to-the-engine.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-011-decide-which-staff-reach-a-custom-object-s-records-and-which.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-012-keep-the-records-of-a-custom-object-validated-by-its-properties.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-016-load-custom-records-and-their-links-from-a-file-again-and-again.md#permissions', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.custom-records.update (scoped to the object)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [replaceCustomObjectRecord, updateCustomObjectRecord]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-012-02, BR-CAP-PFM-MTD-012-08, BR-CAP-PFM-MTD-012-11, BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md#operations']
  - key: platform.customers.read
    intent: Inspect customer administration records within the caller’s applicable scope.
    operations: [getCustomer, listCustomers]
    surfaces: [api, console, portal]
    guarded_by: [BR-CAP-PFM-SEC-001-06, BR-CAP-PFM-SEC-001-13]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/customers/aws/api/customers.routes.ts:listCustomers', 'services-platform:modules/customers/aws/api/customers.routes.ts:getCustomer', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md#permissions']
  - key: platform.customers.update
    intent: Revise customer administration records within the caller’s applicable scope.
    operations: [patchCustomer, updateCustomer]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-001-06, BR-CAP-PFM-SEC-001-13]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/customers/aws/api/customers.routes.ts:updateCustomer', 'services-platform:modules/customers/aws/api/customers.routes.ts:patchCustomer', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md#permissions']
  - key: platform.data-exports.download
    intent: Retrieve authorized files for workspace data packages within the caller’s applicable scope.
    operations: [downloadDataExportVolume]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:downloadDataExportVolume', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-018-take-a-complete-portable-export-of-the-workspace-s-data.md#permissions']
  - key: platform.data-exports.execute
    intent: Request execution of workspace data packages within the caller’s applicable scope.
    operations: [cancelDataExportExecution, requestDataExportExecution, retryDataExportDelivery]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:requestDataExportExecution', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:cancelDataExportExecution', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:retryDataExportDelivery', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-018-take-a-complete-portable-export-of-the-workspace-s-data.md#permissions']
  - key: platform.data-exports.manage
    intent: Administer workspace data packages within the caller’s applicable scope.
    operations: [addDataExportDestination, deleteDataExportArtifact, removeDataExportDestination, saveDataExportDefinition, updateDataExportDestination]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:saveDataExportDefinition', 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:addDataExportDestination', 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:updateDataExportDestination', 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:removeDataExportDestination', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:deleteDataExportArtifact', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-018-take-a-complete-portable-export-of-the-workspace-s-data.md#permissions']
  - key: platform.data-exports.read
    intent: Inspect workspace data packages within the caller’s applicable scope.
    operations: [getDataExportCoverage, getDataExportDefinition, getDataExportExecution, getDataExportManifest, listDataExportExecutions]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-018-04, BR-CAP-PFM-QRY-018-05, BR-CAP-PFM-QRY-018-07, BR-CAP-PFM-QRY-018-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/data-exports/aws/api/coverage.routes.ts:getDataExportCoverage', 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:getDataExportDefinition', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:listDataExportExecutions', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:getDataExportExecution', 'services-platform:modules/data-exports/aws/api/executions.routes.ts:getDataExportManifest', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-018-take-a-complete-portable-export-of-the-workspace-s-data.md#permissions']
  - key: platform.data-jobs.upload
    intent: Open and complete a bounded input transfer for bulk processing.
    operations: [abortDataJobUpload, completeDataJobUpload, getDataJobUpload, listDataJobUploads, openDataJobUpload, presignDataJobUploadParts]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-DJE-011-07, BR-CAP-PFM-DJE-011-10, BR-CAP-PFM-DJE-011-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md#operations', 'rhythm-v2-docs:specs/platform/data-job-engine/planning/capabilities/CAP-PFM-DJE-011-bring-a-file-of-any-size-into-rhythm-intact.md#permissions']
  - key: platform.eligibility-bindings.manage
    intent: Administer eligibility bindings within the caller’s applicable scope.
    operations: [createEligibilityBinding, createEligibilityBindingForService, deleteEligibilityBinding, deleteEligibilityBindingForService, getEligibilityBinding, getEligibilityBindingForService, listEligibilityBindings, listEligibilityBindingsForService, updateEligibilityBinding, updateEligibilityBindingForService]
    surfaces: [api, console, service]
    guarded_by: [BR-CAP-PFM-ELG-007-04, BR-CAP-PFM-ELG-007-07, BR-CAP-PFM-ELG-007-14]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/eligibility/aws/api/bindings.routes.ts:createEligibilityBinding', 'services-platform:modules/eligibility/aws/api/bindings.routes.ts:listEligibilityBindings', 'services-platform:modules/eligibility/aws/api/bindings.routes.ts:getEligibilityBinding', 'services-platform:modules/eligibility/aws/api/bindings.routes.ts:updateEligibilityBinding', 'services-platform:modules/eligibility/aws/api/bindings.routes.ts:deleteEligibilityBinding', 'services-platform:modules/eligibility/aws/api/eligibility-service.routes.ts:createEligibilityBindingForService', 'services-platform:modules/eligibility/aws/api/eligibility-service.routes.ts:listEligibilityBindingsForService', 'services-platform:modules/eligibility/aws/api/eligibility-service.routes.ts:getEligibilityBindingForService', 'services-platform:modules/eligibility/aws/api/eligibility-service.routes.ts:updateEligibilityBindingForService', 'services-platform:modules/eligibility/aws/api/eligibility-service.routes.ts:deleteEligibilityBindingForService', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-007-use-a-rule-wherever-a-price-page-role-or-process-needs-one.md#permissions']
  - key: platform.eligibility.population
    intent: Enumerate qualifying subjects under the source datasets’ query authority.
    operations: [getEligibilityPopulationRun, startEligibilityPopulationRun]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-ELG-011-02, BR-CAP-PFM-ELG-011-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/eligibility/aws/api/population.routes.ts:getEligibilityPopulationRun', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-011-see-who-a-rule-covers-and-what-a-change-would-do.md#permissions', 'services-platform:modules/eligibility/aws/api/population.routes.ts:startEligibilityPopulationRun']
  - key: platform.eligibility.population (evaluates the dataset query keys)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [startEligibilityPopulationRun]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-ELG-011-02, BR-CAP-PFM-ELG-011-08]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/eligibility/aws/api/population.routes.ts:startEligibilityPopulationRun']
  - key: platform.eligibility.publish
    intent: Release or restore qualification versions after the required dataset checks.
    operations: [getEligibilitySimulation, publishEligibilityDefinition, republishEligibilityDefinitionVersion, startEligibilitySimulation, updateEligibilityDefinition]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-ELG-004-03, BR-CAP-PFM-ELG-004-06, BR-CAP-PFM-ELG-004-07, BR-CAP-PFM-ELG-004-09, BR-CAP-PFM-ELG-004-12, BR-CAP-PFM-ELG-010-06, BR-CAP-PFM-ELG-010-07, BR-CAP-PFM-ELG-010-08, BR-CAP-PFM-ELG-011-02, BR-CAP-PFM-ELG-011-08, BR-CAP-PFM-ELG-001-05, BR-CAP-PFM-ELG-001-06, BR-CAP-PFM-ELG-001-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:publishEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:republishEligibilityDefinitionVersion', 'services-platform:modules/eligibility/aws/api/population.routes.ts:getEligibilitySimulation', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-001-write-an-eligibility-rule-staff-can-read-back.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-004-publish-a-rule-as-a-locked-version-schedule-it-and-roll-it.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-011-see-who-a-rule-covers-and-what-a-change-would-do.md#permissions', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:updateEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/population.routes.ts:startEligibilitySimulation']
  - key: platform.eligibility.publish (evaluates the dataset query keys)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [startEligibilitySimulation]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-ELG-011-02, BR-CAP-PFM-ELG-011-08]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/eligibility/aws/api/population.routes.ts:startEligibilitySimulation']
  - key: platform.eligibility.read
    intent: Inspect eligibility within the caller’s applicable scope.
    operations: [diffEligibilityDefinitionVersions, evaluateEligibility, evaluateEligibilityForService, getEligibilityBindingPlan, getEligibilityBindingPlanForService, getEligibilityDecision, getEligibilityDefinition, getEligibilityDefinitionUsage, getEligibilityDefinitionVersion, getEligibilityTenantHealth, listEligibilityConditionTypes, listEligibilityConsumerKinds, listEligibilityDecisions, listEligibilityDefinitionVersions, listEligibilityDefinitions, testEligibilityDefinition, validateEligibilityDefinition]
    surfaces: [api, console, job, portal, service]
    guarded_by: [BR-CAP-PFM-ELG-012-05, BR-CAP-PFM-ELG-006-03, BR-CAP-PFM-ELG-002-01, BR-CAP-PFM-ELG-002-03, BR-CAP-PFM-ELG-002-10, BR-CAP-PFM-ELG-001-05, BR-CAP-PFM-ELG-001-06, BR-CAP-PFM-ELG-001-11, BR-CAP-PFM-ELG-004-03, BR-CAP-PFM-ELG-004-06, BR-CAP-PFM-ELG-004-07, BR-CAP-PFM-ELG-004-09, BR-CAP-PFM-ELG-004-12, BR-CAP-PFM-ELG-007-04, BR-CAP-PFM-ELG-007-07, BR-CAP-PFM-ELG-007-14, BR-CAP-PFM-ELG-008-02, BR-CAP-PFM-ELG-008-03, BR-CAP-PFM-ELG-008-04, BR-CAP-PFM-ELG-008-12, BR-CAP-PFM-ELG-009-02, BR-CAP-PFM-ELG-003-01, BR-CAP-PFM-ELG-003-03, BR-CAP-PFM-ELG-003-04, BR-CAP-PFM-ELG-010-06, BR-CAP-PFM-ELG-010-07, BR-CAP-PFM-ELG-010-08]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/eligibility/aws/api/eligibility.routes.ts:getEligibilityTenantHealth', 'services-platform:modules/eligibility/aws/api/eligibility.routes.ts:listEligibilityConditionTypes', 'services-platform:modules/eligibility/aws/api/eligibility.routes.ts:listEligibilityConsumerKinds', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:listEligibilityDefinitions', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:getEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:validateEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:listEligibilityDefinitionVersions', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:getEligibilityDefinitionVersion', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:diffEligibilityDefinitionVersions', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:getEligibilityDefinitionUsage', 'services-platform:modules/eligibility/aws/api/bindings.routes.ts:getEligibilityBindingPlan', 'services-platform:modules/eligibility/aws/api/eligibility-service.routes.ts:getEligibilityBindingPlanForService', 'services-platform:modules/eligibility/aws/api/eligibility-service.routes.ts:evaluateEligibilityForService', 'services-platform:modules/eligibility/aws/api/evaluate.routes.ts:listEligibilityDecisions', 'services-platform:modules/eligibility/aws/api/evaluate.routes.ts:getEligibilityDecision', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-001-write-an-eligibility-rule-staff-can-read-back.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-002-find-rules-and-see-where-each-one-is-used.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-003-test-a-rule-on-real-people-before-relying-on-it.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-004-publish-a-rule-as-a-locked-version-schedule-it-and-roll-it.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-006-offer-the-conditions-and-purposes-applications-declare.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-007-use-a-rule-wherever-a-price-page-role-or-process-needs-one.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-008-answer-who-qualifies-one-person-at-a-time-with-a-reason.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-009-keep-the-record-of-the-decisions-that-counted.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-012-tell-rhythm-s-operators-when-the-engine-cannot-answer-well.md#permissions', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:testEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/evaluate.routes.ts:evaluateEligibility']
  - key: platform.eligibility.read (evaluates the record types' read keys)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [testEligibilityDefinition]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-ELG-003-01, BR-CAP-PFM-ELG-003-03, BR-CAP-PFM-ELG-003-04]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/eligibility/aws/api/definitions.routes.ts:testEligibilityDefinition']
  - key: platform.eligibility.reconcile
    intent: Queue staff-authorized refresh of derived eligibility roles.
    operations: [requestEligibilityReconcile]
    surfaces: [api, job, portal, service]
    guarded_by: [BR-CAP-PFM-ELG-010-06, BR-CAP-PFM-ELG-010-07, BR-CAP-PFM-ELG-010-08, BR-CAP-PFM-SEC-014-02, BR-CAP-PFM-SEC-014-05, BR-CAP-PFM-SEC-014-13]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-010-keep-answers-current-when-a-rule-or-a-record-changes.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-014-grant-roles-automatically-from-appointments-and-eligibility.md#permissions', 'services-platform:modules/eligibility/aws/api/reconcile.routes.ts:requestEligibilityReconcile']
  - key: 'platform.eligibility.reconcile (system access, staff-only key)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [requestEligibilityReconcile]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-ELG-010-06, BR-CAP-PFM-ELG-010-07, BR-CAP-PFM-ELG-010-08]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/eligibility/aws/api/reconcile.routes.ts:requestEligibilityReconcile']
  - key: platform.eligibility.retire
    intent: Replace or retire qualification definitions subject to their dependency guards.
    operations: [archiveEligibilityDefinition, deleteEligibilityDefinition, deprecateEligibilityDefinition, migrateEligibilityDefinitionReferences, restoreEligibilityDefinition]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-005-03, BR-CAP-PFM-ELG-005-07, BR-CAP-PFM-ELG-005-08, BR-CAP-PFM-ELG-005-09]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:deprecateEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:archiveEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:deleteEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:restoreEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:migrateEligibilityDefinitionReferences', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-005-retire-a-rule-and-move-its-uses-to-a-replacement.md#permissions']
  - key: platform.eligibility.write
    intent: Maintain a qualification draft and exercise its validation without granting release authority.
    operations: [createEligibilityDefinition, duplicateEligibilityDefinition, saveEligibilityDefinitionDraft, updateEligibilityDefinition]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-001-05, BR-CAP-PFM-ELG-001-06, BR-CAP-PFM-ELG-001-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:createEligibilityDefinition', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:saveEligibilityDefinitionDraft', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:duplicateEligibilityDefinition', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-001-write-an-eligibility-rule-staff-can-read-back.md#permissions', 'services-platform:modules/eligibility/aws/api/definitions.routes.ts:updateEligibilityDefinition']
  - key: platform.eligibility.write (evaluates platform.eligibility.publish)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [updateEligibilityDefinition]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-ELG-001-05, BR-CAP-PFM-ELG-001-06, BR-CAP-PFM-ELG-001-11]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/eligibility/aws/api/definitions.routes.ts:updateEligibilityDefinition']
  - key: platform.explorer-views.manage
    intent: Administer record-list views within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-009-05, BR-CAP-PFM-QRY-009-06, BR-CAP-PFM-QRY-009-10, BR-CAP-PFM-QRY-009-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-009-keep-and-share-the-explorer-views-a-person-works-from.md#permissions']
  - key: platform.explorer-views.share
    intent: Change the shared audience of record-list views within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-009-05, BR-CAP-PFM-QRY-009-06, BR-CAP-PFM-QRY-009-10, BR-CAP-PFM-QRY-009-11]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-009-keep-and-share-the-explorer-views-a-person-works-from.md#permissions']
  - key: platform.explorer-views.use
    intent: Use and maintain the caller’s own record-list views within the caller’s applicable scope.
    operations: [createExplorerView, deleteExplorerView, getExplorerView, getExplorerViewPreferences, listExplorerViews, patchExplorerView, putExplorerViewPreferences, readExplorerNavigation, selectExplorerRecordIds, startExplorerNavigation, updateExplorerView]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-010-05, BR-CAP-PFM-QRY-010-07, BR-CAP-PFM-QRY-009-05, BR-CAP-PFM-QRY-009-06, BR-CAP-PFM-QRY-009-10, BR-CAP-PFM-QRY-009-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/explorer/aws/api/explorer-navigation.routes.ts:startExplorerNavigation', 'services-platform:modules/explorer/aws/api/explorer-navigation.routes.ts:selectExplorerRecordIds', 'services-platform:modules/explorer/aws/api/explorer-navigation.routes.ts:readExplorerNavigation', 'services-platform:modules/explorer/aws/api/explorer-preferences.routes.ts:getExplorerViewPreferences', 'services-platform:modules/explorer/aws/api/explorer-preferences.routes.ts:putExplorerViewPreferences', 'services-platform:modules/explorer/aws/api/explorer-views.routes.ts:createExplorerView', 'services-platform:modules/explorer/aws/api/explorer-views.routes.ts:listExplorerViews', 'services-platform:modules/explorer/aws/api/explorer-views.routes.ts:getExplorerView', 'services-platform:modules/explorer/aws/api/explorer-views.routes.ts:updateExplorerView', 'services-platform:modules/explorer/aws/api/explorer-views.routes.ts:patchExplorerView', 'services-platform:modules/explorer/aws/api/explorer-views.routes.ts:deleteExplorerView', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-009-keep-and-share-the-explorer-views-a-person-works-from.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-010-walk-a-list-record-by-record-and-act-on-every-record-it.md#permissions']
  - key: platform.extension-bindings.manage
    intent: Administer customization bindings within the caller’s applicable scope.
    operations: [createExtensionBinding, deleteExtensionBinding, updateExtensionBinding]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-INT-017-05, BR-CAP-PFM-INT-017-06, BR-CAP-PFM-INT-017-07, BR-CAP-PFM-INT-017-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-017-customize-an-extension-point-with-handlers-and-bindings.md#permissions']
  - key: platform.extension-handlers.manage
    intent: Configure permitted handler definitions and their protected settings.
    operations: [createExtensionHandler, deleteExtensionHandler, updateExtensionHandler]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-INT-017-05, BR-CAP-PFM-INT-017-06, BR-CAP-PFM-INT-017-07, BR-CAP-PFM-INT-017-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-017-customize-an-extension-point-with-handlers-and-bindings.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations']
  - key: platform.extension-handlers.test
    intent: Exercise a controlled test of customization handlers within the caller’s applicable scope.
    operations: [testExtensionHandler]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-INT-017-05, BR-CAP-PFM-INT-017-06, BR-CAP-PFM-INT-017-07, BR-CAP-PFM-INT-017-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-017-customize-an-extension-point-with-handlers-and-bindings.md#permissions']
  - key: platform.extension-invocations.read
    intent: Inspect customization execution history within the caller’s applicable scope.
    operations: [getExtensionInvocation, listExtensionInvocations]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-INT-017-05, BR-CAP-PFM-INT-017-06, BR-CAP-PFM-INT-017-07, BR-CAP-PFM-INT-017-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-017-customize-an-extension-point-with-handlers-and-bindings.md#permissions']
  - key: platform.extension-points.read
    intent: Inspect application customization declarations within the caller’s applicable scope.
    operations: [createExtensionHandler, deleteExtensionHandler, getEventType, getExtensionHandler, getExtensionPoint, listEventTypes, listExtensionBindings, listExtensionHandlers, listExtensionPoints, previewExtensionResolution, updateExtensionHandler]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-016-01, BR-CAP-PFM-INT-016-02, BR-CAP-PFM-INT-016-03, BR-CAP-PFM-INT-016-04, BR-CAP-PFM-INT-016-05, BR-CAP-PFM-INT-017-05, BR-CAP-PFM-INT-017-06, BR-CAP-PFM-INT-017-07, BR-CAP-PFM-INT-017-08]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-016-register-extension-points-and-business-event-types.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-017-customize-an-extension-point-with-handlers-and-bindings.md#permissions']
  - key: platform.extension-rules.manage
    intent: Administer customer customization rules within the caller’s applicable scope.
    operations: [createExtensionHandler, deleteExtensionHandler, updateExtensionHandler]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-INT-017-05, BR-CAP-PFM-INT-017-06, BR-CAP-PFM-INT-017-07, BR-CAP-PFM-INT-017-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-017-customize-an-extension-point-with-handlers-and-bindings.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations']
  - key: platform.field-labels.update
    intent: Revise local field labels within the caller’s applicable scope.
    operations: [removeFieldLabel, setFieldLabel]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-004-02, BR-CAP-PFM-MTD-004-06]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-004-call-a-standard-field-by-the-workspace-s-own-name.md#permissions']
  - key: platform.files.upload
    intent: Obtain authorized attachment staging with the prescribed file limits.
    operations: [issueFileUpload]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-007-06, BR-CAP-PFM-MTD-007-07]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-files.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md#permissions']
  - key: platform.integration-credentials.manage
    intent: Supply or replace provider credentials without disclosing stored secret values.
    operations: [putIntegrationConnectionCredential, reauthorizeIntegrationConnection, startIntegrationConnectionOauth]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-005-01, BR-CAP-PFM-INT-005-05, BR-CAP-PFM-INT-005-08, BR-CAP-PFM-INT-005-09, BR-CAP-PFM-INT-005-12, BR-CAP-PFM-INT-005-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-005-keep-provider-credentials-secret-and-current.md#permissions']
  - key: platform.integration-executions.operate
    intent: Recover or resolve operational work for provider execution history within the caller’s applicable scope.
    operations: [cancelIntegrationExecution, replayIntegrationSubscription, replayIntegrationWebhookEndpoint, replayIntegrationWebhookEvent, resolveIntegrationExecution, retryIntegrationDelivery, retryIntegrationExecution]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-013-01]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-011-review-and-operate-calls-by-hand.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-013-receive-provider-notifications-once-and-replay-them.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-014-send-rhythm-changes-to-subscribed-integrations.md#permissions']
  - key: platform.integration-executions.read
    intent: Inspect provider execution history within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: []
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-011-review-and-operate-calls-by-hand.md#permissions']
  - key: platform.integrations.invoke
    intent: Request a provider capability through the selected connection and its additional authority checks.
    operations: [completeIntegrationExecution, emitIntegrationEvents, getIntegrationSyncCursor, invokeIntegrationCapability, invokeIntegrationCapabilityFromConsole, projectIntegrationDataGrant, putIntegrationSyncCursor, queryIntegrationDataGrant, renewIntegrationLease, reportIntegrationExecutionProgress]
    surfaces: [api, console, job, service]
    guarded_by: [BR-CAP-PFM-INT-010-07, BR-CAP-PFM-INT-005-01, BR-CAP-PFM-INT-005-05, BR-CAP-PFM-INT-005-08, BR-CAP-PFM-INT-005-09, BR-CAP-PFM-INT-005-12, BR-CAP-PFM-INT-005-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-009-call-a-capability-through-the-gateway-without-doing-it-twice.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-010-settle-calls-whose-outcome-is-unknown-or-late.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: 'platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [completeIntegrationExecution, emitIntegrationEvents, getIntegrationSyncCursor, projectIntegrationDataGrant, putIntegrationSyncCursor, queryIntegrationDataGrant, renewIntegrationLease, reportIntegrationExecutionProgress]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-INT-005-01, BR-CAP-PFM-INT-005-05, BR-CAP-PFM-INT-005-08, BR-CAP-PFM-INT-005-09, BR-CAP-PFM-INT-005-12, BR-CAP-PFM-INT-005-14, BR-CAP-PFM-INT-010-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: 'platform.integrations.invoke, plus the capability’s own permission'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [invokeIntegrationCapabilityFromConsole]
    surfaces: [console]
    guarded_by: []
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: platform.integrations.invoke; the principal acts only for its own application
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [invokeIntegrationCapability]
    surfaces: [service]
    guarded_by: []
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations']
  - key: platform.integrations.manage
    intent: Administer integrations within the caller’s applicable scope.
    operations: [checkIntegrationConnectionHealth, createIntegrationConnection, createIntegrationInstallation, createIntegrationSubscription, deleteIntegrationBinding, deleteIntegrationSubscription, disconnectIntegrationConnection, migrateIntegrationBindings, moveIntegrationConnectionBindings, putIntegrationBinding, resumeIntegrationConnection, resumeIntegrationInstallation, rotateIntegrationWebhookEndpoint, suspendIntegrationConnection, suspendIntegrationInstallation, tryIntegrationConnectionCall, uninstallIntegrationInstallation, updateIntegrationConnection, updateIntegrationConnectionVersion, updateIntegrationInstallation, updateIntegrationSubscription, verifyIntegrationConnection]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-013-01, BR-CAP-PFM-INT-003-04, BR-CAP-PFM-INT-003-06, BR-CAP-PFM-INT-003-10, BR-CAP-PFM-INT-004-05, BR-CAP-PFM-INT-004-06, BR-CAP-PFM-INT-004-08, BR-CAP-PFM-INT-004-09, BR-CAP-PFM-INT-007-01, BR-CAP-PFM-INT-007-02, BR-CAP-PFM-INT-007-04, BR-CAP-PFM-INT-007-05, BR-CAP-PFM-INT-007-06, BR-CAP-PFM-INT-007-07, BR-CAP-PFM-INT-007-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-003-install-an-integration-on-the-access-the-administrator.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-004-connect-a-provider-account-and-look-after-the-connection.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-006-watch-the-health-and-history-of-integrations.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-007-choose-which-connection-serves-each-capability.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-012-try-a-capability-on-a-test-connection.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-013-receive-provider-notifications-once-and-replay-them.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-014-send-rhythm-changes-to-subscribed-integrations.md#permissions']
  - key: platform.integrations.read
    intent: Inspect integrations within the caller’s applicable scope.
    operations: [getIntegrationCatalogEntry, getIntegrationConnection, getIntegrationConnectionCredential, getIntegrationDelivery, getIntegrationExecution, getIntegrationInstallation, getIntegrationWebhookEvent, getTenantIntegrationHealth, listIntegrationAuditEvents, listIntegrationBindingRevisions, listIntegrationBindings, listIntegrationCatalog, listIntegrationConnectionNotices, listIntegrationConnections, listIntegrationDeliveries, listIntegrationEvents, listIntegrationExecutionAttempts, listIntegrationExecutions, listIntegrationInstallations, listIntegrationSubscriptions, listIntegrationWebhookEndpoints, listIntegrationWebhookEvents, resolveIntegrationBinding]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-013-01, BR-CAP-PFM-INT-002-01, BR-CAP-PFM-INT-002-02, BR-CAP-PFM-INT-003-04, BR-CAP-PFM-INT-003-06, BR-CAP-PFM-INT-003-10, BR-CAP-PFM-INT-004-05, BR-CAP-PFM-INT-004-06, BR-CAP-PFM-INT-004-08, BR-CAP-PFM-INT-004-09, BR-CAP-PFM-INT-005-01, BR-CAP-PFM-INT-005-05, BR-CAP-PFM-INT-005-08, BR-CAP-PFM-INT-005-09, BR-CAP-PFM-INT-005-12, BR-CAP-PFM-INT-005-14, BR-CAP-PFM-INT-007-01, BR-CAP-PFM-INT-007-02, BR-CAP-PFM-INT-007-04, BR-CAP-PFM-INT-007-05, BR-CAP-PFM-INT-007-06, BR-CAP-PFM-INT-007-07, BR-CAP-PFM-INT-007-11, BR-CAP-PFM-INT-008-02, BR-CAP-PFM-INT-008-03, BR-CAP-PFM-INT-008-04, BR-CAP-PFM-INT-008-08, BR-CAP-PFM-INT-010-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-002-find-an-integration-the-workspace-may-use.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-003-install-an-integration-on-the-access-the-administrator.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-004-connect-a-provider-account-and-look-after-the-connection.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-005-keep-provider-credentials-secret-and-current.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-006-watch-the-health-and-history-of-integrations.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-007-choose-which-connection-serves-each-capability.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-008-route-each-call-to-an-eligible-connection-and-explain-why.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-010-settle-calls-whose-outcome-is-unknown-or-late.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-011-review-and-operate-calls-by-hand.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-013-receive-provider-notifications-once-and-replay-them.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-014-send-rhythm-changes-to-subscribed-integrations.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-015-deliver-integration-events-to-rhythm-applications.md#permissions']
  - key: platform.jobs.read
    intent: Inspect jobs within the caller’s applicable scope.
    operations: [countJobs, countJobsOfTenant, getJob, getJobOfTenant, listJobEvents, listJobEventsOfTenant, listJobKinds, listJobKindsOfTenant, listJobs, listJobsOfTenant]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-OPS-005-02, BR-CAP-PFM-OPS-005-08, BR-CAP-PFM-OPS-007-03]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-jobs.md#operations', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-005-see-what-ran-for-a-workspace-and-across-the-organization.md#permissions']
  - key: platform.layouts.create
    intent: Add layouts within the caller’s applicable scope.
    operations: [createConsoleForm, createConsolePageLayout, createPortalForm, createPortalPageLayout]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-003-offer-custom-fields-forms-and-layouts-only-on-the-record-types.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: 'platform.layouts.create, with the purpose''s own keys evaluated (the owner''s administration keys, or for a read the record read key; platform.custom-objects.* and platform.custom-records.read for a custom object purpose)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [createConsoleForm, createConsolePageLayout, createPortalForm, createPortalPageLayout]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: platform.layouts.delete
    intent: Remove layouts within the caller’s applicable scope.
    operations: [deleteConsoleForm, deleteConsolePageLayout, deletePortalForm, deletePortalPageLayout]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: 'platform.layouts.delete, with the purpose''s own keys evaluated (the owner''s administration keys, or for a read the record read key; platform.custom-objects.* and platform.custom-records.read for a custom object purpose)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [deleteConsoleForm, deleteConsolePageLayout, deletePortalForm, deletePortalPageLayout]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: platform.layouts.read
    intent: Inspect layouts within the caller’s applicable scope.
    operations: [getConsoleForm, getConsolePageLayout, getPortalForm, getPortalPageLayout, listConsoleForms, listConsolePageLayouts, listPortalForms, listPortalPageLayouts]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: 'platform.layouts.read, with the purpose''s own keys evaluated (the owner''s administration keys, or for a read the record read key; platform.custom-objects.* and platform.custom-records.read for a custom object purpose)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [getConsoleForm, getConsolePageLayout, getPortalForm, getPortalPageLayout, listConsoleForms, listConsolePageLayouts, listPortalForms, listPortalPageLayouts]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: platform.layouts.update
    intent: Revise layouts within the caller’s applicable scope.
    operations: [patchConsoleForm, patchConsolePageLayout, patchPortalForm, patchPortalPageLayout, updateConsoleForm, updateConsolePageLayout, updatePortalForm, updatePortalPageLayout]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-008-keep-the-workspace-s-forms-and-page-layouts-governed-by-the.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: 'platform.layouts.update, with the purpose''s own keys evaluated (the owner''s administration keys, or for a read the record read key; platform.custom-objects.* and platform.custom-records.read for a custom object purpose)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [patchConsoleForm, patchConsolePageLayout, patchPortalForm, patchPortalPageLayout, updateConsoleForm, updateConsolePageLayout, updatePortalForm, updatePortalPageLayout]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-MTD-008-03, BR-CAP-PFM-MTD-008-04, BR-CAP-PFM-MTD-008-05, BR-CAP-PFM-MTD-008-07]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md#operations']
  - key: platform.llm-usage.read
    intent: Inspect AI allowance and usage information within the caller’s applicable scope.
    operations: [getLlmUsageSummary, listLlmUsageFeatures]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-LLM-017-08, BR-CAP-PFM-LLM-017-09, BR-CAP-PFM-LLM-018-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md#operations', 'rhythm-v2-docs:specs/platform/llm/planning/capabilities/CAP-PFM-LLM-017-let-an-organization-s-administrators-see-their-own-ai.md#permissions']
  - key: platform.metadata.read
    intent: Inspect record descriptions within the caller’s applicable scope.
    operations: [describeObject, listFieldTypes, listObjects]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-MTD-002-07, BR-CAP-PFM-MTD-004-02, BR-CAP-PFM-MTD-004-06]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md#operations', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-002-tell-every-screen-what-fields-a-record-type-has-and-how-each.md#permissions', 'rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-003-offer-custom-fields-forms-and-layouts-only-on-the-record-types.md#permissions']
  - key: platform.notifications.manage
    intent: Administer staff notices within the caller’s applicable scope.
    operations: [getNotificationDelivery, getNotificationInstance, getNotificationRequest, listNotificationHistory, listNotificationRequests]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-011-05, BR-CAP-PFM-NOT-011-06, BR-CAP-PFM-NOT-011-08, BR-CAP-PFM-NOT-010-01, BR-CAP-PFM-NOT-010-03, BR-CAP-PFM-NOT-010-04, BR-CAP-PFM-NOT-010-05]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-007-move-into-a-settings-area-and-back-to-my-work.md#permissions', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-011-see-what-the-organization-told-whom.md#permissions']
  - key: platform.notifications.publish
    intent: Submit application-owned staff notices through the protected publication entry point.
    operations: [cancelNotificationRequest, requestNotification]
    surfaces: [api, hq, job]
    guarded_by: [BR-CAP-PFM-NOT-002-04, BR-CAP-PFM-NOT-002-05, BR-CAP-PFM-NOT-002-08, BR-CAP-PFM-NOT-006-05, BR-CAP-PFM-NOT-006-07, BR-CAP-PFM-NOT-006-08]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-002-tell-people-that-something-happened-with-one-call.md#permissions']
  - key: platform.notifications.use
    intent: Use and maintain the caller’s own staff notices within the caller’s applicable scope.
    operations: [archiveMyNotification, getMyNotification, getMyNotificationSummary, listMyNotifications, markAllMyNotificationsRead, markMyNotificationRead, markMyNotificationUnread, sendMyTestNotification, unarchiveMyNotification]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-NOT-009-02, BR-CAP-PFM-NOT-009-05, BR-CAP-PFM-NOT-010-01, BR-CAP-PFM-NOT-010-03, BR-CAP-PFM-NOT-010-04, BR-CAP-PFM-NOT-010-05, BR-CAP-PFM-NOT-002-04, BR-CAP-PFM-NOT-002-05, BR-CAP-PFM-NOT-002-08]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-009-work-through-my-own-notifications.md#permissions', 'rhythm-v2-docs:specs/platform/notifications/planning/capabilities/CAP-PFM-NOT-010-understand-why-i-was-told.md#permissions']
  - key: platform.queries.generate
    intent: Request a query draft from a written question while retaining dataset access checks.
    operations: [generateDatasetQuery, getQueryGeneration]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-003-10]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/queries.routes.ts:generateDatasetQuery', 'services-platform:modules/queries/aws/api/queries.routes.ts:getQueryGeneration', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-003-have-a-query-written-from-a-plain-english-request.md#permissions']
  - key: platform.queries.read
    intent: Inspect queries within the caller’s applicable scope.
    operations: [createQueryRecipeDraft, createQuerySchedule, deleteQuerySchedule, describeQueryDataset, downloadQueryExport, duplicateQuerySchedule, findRecipientUsers, getDeliveryTemplateStarter, getQueryExport, getQueryRecipe, getQuerySchedule, getScheduleQueryChanges, listDeliveryTemplates, listQueryDatasets, listQueryRecipes, listQueryScheduleRuns, listQuerySchedules, pauseQuerySchedule, previewQuerySchedule, replaceQuerySchedule, resolveDateExpressions, resumeQuerySchedule, runDatasetQuery, runQueryRecipe, runQueryScheduleNow, startQueryExport, takeQueryScheduleOwnership, useLatestScheduleQuery, validateDatasetQuery]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-001-02, BR-CAP-PFM-QRY-001-06, BR-CAP-PFM-QRY-001-09, BR-CAP-PFM-QRY-001-11, BR-CAP-PFM-QRY-002-02, BR-CAP-PFM-QRY-008-04, BR-CAP-PFM-QRY-008-08, BR-CAP-PFM-QRY-014-07, BR-CAP-PFM-QRY-014-09, BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15, BR-CAP-PFM-QRY-013-01]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/queries.routes.ts:listQueryDatasets', 'services-platform:modules/queries/aws/api/queries.routes.ts:describeQueryDataset', 'services-platform:modules/queries/aws/api/queries.routes.ts:runDatasetQuery', 'services-platform:modules/queries/aws/api/queries.routes.ts:validateDatasetQuery', 'services-platform:modules/queries/aws/api/queries.routes.ts:resolveDateExpressions', 'services-platform:modules/queries/aws/api/query-recipes.routes.ts:listQueryRecipes', 'services-platform:modules/queries/aws/api/query-recipes.routes.ts:getQueryRecipe', 'services-platform:modules/queries/aws/api/query-recipes.routes.ts:createQueryRecipeDraft', 'services-platform:modules/queries/aws/api/query-recipes.routes.ts:runQueryRecipe', 'services-platform:modules/queries/aws/api/query-exports.routes.ts:startQueryExport', 'services-platform:modules/queries/aws/api/query-exports.routes.ts:getQueryExport', 'services-platform:modules/queries/aws/api/query-exports.routes.ts:downloadQueryExport', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-001-know-which-data-can-be-queried-and-what-each-dataset-holds.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-002-ask-a-question-of-the-workspace-s-data-and-see-only-what.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-008-start-a-query-from-a-recipe-rhythm-ships.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-014-take-a-query-s-whole-result-away-as-a-csv-or-excel-file.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-015-send-a-saved-query-or-report-to-chosen-people-on-a-schedule.md#permissions', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQuerySchedules', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:createQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:replaceQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:deleteQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:duplicateQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:pauseQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:resumeQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:runQueryScheduleNow', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:takeQueryScheduleOwnership', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:useLatestScheduleQuery', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getScheduleQueryChanges', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQueryScheduleRuns', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:previewQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listDeliveryTemplates', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getDeliveryTemplateStarter', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:findRecipientUsers', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-013-print-a-report-or-dashboard-to-pdf-or-excel-as-the-person.md#permissions']
  - key: 'platform.queries.read (to follow and download, CAP-014)'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-013-01]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-013-print-a-report-or-dashboard-to-pdf-or-excel-as-the-person.md#permissions']
  - key: platform.queries.read AND (platform.query-schedules.use OR platform.query-schedules.manage)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [createQuerySchedule, deleteQuerySchedule, duplicateQuerySchedule, findRecipientUsers, getDeliveryTemplateStarter, getQuerySchedule, getScheduleQueryChanges, listDeliveryTemplates, listQueryScheduleRuns, listQuerySchedules, pauseQuerySchedule, previewQuerySchedule, replaceQuerySchedule, resumeQuerySchedule, runQueryScheduleNow, takeQueryScheduleOwnership, useLatestScheduleQuery]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQuerySchedules', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:createQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:replaceQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:deleteQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:duplicateQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:pauseQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:resumeQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:runQueryScheduleNow', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:takeQueryScheduleOwnership', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:useLatestScheduleQuery', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getScheduleQueryChanges', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQueryScheduleRuns', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:previewQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listDeliveryTemplates', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getDeliveryTemplateStarter', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:findRecipientUsers']
  - key: platform.query-schedules.external-recipients
    intent: Allow delivery to external recipients for recurring file deliveries within the caller’s applicable scope.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-015-send-a-saved-query-or-report-to-chosen-people-on-a-schedule.md#permissions']
  - key: platform.query-schedules.manage
    intent: Administer recurring file deliveries within the caller’s applicable scope.
    operations: [createQuerySchedule, deleteQuerySchedule, duplicateQuerySchedule, findRecipientUsers, getDeliveryTemplateStarter, getQuerySchedule, getScheduleQueryChanges, listDeliveryTemplates, listQueryScheduleRuns, listQuerySchedules, pauseQuerySchedule, previewQuerySchedule, replaceQuerySchedule, resumeQuerySchedule, runQueryScheduleNow, takeQueryScheduleOwnership, useLatestScheduleQuery]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15, BR-CAP-PFM-QRY-014-07, BR-CAP-PFM-QRY-014-09]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-015-send-a-saved-query-or-report-to-chosen-people-on-a-schedule.md#permissions', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQuerySchedules', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:createQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:replaceQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:deleteQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:duplicateQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:pauseQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:resumeQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:runQueryScheduleNow', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:takeQueryScheduleOwnership', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:useLatestScheduleQuery', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getScheduleQueryChanges', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQueryScheduleRuns', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:previewQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listDeliveryTemplates', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getDeliveryTemplateStarter', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:findRecipientUsers', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-014-take-a-query-s-whole-result-away-as-a-csv-or-excel-file.md#permissions']
  - key: platform.query-schedules.manage (to follow and download anyone's export)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-014-07, BR-CAP-PFM-QRY-014-09]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-014-take-a-query-s-whole-result-away-as-a-csv-or-excel-file.md#permissions']
  - key: platform.query-schedules.use
    intent: Use and maintain the caller’s own recurring file deliveries within the caller’s applicable scope.
    operations: [createQuerySchedule, deleteQuerySchedule, duplicateQuerySchedule, findRecipientUsers, getDeliveryTemplateStarter, getQuerySchedule, getScheduleQueryChanges, listDeliveryTemplates, listQueryScheduleRuns, listQuerySchedules, pauseQuerySchedule, previewQuerySchedule, replaceQuerySchedule, resumeQuerySchedule, runQueryScheduleNow, takeQueryScheduleOwnership, useLatestScheduleQuery]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-015-send-a-saved-query-or-report-to-chosen-people-on-a-schedule.md#permissions', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQuerySchedules', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:createQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:replaceQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:deleteQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:duplicateQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:pauseQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:resumeQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:runQueryScheduleNow', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:takeQueryScheduleOwnership', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:useLatestScheduleQuery', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getScheduleQueryChanges', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listQueryScheduleRuns', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:previewQuerySchedule', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:listDeliveryTemplates', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:getDeliveryTemplateStarter', 'services-platform:modules/queries/aws/api/query-schedules.routes.ts:findRecipientUsers']
  - key: platform.quick-search-settings.read
    intent: Inspect search field configuration within the caller’s applicable scope.
    operations: [getQuickSearchConfiguration, listQuickSearchConfigurations, listQuickSearchFields]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/quick-search/aws/api/quick-search.routes.ts:listQuickSearchConfigurations', 'services-platform:modules/quick-search/aws/api/quick-search.routes.ts:getQuickSearchConfiguration', 'services-platform:modules/quick-search/aws/api/quick-search.routes.ts:listQuickSearchFields', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-017-choose-what-quick-search-finds-records-by-and-keep-the.md#permissions']
  - key: platform.quick-search-settings.rebuild
    intent: Rebuild search field configuration within the caller’s applicable scope.
    operations: [rebuildQuickSearchIndex]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/quick-search/aws/api/quick-search.routes.ts:rebuildQuickSearchIndex', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-017-choose-what-quick-search-finds-records-by-and-keep-the.md#permissions']
  - key: platform.quick-search-settings.update
    intent: Revise search field configuration within the caller’s applicable scope.
    operations: [replaceQuickSearchConfiguration]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-017-02, BR-CAP-PFM-QRY-017-04, BR-CAP-PFM-QRY-017-06]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/quick-search/aws/api/quick-search.routes.ts:replaceQuickSearchConfiguration', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-017-choose-what-quick-search-finds-records-by-and-keep-the.md#permissions']
  - key: platform.quick-search.read
    intent: Inspect typed record lookup within the caller’s applicable scope.
    operations: [issueQuickSearchAccess]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-CSH-003-05, BR-CAP-PFM-QRY-016-04]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-003-act-from-the-keyboard.md#permissions', 'services-platform:modules/quick-search/aws/api/quick-search.routes.ts:issueQuickSearchAccess', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-016-find-contacts-and-organizations-as-one-types.md#permissions']
  - key: platform.record-views.create
    intent: Add personal record visits within the caller’s applicable scope.
    operations: [recordRecordView]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-OPS-010-02]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-008-record-that-a-person-opened-a-record.md#permissions', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-audit.md#operations']
  - key: 'platform.record-views.create, and the record type’s read and dataset-query keys evaluated for the target'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [recordRecordView]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-OPS-010-02]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-audit.md#operations']
  - key: platform.record-views.read
    intent: Inspect personal record visits within the caller’s applicable scope.
    operations: [listMyRecordViews]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-OPS-009-08]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-audit.md#operations', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-009-look-back-over-the-records-a-person-opened.md#permissions']
  - key: platform.reports.manage
    intent: Administer reports within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-011-01, BR-CAP-PFM-QRY-011-05, BR-CAP-PFM-QRY-011-06, BR-CAP-PFM-QRY-011-07, BR-CAP-PFM-QRY-011-09, BR-CAP-PFM-QRY-011-10, BR-CAP-PFM-QRY-011-13, BR-CAP-PFM-QRY-012-07]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-011-keep-share-and-find-reports-without-sharing-anyone-s-data.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-012-assemble-a-dashboard-from-several-saved-queries.md#permissions']
  - key: platform.reports.read
    intent: Inspect reports within the caller’s applicable scope.
    operations: [getReport, listReports]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-011-01, BR-CAP-PFM-QRY-011-05, BR-CAP-PFM-QRY-011-06, BR-CAP-PFM-QRY-011-07, BR-CAP-PFM-QRY-011-09, BR-CAP-PFM-QRY-011-10, BR-CAP-PFM-QRY-011-13, BR-CAP-PFM-QRY-012-07]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/reports.routes.ts:listReports', 'services-platform:modules/queries/aws/api/reports.routes.ts:getReport', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-011-keep-share-and-find-reports-without-sharing-anyone-s-data.md#permissions']
  - key: platform.reports.share
    intent: Change the shared audience of reports within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-011-01, BR-CAP-PFM-QRY-011-05, BR-CAP-PFM-QRY-011-06, BR-CAP-PFM-QRY-011-07, BR-CAP-PFM-QRY-011-09, BR-CAP-PFM-QRY-011-10, BR-CAP-PFM-QRY-011-13, BR-CAP-PFM-QRY-012-07]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-011-keep-share-and-find-reports-without-sharing-anyone-s-data.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-012-assemble-a-dashboard-from-several-saved-queries.md#permissions']
  - key: platform.reports.use
    intent: Use and maintain the caller’s own reports within the caller’s applicable scope.
    operations: [createReport, deleteReport, startReportExport, updateReport]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-011-01, BR-CAP-PFM-QRY-011-05, BR-CAP-PFM-QRY-011-06, BR-CAP-PFM-QRY-011-07, BR-CAP-PFM-QRY-011-09, BR-CAP-PFM-QRY-011-10, BR-CAP-PFM-QRY-011-13, BR-CAP-PFM-QRY-012-07, BR-CAP-PFM-QRY-013-01, BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/reports.routes.ts:createReport', 'services-platform:modules/queries/aws/api/reports.routes.ts:updateReport', 'services-platform:modules/queries/aws/api/reports.routes.ts:deleteReport', 'services-platform:modules/queries/aws/api/reports.routes.ts:startReportExport', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-011-keep-share-and-find-reports-without-sharing-anyone-s-data.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-012-assemble-a-dashboard-from-several-saved-queries.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-013-print-a-report-or-dashboard-to-pdf-or-excel-as-the-person.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-015-send-a-saved-query-or-report-to-chosen-people-on-a-schedule.md#permissions']
  - key: platform.reports.use (report schedules)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-015-01, BR-CAP-PFM-QRY-015-04, BR-CAP-PFM-QRY-015-05, BR-CAP-PFM-QRY-015-07, BR-CAP-PFM-QRY-015-11, BR-CAP-PFM-QRY-015-14, BR-CAP-PFM-QRY-015-15]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-015-send-a-saved-query-or-report-to-chosen-people-on-a-schedule.md#permissions']
  - key: platform.responsibilities.delegate-own
    intent: Arrange temporary cover for a responsibility the caller holds.
    operations: [createResponsibilityDelegation, delegateAllMyResponsibilities, endResponsibilityDelegation]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-014-01, BR-CAP-PFM-ELG-014-04, BR-CAP-PFM-ELG-014-07, BR-CAP-PFM-ELG-014-08]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:delegateAllMyResponsibilities', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-014-cover-a-colleague-s-responsibilities-while-they-are-away.md#permissions', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:createResponsibilityDelegation', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:endResponsibilityDelegation']
  - key: platform.responsibilities.manage
    intent: Administer responsibilities within the caller’s applicable scope.
    operations: [createResponsibilityAssignment, createResponsibilityDelegation, endResponsibilityAssignment, endResponsibilityDelegation, removeResponsibilityRoleDefault]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-ELG-013-02, BR-CAP-PFM-ELG-013-04, BR-CAP-PFM-ELG-013-05, BR-CAP-PFM-ELG-013-08, BR-CAP-PFM-ELG-015-01, BR-CAP-PFM-ELG-015-03, BR-CAP-PFM-ELG-015-09, BR-CAP-PFM-ELG-014-01, BR-CAP-PFM-ELG-014-04, BR-CAP-PFM-ELG-014-07, BR-CAP-PFM-ELG-014-08]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:createResponsibilityAssignment', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:endResponsibilityAssignment', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:removeResponsibilityRoleDefault', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-013-decide-who-looks-after-each-area-of-work.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-014-cover-a-colleague-s-responsibilities-while-they-are-away.md#permissions', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:createResponsibilityDelegation', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:endResponsibilityDelegation']
  - key: platform.responsibilities.read
    intent: Inspect responsibilities within the caller’s applicable scope.
    operations: [createResponsibilityDelegation, endResponsibilityDelegation, getEffectiveResponsibilityHolders, getMyResponsibilities, listResponsibilityAssignments, listResponsibilityDefinitions, listUnassignedResponsibilities]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-ELG-013-02, BR-CAP-PFM-ELG-013-04, BR-CAP-PFM-ELG-013-05, BR-CAP-PFM-ELG-013-08, BR-CAP-PFM-ELG-014-01, BR-CAP-PFM-ELG-014-04, BR-CAP-PFM-ELG-014-07, BR-CAP-PFM-ELG-014-08, BR-CAP-PFM-ELG-015-01, BR-CAP-PFM-ELG-015-03, BR-CAP-PFM-ELG-015-09]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-005-reach-my-own-pages-help-and-sign-out-from-the-user-menu.md#permissions', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:listResponsibilityDefinitions', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:getMyResponsibilities', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:getEffectiveResponsibilityHolders', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:listResponsibilityAssignments', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:listUnassignedResponsibilities', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-013-decide-who-looks-after-each-area-of-work.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-014-cover-a-colleague-s-responsibilities-while-they-are-away.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-015-keep-every-always-held-area-covered.md#permissions', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:createResponsibilityDelegation', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:endResponsibilityDelegation']
  - key: platform.responsibilities.read (evaluates platform.responsibilities.manage and platform.responsibilities.delegate-own)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [createResponsibilityDelegation, endResponsibilityDelegation]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-ELG-014-01, BR-CAP-PFM-ELG-014-04, BR-CAP-PFM-ELG-014-07, BR-CAP-PFM-ELG-014-08]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:createResponsibilityDelegation', 'services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts:endResponsibilityDelegation']
  - key: platform.saved-queries.manage
    intent: Administer saved questions within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-006-01, BR-CAP-PFM-QRY-006-02, BR-CAP-PFM-QRY-006-04, BR-CAP-PFM-QRY-006-05, BR-CAP-PFM-QRY-006-06, BR-CAP-PFM-QRY-006-08, BR-CAP-PFM-QRY-006-12, BR-CAP-PFM-QRY-006-13, BR-CAP-PFM-QRY-006-15]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-006-keep-and-share-saved-queries-without-widening-anyone-s.md#permissions']
  - key: platform.saved-queries.read
    intent: Inspect saved questions within the caller’s applicable scope.
    operations: [getSavedQuery, listSavedQueries, runSavedQuery]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-006-01, BR-CAP-PFM-QRY-006-02, BR-CAP-PFM-QRY-006-04, BR-CAP-PFM-QRY-006-05, BR-CAP-PFM-QRY-006-06, BR-CAP-PFM-QRY-006-08, BR-CAP-PFM-QRY-006-12, BR-CAP-PFM-QRY-006-13, BR-CAP-PFM-QRY-006-15, BR-CAP-PFM-QRY-007-05, BR-CAP-PFM-QRY-011-01, BR-CAP-PFM-QRY-011-05, BR-CAP-PFM-QRY-011-06, BR-CAP-PFM-QRY-011-07, BR-CAP-PFM-QRY-011-09, BR-CAP-PFM-QRY-011-10, BR-CAP-PFM-QRY-011-13]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/saved-queries.routes.ts:listSavedQueries', 'services-platform:modules/queries/aws/api/saved-queries.routes.ts:getSavedQuery', 'services-platform:modules/queries/aws/api/saved-queries.routes.ts:runSavedQuery', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-006-keep-and-share-saved-queries-without-widening-anyone-s.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-007-run-a-saved-query-with-the-values-it-asks-for-as-the-person.md#permissions', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-011-keep-share-and-find-reports-without-sharing-anyone-s-data.md#permissions']
  - key: platform.saved-queries.read and the dataset's query key (to read a report's data)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-011-01, BR-CAP-PFM-QRY-011-05, BR-CAP-PFM-QRY-011-06, BR-CAP-PFM-QRY-011-07, BR-CAP-PFM-QRY-011-09, BR-CAP-PFM-QRY-011-10, BR-CAP-PFM-QRY-011-13]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-011-keep-share-and-find-reports-without-sharing-anyone-s-data.md#permissions']
  - key: platform.saved-queries.share
    intent: Change the shared audience of saved questions within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-006-01, BR-CAP-PFM-QRY-006-02, BR-CAP-PFM-QRY-006-04, BR-CAP-PFM-QRY-006-05, BR-CAP-PFM-QRY-006-06, BR-CAP-PFM-QRY-006-08, BR-CAP-PFM-QRY-006-12, BR-CAP-PFM-QRY-006-13, BR-CAP-PFM-QRY-006-15]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-006-keep-and-share-saved-queries-without-widening-anyone-s.md#permissions']
  - key: platform.saved-queries.use
    intent: Use and maintain the caller’s own saved questions within the caller’s applicable scope.
    operations: [createSavedQuery, deleteSavedQuery, updateSavedQuery]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-QRY-006-01, BR-CAP-PFM-QRY-006-02, BR-CAP-PFM-QRY-006-04, BR-CAP-PFM-QRY-006-05, BR-CAP-PFM-QRY-006-06, BR-CAP-PFM-QRY-006-08, BR-CAP-PFM-QRY-006-12, BR-CAP-PFM-QRY-006-13, BR-CAP-PFM-QRY-006-15]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/queries/aws/api/saved-queries.routes.ts:createSavedQuery', 'services-platform:modules/queries/aws/api/saved-queries.routes.ts:updateSavedQuery', 'services-platform:modules/queries/aws/api/saved-queries.routes.ts:deleteSavedQuery', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-006-keep-and-share-saved-queries-without-widening-anyone-s.md#permissions']
  - key: platform.security-access.explain
    intent: Inspect access explanations and the associated security history.
    operations: [explainConsoleUserPermissions, listSecurityAuditEvents]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-011-01, BR-CAP-PFM-SEC-011-09, BR-CAP-PFM-SEC-010-01, BR-CAP-PFM-SEC-010-02, BR-CAP-PFM-SEC-010-04, BR-CAP-PFM-SEC-010-06, BR-CAP-PFM-SEC-010-09, BR-CAP-PFM-SEC-010-10, BR-CAP-PFM-SEC-010-12, BR-CAP-PFM-SEC-010-13, BR-CAP-PFM-SEC-010-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/console-users.routes.ts:listSecurityAuditEvents', 'services-platform:modules/security/aws/api/console-users.routes.ts:explainConsoleUserPermissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-011-review-who-changed-access-and-what-was-refused.md#permissions']
  - key: platform.security-access.manage
    intent: Administer scoped memberships and assignments subject to delegation and self-widening checks.
    operations: [activateConsoleUser, activateUser, deleteUser, grantConsoleUserRole, inviteConsoleUser, inviteTenantMember, reinstateConsoleUser, reinstateUser, resendConsoleUserInvitation, resendInvitation, revokeConsoleUser, revokeUser, setConsoleUserRoleScope, suspendConsoleUser, suspendUser, updateConsoleUserDetails, withdrawConsoleUserRole]
    surfaces: [api, console, job, portal]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10, BR-CAP-PFM-SEC-010-01, BR-CAP-PFM-SEC-010-02, BR-CAP-PFM-SEC-010-04, BR-CAP-PFM-SEC-010-06, BR-CAP-PFM-SEC-010-09, BR-CAP-PFM-SEC-010-10, BR-CAP-PFM-SEC-010-12, BR-CAP-PFM-SEC-010-13, BR-CAP-PFM-SEC-010-14, BR-CAP-PFM-SEC-008-01, BR-CAP-PFM-SEC-008-04, BR-CAP-PFM-SEC-008-05, BR-CAP-PFM-SEC-008-09, BR-CAP-PFM-SEC-008-11, BR-CAP-PFM-SEC-008-12]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/console-users.routes.ts:updateConsoleUserDetails', 'services-platform:modules/security/aws/api/console-users.routes.ts:grantConsoleUserRole', 'services-platform:modules/security/aws/api/console-users.routes.ts:setConsoleUserRoleScope', 'services-platform:modules/security/aws/api/console-users.routes.ts:withdrawConsoleUserRole', 'services-platform:modules/security/aws/api/invitations.routes.ts:inviteConsoleUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:inviteTenantMember', 'services-platform:modules/security/aws/api/invitations.routes.ts:resendConsoleUserInvitation', 'services-platform:modules/security/aws/api/invitations.routes.ts:revokeConsoleUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:suspendConsoleUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:reinstateConsoleUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:activateConsoleUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:resendInvitation', 'services-platform:modules/security/aws/api/invitations.routes.ts:revokeUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:suspendUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:reinstateUser', 'services-platform:modules/security/aws/api/invitations.routes.ts:activateUser', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-008-invite-people-and-follow-their-invitations.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md#permissions', 'services-platform:modules/security/aws/api/users.routes.ts:deleteUser']
  - key: platform.security-policies.manage
    intent: Administer access policies within the caller’s applicable scope.
    operations: [archiveSecurityPolicy, createSecurityPolicy, duplicateSecurityPolicy, patchSecurityPolicy]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-012-02, BR-CAP-PFM-SEC-012-03, BR-CAP-PFM-SEC-012-07, BR-CAP-PFM-SEC-012-10, BR-CAP-PFM-SEC-012-12]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/definitions.routes.ts:createSecurityPolicy', 'services-platform:modules/security/aws/api/definitions.routes.ts:patchSecurityPolicy', 'services-platform:modules/security/aws/api/definitions.routes.ts:duplicateSecurityPolicy', 'services-platform:modules/security/aws/api/definitions.routes.ts:archiveSecurityPolicy', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md#permissions']
  - key: platform.security-policies.read
    intent: Inspect access policies within the caller’s applicable scope.
    operations: [getCustomerPermissionCatalog, getPermissionCatalog, getSecurityPolicy, listSecurityPolicies, validateSecurityPolicyRules]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-012-02, BR-CAP-PFM-SEC-012-03, BR-CAP-PFM-SEC-012-07, BR-CAP-PFM-SEC-012-10, BR-CAP-PFM-SEC-012-12]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/definitions.routes.ts:listSecurityPolicies', 'services-platform:modules/security/aws/api/definitions.routes.ts:getSecurityPolicy', 'services-platform:modules/security/aws/api/definitions.routes.ts:validateSecurityPolicyRules', 'services-platform:modules/security/aws/api/definitions.routes.ts:getCustomerPermissionCatalog', 'services-platform:modules/security/aws/api/definitions.routes.ts:getPermissionCatalog', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md#permissions']
  - key: platform.security-roles.manage
    intent: Administer role definitions within the caller’s applicable scope.
    operations: [archiveSecurityRole, createSecurityRole, duplicateSecurityRole, patchSecurityRole, setSecurityRoleEligibility]
    surfaces: [api, console, job, portal]
    guarded_by: [BR-CAP-PFM-SEC-012-02, BR-CAP-PFM-SEC-012-03, BR-CAP-PFM-SEC-012-07, BR-CAP-PFM-SEC-012-10, BR-CAP-PFM-SEC-012-12, BR-CAP-PFM-SEC-014-02, BR-CAP-PFM-SEC-014-05, BR-CAP-PFM-SEC-014-13]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/definitions.routes.ts:createSecurityRole', 'services-platform:modules/security/aws/api/definitions.routes.ts:patchSecurityRole', 'services-platform:modules/security/aws/api/definitions.routes.ts:setSecurityRoleEligibility', 'services-platform:modules/security/aws/api/definitions.routes.ts:duplicateSecurityRole', 'services-platform:modules/security/aws/api/definitions.routes.ts:archiveSecurityRole', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-014-grant-roles-automatically-from-appointments-and-eligibility.md#permissions']
  - key: platform.security-roles.read
    intent: Inspect role definitions within the caller’s applicable scope.
    operations: [getSecurityRole, listSecurityRoles]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-012-02, BR-CAP-PFM-SEC-012-03, BR-CAP-PFM-SEC-012-07, BR-CAP-PFM-SEC-012-10, BR-CAP-PFM-SEC-012-12]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/definitions.routes.ts:listSecurityRoles', 'services-platform:modules/security/aws/api/definitions.routes.ts:getSecurityRole', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md#permissions']
  - key: platform.security-self.read
    intent: Inspect the active caller’s own evaluated authority without an administered role grant.
    operations: [declinePortalContactMatch, evaluateEligibility, getMyAccess, getMyApplications, getMySecurityContext, getMySecurityContextInTenant, getPortalContactMatch, resolveTenantUserNames, signOutPortalMember, startPortalContactChallenge, verifyPortalContactChallenge]
    surfaces: [api, console, job, portal]
    guarded_by: [BR-CAP-PFM-CSH-001-02, BR-CAP-PFM-CSH-001-06, BR-CAP-PFM-CSH-012-06, BR-CAP-PFM-CSH-014-10, BR-CAP-PFM-CSH-009-08, BR-CAP-PFM-ELG-008-02, BR-CAP-PFM-ELG-008-03, BR-CAP-PFM-ELG-008-04, BR-CAP-PFM-ELG-008-12, BR-CAP-PFM-SEC-007-04, BR-CAP-PFM-SEC-007-08, BR-CAP-PFM-SEC-007-13, BR-CAP-PFM-SEC-020-04, BR-CAP-PFM-SEC-020-08, BR-CAP-PFM-SEC-020-09, BR-CAP-PFM-SEC-019-05, BR-CAP-PFM-SEC-019-07, BR-CAP-PFM-SEC-015-01, BR-CAP-PFM-SEC-015-02, BR-CAP-PFM-SEC-015-03, BR-CAP-PFM-SEC-015-07, BR-CAP-PFM-SEC-015-12, BR-CAP-PFM-ELG-009-02, BR-CAP-PFM-ELG-010-06, BR-CAP-PFM-ELG-010-07, BR-CAP-PFM-ELG-010-08]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/design/contracts/SVC-PFM-CSH-console-shell.md#operations', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-001-work-inside-one-console-frame.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-006-find-my-way-through-the-applications-menu.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-009-open-any-console-page-from-its-address.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-010-enter-the-workspace-an-address-names-or-learn-why-not.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-011-switch-to-another-workspace-without-carrying-records-across.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-012-keep-links-from-before-the-address-change-working.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-014-offer-exactly-the-applications-the-workspace-and-the-person.md#permissions', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md#permissions', 'rhythm-v2-docs:specs/platform/eligibility/planning/capabilities/CAP-PFM-ELG-008-answer-who-qualifies-one-person-at-a-time-with-a-reason.md#permissions', 'services-platform:modules/security/aws/api/access.routes.ts:getMyAccess', 'services-platform:modules/security/aws/api/access.routes.ts:getMySecurityContext', 'services-platform:modules/security/aws/api/access.routes.ts:getMySecurityContextInTenant', 'services-platform:modules/security/aws/api/access.routes.ts:getMyApplications', 'services-platform:modules/security/aws/api/portal-contact-match.routes.ts:getPortalContactMatch', 'services-platform:modules/security/aws/api/portal-contact-match.routes.ts:startPortalContactChallenge', 'services-platform:modules/security/aws/api/portal-contact-match.routes.ts:verifyPortalContactChallenge', 'services-platform:modules/security/aws/api/portal-contact-match.routes.ts:declinePortalContactMatch', 'services-platform:modules/security/aws/api/portal-identity.routes.ts:signOutPortalMember', 'services-platform:modules/security/aws/api/user-names.routes.ts:resolveTenantUserNames', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-007-know-what-i-may-do-in-a-workspace.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-019-let-members-sign-up-and-sign-in-on-a-workspace-s-portal.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-020-link-a-portal-member-to-their-contact-record.md#permissions', 'services-platform:modules/eligibility/aws/api/evaluate.routes.ts:evaluateEligibility']
  - key: platform.security-self.read (evaluates platform.eligibility.read; the purpose's declared callers decide admission)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [evaluateEligibility]
    surfaces: [portal]
    guarded_by: [BR-CAP-PFM-ELG-008-02, BR-CAP-PFM-ELG-008-03, BR-CAP-PFM-ELG-008-04, BR-CAP-PFM-ELG-008-12, BR-CAP-PFM-ELG-009-02, BR-CAP-PFM-ELG-010-06, BR-CAP-PFM-ELG-010-07, BR-CAP-PFM-ELG-010-08]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/eligibility/aws/api/evaluate.routes.ts:evaluateEligibility']
  - key: platform.snapshots.read
    intent: Inspect snapshots within the caller’s applicable scope.
    operations: [listSnapshotPeriods]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-QRY-019-01, BR-CAP-PFM-QRY-019-04, BR-CAP-PFM-QRY-019-05, BR-CAP-PFM-QRY-019-06, BR-CAP-PFM-QRY-019-08, BR-CAP-PFM-QRY-019-10, BR-CAP-PFM-QRY-019-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/snapshots/aws/api/snapshots.routes.ts:listSnapshotPeriods', 'rhythm-v2-docs:specs/platform/queries/planning/capabilities/CAP-PFM-QRY-019-keep-monthly-snapshots-of-each-workspace-and-show-which.md#permissions']
  - key: platform.staff-access.manage
    intent: Administer customer decisions on Rhythm staff entry within the caller’s applicable scope.
    operations: [approveTenantStaffAccess, declineTenantStaffAccess, giveTenantStaffAccess, revokeTenantStaffAccess]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-017-01, BR-CAP-PFM-SEC-017-02, BR-CAP-PFM-SEC-017-04, BR-CAP-PFM-SEC-017-07, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-SEC-017-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/staff-access.routes.ts:approveTenantStaffAccess', 'services-platform:modules/security/aws/api/staff-access.routes.ts:declineTenantStaffAccess', 'services-platform:modules/security/aws/api/staff-access.routes.ts:revokeTenantStaffAccess', 'services-platform:modules/security/aws/api/staff-access.routes.ts:giveTenantStaffAccess', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md#permissions']
  - key: platform.staff-access.read
    intent: Inspect customer decisions on Rhythm staff entry within the caller’s applicable scope.
    operations: [listTenantStaffAccess]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-017-01, BR-CAP-PFM-SEC-017-02, BR-CAP-PFM-SEC-017-04, BR-CAP-PFM-SEC-017-07, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-SEC-017-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/staff-access.routes.ts:listTenantStaffAccess', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md#permissions']
  - key: platform.tenant-applications.read
    intent: Inspect workspace application availability within the caller’s applicable scope.
    operations: [listTenantApplicationsForTenant]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-CSH-017-08, BR-CAP-PFM-CSH-017-09, BR-CAP-PFM-CSH-017-12, BR-CAP-PFM-OPS-016-01, BR-CAP-PFM-OPS-016-03, BR-CAP-PFM-OPS-016-06, BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/console-shell/design/contracts/SVC-PFM-CSH-console-shell.md#operations', 'rhythm-v2-docs:specs/platform/console-shell/design/contracts/SVC-PFM-CSH-tenant-applications.md#operations', 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-017-see-which-applications-the-organization-has-and-why-one-is.md#permissions', 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-licensing.md#operations', 'rhythm-v2-docs:specs/platform/operations/planning/capabilities/CAP-PFM-OPS-016-tell-a-customer-s-administrator-which-applications-their.md#permissions', 'services-platform:modules/tenants/aws/api/tenant-applications.routes.ts:listTenantApplicationsForTenant']
  - key: platform.tenants.bulk
    intent: Apply counted bulk changes to workspace administration records within the caller’s applicable scope.
    operations: []
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md#permissions']
  - key: platform.tenants.deletion-cancel
    intent: Withdraw a workspace-removal decision while cancellation remains valid.
    operations: [cancelTenantDeletionRequest]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-004-02, BR-CAP-PFM-SEC-004-08, BR-CAP-PFM-SEC-004-09, BR-CAP-PFM-SEC-004-11, BR-CAP-PFM-SEC-004-12, BR-CAP-PFM-SEC-004-13, BR-CAP-PFM-TNL-014-02, BR-CAP-PFM-TNL-014-03, BR-CAP-PFM-TNL-014-06, BR-CAP-PFM-TNL-014-08]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:cancelTenantDeletionRequest', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-004-retire-a-workspace-through-a-deliberate-reversible-deletion.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md#permissions']
  - key: platform.tenants.deletion-hold
    intent: Pause or release a workspace-removal decision before irreversible work.
    operations: [holdTenantDeletionRequest, releaseTenantDeletionRequest]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-004-02, BR-CAP-PFM-SEC-004-08, BR-CAP-PFM-SEC-004-09, BR-CAP-PFM-SEC-004-11, BR-CAP-PFM-SEC-004-12, BR-CAP-PFM-SEC-004-13, BR-CAP-PFM-TNL-014-02, BR-CAP-PFM-TNL-014-03, BR-CAP-PFM-TNL-014-06, BR-CAP-PFM-TNL-014-08]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:holdTenantDeletionRequest', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:releaseTenantDeletionRequest', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-004-retire-a-workspace-through-a-deliberate-reversible-deletion.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md#permissions']
  - key: platform.tenants.deletion-read
    intent: Inspect workspace-removal decisions and their retained progress.
    operations: [getTenantDeletionRequest, listTenantDeletionRequests]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-004-02, BR-CAP-PFM-SEC-004-08, BR-CAP-PFM-SEC-004-09, BR-CAP-PFM-SEC-004-11, BR-CAP-PFM-SEC-004-12, BR-CAP-PFM-SEC-004-13, BR-CAP-PFM-TNL-014-02, BR-CAP-PFM-TNL-014-03, BR-CAP-PFM-TNL-014-06, BR-CAP-PFM-TNL-014-08, BR-CAP-PFM-TNL-018-03, BR-CAP-PFM-TNL-018-05]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:listTenantDeletionRequests', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:getTenantDeletionRequest', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-004-retire-a-workspace-through-a-deliberate-reversible-deletion.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-014-hold-release-or-call-off-a-deletion-before-destruction.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-018-keep-a-lasting-record-of-a-deleted-workspace-and-stop-it.md#permissions']
  - key: platform.tenants.deletion-request
    intent: Submit a deliberate workspace-removal decision and request permitted recovery.
    operations: [requestTenantDeletion, resumeTenantDeletionSchedule, retryTenantPurge]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-004-02, BR-CAP-PFM-SEC-004-08, BR-CAP-PFM-SEC-004-09, BR-CAP-PFM-SEC-004-11, BR-CAP-PFM-SEC-004-12, BR-CAP-PFM-SEC-004-13, BR-CAP-PFM-TNL-013-03, BR-CAP-PFM-TNL-013-10, BR-CAP-PFM-TNL-015-06, BR-CAP-PFM-TNL-016-02, BR-CAP-PFM-TNL-016-03, BR-CAP-PFM-TNL-017-03, BR-CAP-PFM-TNL-017-06, BR-CAP-PFM-TNL-017-13]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:requestTenantDeletion', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:resumeTenantDeletionSchedule', 'services-platform:modules/tenants/aws/api/tenant-deletion-requests.routes.ts:retryTenantPurge', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-004-retire-a-workspace-through-a-deliberate-reversible-deletion.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-013-ask-for-a-workspace-to-be-deleted-after-a-waiting-period.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-016-begin-destruction-only-when-every-safeguard-still-holds.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-017-remove-everything-a-workspace-owned-and-prove-it-is-gone.md#permissions']
  - key: platform.tenants.manage-commercial-link
    intent: Change the commercial-company link used to derive workspace coverage.
    operations: [setTenantHubspotCompany]
    surfaces: [api, console, hq]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:setTenantHubspotCompany', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md#permissions']
  - key: platform.tenants.manage-status
    intent: Change business standing through the separate staff authority for workspace availability.
    operations: [patchHqTenant, patchTenant]
    surfaces: [api, console, hq, job]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14, BR-CAP-PFM-TNL-006-01, BR-CAP-PFM-TNL-006-03]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md#permissions', 'rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-006-keep-every-workspace-s-lifecycle-state-truthful.md#permissions', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:patchTenant', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:patchHqTenant']
  - key: platform.tenants.onboard
    intent: Prepare the workspace’s portal identity infrastructure under staff authority.
    operations: [onboardTenantPortal]
    surfaces: [api, hq, job, portal]
    guarded_by: [BR-CAP-PFM-SEC-019-05, BR-CAP-PFM-SEC-019-07]
    kind: permission
    tier: admin
    staff_only: true
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/access.routes.ts:onboardTenantPortal', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-019-let-members-sign-up-and-sign-in-on-a-workspace-s-portal.md#permissions']
  - key: platform.tenants.read
    intent: Inspect workspace administration records within the caller’s applicable scope.
    operations: [getDefaultTenantForCustomer, getTenant, listByCustomerId, listTenants, listTenantsByParentId]
    surfaces: [api, console, portal]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:listTenants', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:getTenant', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:getDefaultTenantForCustomer', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:listByCustomerId', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:listTenantsByParentId', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md#permissions']
  - key: platform.tenants.update
    intent: Revise workspace administration records within the caller’s applicable scope.
    operations: [patchTenant, updateTenant]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:updateTenant', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md#permissions', 'services-platform:modules/tenants/aws/api/tenants.routes.ts:patchTenant']
  - key: platform.tenants.update (a status change also evaluates platform.tenants.manage-status)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [patchTenant]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-SEC-002-01, BR-CAP-PFM-SEC-002-07, BR-CAP-PFM-SEC-002-08, BR-CAP-PFM-SEC-002-13, BR-CAP-PFM-SEC-002-14]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/tenants/aws/api/tenants.routes.ts:patchTenant']
  - key: platform.users.bulk
    intent: Apply counted bulk changes to membership profiles within the caller’s applicable scope.
    operations: []
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md#permissions']
  - key: platform.users.change-password
    intent: Change or recover the caller’s own credential through the admitted identity flow.
    operations: [changePassword, resetOwnPassword]
    surfaces: [api, console, portal]
    guarded_by: [BR-CAP-PFM-SEC-006-04, BR-CAP-PFM-SEC-006-06, BR-CAP-PFM-SEC-006-08, BR-CAP-PFM-SEC-006-09, BR-CAP-PFM-SEC-006-10, BR-CAP-PFM-SEC-006-11]
    kind: permission
    tier: user
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/users.routes.ts:changePassword', 'services-platform:modules/security/aws/api/users.routes.ts:resetOwnPassword', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-006-sign-in-stay-signed-in-and-recover-a-password.md#permissions']
  - key: platform.users.create
    intent: Add membership profiles within the caller’s applicable scope.
    operations: [createUser]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/users.routes.ts:createUser', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md#permissions']
  - key: platform.users.delete
    intent: Remove membership profiles within the caller’s applicable scope.
    operations: [deleteUser]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md#permissions', 'services-platform:modules/security/aws/api/users.routes.ts:deleteUser']
  - key: platform.users.delete and platform.security-access.manage
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [deleteUser]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10]
    kind: permission-expression
    provenance: documented
    source: ['services-platform:modules/security/aws/api/users.routes.ts:deleteUser']
  - key: platform.users.manage-identities
    intent: Maintain a reachable membership’s canonical provider identity.
    operations: [linkCognitoIdentity]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/users.routes.ts:linkCognitoIdentity', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md#permissions']
  - key: platform.users.manage-passwords
    intent: Initiate password recovery for another reachable membership.
    operations: [resetUserPassword]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-SEC-006-04, BR-CAP-PFM-SEC-006-06, BR-CAP-PFM-SEC-006-08, BR-CAP-PFM-SEC-006-09, BR-CAP-PFM-SEC-006-10, BR-CAP-PFM-SEC-006-11]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/users.routes.ts:resetUserPassword', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-006-sign-in-stay-signed-in-and-recover-a-password.md#permissions']
  - key: platform.users.read
    intent: Inspect membership profiles within the caller’s applicable scope.
    operations: [checkSecurityGrant, checkTenantSecurityGrant, getConsoleUser, getCurrentUser, getUser, listConsoleUserAssignments, listConsoleUsers, listCustomerInvitations, listSecurityRoleMembers, listTenantMembers, listUserIdentities, listUsers]
    surfaces: [api, console, job, portal]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10, BR-CAP-PFM-SEC-008-01, BR-CAP-PFM-SEC-008-04, BR-CAP-PFM-SEC-008-05, BR-CAP-PFM-SEC-008-09, BR-CAP-PFM-SEC-008-11, BR-CAP-PFM-SEC-008-12, BR-CAP-PFM-SEC-010-01, BR-CAP-PFM-SEC-010-02, BR-CAP-PFM-SEC-010-04, BR-CAP-PFM-SEC-010-06, BR-CAP-PFM-SEC-010-09, BR-CAP-PFM-SEC-010-10, BR-CAP-PFM-SEC-010-12, BR-CAP-PFM-SEC-010-13, BR-CAP-PFM-SEC-010-14, BR-CAP-PFM-SEC-006-04, BR-CAP-PFM-SEC-006-06, BR-CAP-PFM-SEC-006-08, BR-CAP-PFM-SEC-006-09, BR-CAP-PFM-SEC-006-10, BR-CAP-PFM-SEC-006-11]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/console-users.routes.ts:listConsoleUsers', 'services-platform:modules/security/aws/api/console-users.routes.ts:getConsoleUser', 'services-platform:modules/security/aws/api/console-users.routes.ts:listCustomerInvitations', 'services-platform:modules/security/aws/api/console-users.routes.ts:listConsoleUserAssignments', 'services-platform:modules/security/aws/api/console-users.routes.ts:checkSecurityGrant', 'services-platform:modules/security/aws/api/console-users.routes.ts:checkTenantSecurityGrant', 'services-platform:modules/security/aws/api/definitions.routes.ts:listSecurityRoleMembers', 'services-platform:modules/security/aws/api/invitations.routes.ts:listTenantMembers', 'services-platform:modules/security/aws/api/users.routes.ts:listUsers', 'services-platform:modules/security/aws/api/users.routes.ts:getCurrentUser', 'services-platform:modules/security/aws/api/users.routes.ts:getUser', 'services-platform:modules/security/aws/api/users.routes.ts:listUserIdentities', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-006-sign-in-stay-signed-in-and-recover-a-password.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-008-invite-people-and-follow-their-invitations.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md#permissions', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md#permissions']
  - key: platform.users.update
    intent: Revise membership profiles within the caller’s applicable scope.
    operations: [patchUser, updateUser]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-SEC-009-03, BR-CAP-PFM-SEC-009-05, BR-CAP-PFM-SEC-009-06, BR-CAP-PFM-SEC-009-07, BR-CAP-PFM-SEC-009-10]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'services-platform:modules/security/aws/api/users.routes.ts:updateUser', 'services-platform:modules/security/aws/api/users.routes.ts:patchUser', 'rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md#permissions']
  - key: platform.workflow-actions.automation-manage
    intent: Maintain and publish event-driven definitions in shared workflow configuration within the caller’s applicable scope.
    operations: [createAutomationRule, deleteAutomationRule, disableAutomationRule, enableAutomationRule, publishAutomationRule, replaceAutomationRule, retireAutomationRule, saveAutomationRuleDraft]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-020-01, BR-CAP-PFM-INT-020-02, BR-CAP-PFM-INT-020-03, BR-CAP-PFM-INT-020-04, BR-CAP-PFM-INT-020-05, BR-CAP-PFM-INT-020-06, BR-CAP-PFM-INT-020-09]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-020-run-actions-automatically-when-a-business-event-happens.md#permissions']
  - key: platform.workflow-actions.calendars-manage
    intent: Maintain business-time calendars in shared workflow configuration within the caller’s applicable scope.
    operations: [createBusinessCalendar, deleteBusinessCalendar, replaceBusinessCalendar]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-INT-019-02, BR-CAP-PFM-INT-019-03]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-019-reuse-action-templates-and-keep-business-calendars.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-022-schedule-work-with-customer-business-calendars.md#permissions']
  - key: platform.workflow-actions.registry-read
    intent: Inspect available action and trigger declarations.
    operations: [getAutomationRule, getBusinessCalendar, getWorkflowActionTemplate, getWorkflowActionType, getWorkflowActionsTenantHealth, getWorkflowTemplate, listAutomationRuleVersions, listAutomationRules, listBusinessCalendars, listWorkflowActionTemplates, listWorkflowActionTypes, listWorkflowTemplates, listWorkflowTriggerPoints]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-018-01, BR-CAP-PFM-INT-018-02, BR-CAP-PFM-INT-018-06, BR-CAP-PFM-INT-021-02, BR-CAP-PFM-INT-021-03, BR-CAP-PFM-INT-020-01, BR-CAP-PFM-INT-020-02, BR-CAP-PFM-INT-020-03, BR-CAP-PFM-INT-020-04, BR-CAP-PFM-INT-020-05, BR-CAP-PFM-INT-020-06, BR-CAP-PFM-INT-020-09, BR-CAP-PFM-INT-019-02, BR-CAP-PFM-INT-019-03]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-018-register-workflow-trigger-points-and-action-types.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-019-reuse-action-templates-and-keep-business-calendars.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-020-run-actions-automatically-when-a-business-event-happens.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-021-reuse-validated-action-and-workflow-recipes.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-022-schedule-work-with-customer-business-calendars.md#permissions']
  - key: platform.workflow-actions.registry-register
    intent: Replace an application’s action declarations through its admitted service identity.
    operations: [registerWorkflowActionsManifest]
    surfaces: [api, job, service]
    guarded_by: [BR-CAP-PFM-INT-018-01, BR-CAP-PFM-INT-018-02, BR-CAP-PFM-INT-018-06]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: true
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-018-register-workflow-trigger-points-and-action-types.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations']
  - key: platform.workflow-actions.registry-register (service caller for its own application)
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [registerWorkflowActionsManifest]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-INT-018-01, BR-CAP-PFM-INT-018-02, BR-CAP-PFM-INT-018-06]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations']
  - key: platform.workflow-actions.runs-read
    intent: Inspect host-owned runs through shared workflow configuration within the caller’s applicable scope.
    operations: [listWorkflowActionRuns, listWorkflowTimers]
    surfaces: [api, console, job]
    guarded_by: [BR-CAP-PFM-INT-020-01, BR-CAP-PFM-INT-020-02, BR-CAP-PFM-INT-020-03, BR-CAP-PFM-INT-020-04, BR-CAP-PFM-INT-020-05, BR-CAP-PFM-INT-020-06, BR-CAP-PFM-INT-020-09]
    kind: permission
    tier: read
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-020-run-actions-automatically-when-a-business-event-happens.md#permissions']
  - key: platform.workflow-actions.runs-resolve
    intent: Resolve permitted host-owned runs through shared workflow configuration within the caller’s applicable scope.
    operations: []
    surfaces: [api, job]
    guarded_by: [BR-CAP-PFM-INT-020-01, BR-CAP-PFM-INT-020-02, BR-CAP-PFM-INT-020-03, BR-CAP-PFM-INT-020-04, BR-CAP-PFM-INT-020-05, BR-CAP-PFM-INT-020-06, BR-CAP-PFM-INT-020-09]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-020-run-actions-automatically-when-a-business-event-happens.md#permissions']
  - key: platform.workflow-actions.templates-manage
    intent: Maintain reusable recipes in shared workflow configuration within the caller’s applicable scope.
    operations: [createWorkflowActionTemplate, createWorkflowTemplate, deleteWorkflowActionTemplate, deleteWorkflowTemplate, replaceWorkflowActionTemplate, replaceWorkflowTemplate]
    surfaces: [api, console]
    guarded_by: [BR-CAP-PFM-INT-021-02, BR-CAP-PFM-INT-021-03, BR-CAP-PFM-INT-019-02, BR-CAP-PFM-INT-019-03]
    kind: permission
    tier: admin
    staff_only: false
    sensitive: false
    provenance: observed
    source: ['services-platform:aws/platform.service.ts', 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md#operations', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-019-reuse-action-templates-and-keep-business-calendars.md#permissions', 'rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-021-reuse-validated-action-and-workflow-recipes.md#permissions']
  - key: rhythm_crm_app and rhythm_platform_app execution of the endpoint deletion and merge functions (no user key)
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: []
    surfaces: [api, job]
    guarded_by: [BR-CAP-PFM-MTD-019-06]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-019-apply-each-relationship-s-rule-when-a-linked-record-is-deleted.md#permissions']
  - key: 'Route permission metadata: platform.extension-points.read; anyOf: platform.extension-handlers.manage, platform.extension-rules.manage. The handler additionally requires the manage key for its kind.'
    intent: Evaluate the combined or owner-declared requirement recorded by the consuming artifact; this expression is not a separately grantable permission.
    operations: [createExtensionHandler, deleteExtensionHandler, updateExtensionHandler]
    surfaces: [console]
    guarded_by: [BR-CAP-PFM-INT-017-05, BR-CAP-PFM-INT-017-06, BR-CAP-PFM-INT-017-07, BR-CAP-PFM-INT-017-08]
    kind: permission-expression
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md#operations']
  - key: security.access
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-007-move-into-a-settings-area-and-back-to-my-work.md#permissions']
  - key: system (no user permission key; events are written by the record and link writes)
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: []
    surfaces: [job]
    guarded_by: [BR-CAP-PFM-MTD-015-03, BR-CAP-PFM-MTD-015-05]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-015-announce-every-custom-record-and-link-change-to-the-rest-of.md#permissions']
  - key: the platform-communications-dispatcher-invoke managed policy
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [nudgeCommunicationsDispatcher (IAM invoke of platform_communications_dispatcher)]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-018-01, BR-CAP-PFM-NOT-018-03, BR-CAP-PFM-NOT-018-05]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations']
  - key: 'the platform-communications-message-templates-invoke managed policy, given only to Marketing'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [storeMessageVersionTemplate (IAM function platform_communications_message_templates)]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations']
  - key: the platform-communications-request-invoke managed policy
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: ['readiness, testSend and renderPreview (IAM operations)', request (IAM operation of platform_communications_request), 'saveOwnedTemplate, clearOwnedTemplate and getOwnedTemplates (IAM operations)']
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-017-05, BR-CAP-PFM-NOT-017-11, BR-CAP-PFM-NOT-017-16, BR-CAP-PFM-NOT-016-02, BR-CAP-PFM-NOT-016-05, BR-CAP-PFM-NOT-016-07, BR-CAP-PFM-NOT-016-08, BR-CAP-PFM-NOT-016-09, BR-CAP-PFM-NOT-016-10, BR-CAP-PFM-NOT-016-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations']
  - key: the platform-communications-request-invoke managed policy; service filter not authenticated (FND-PFM-NOT-035)
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [changedMessages (IAM operation)]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-019-04, BR-CAP-PFM-NOT-019-06, BR-CAP-PFM-NOT-019-08, BR-CAP-PFM-NOT-019-09, BR-CAP-PFM-NOT-019-10, BR-CAP-PFM-NOT-019-11]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations']
  - key: the platform-notifications-dispatcher-invoke managed policy
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [nudgeNotificationsDispatcher (IAM invoke of platform_notifications_dispatcher)]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-002-04, BR-CAP-PFM-NOT-002-05, BR-CAP-PFM-NOT-002-08, BR-CAP-PFM-NOT-008-05, BR-CAP-PFM-NOT-008-06, BR-CAP-PFM-NOT-008-09]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations']
  - key: the platform-notifications-registration-invoke managed policy
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [registerServiceNotifications (IAM function platform_notifications_registration)]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-001-02, BR-CAP-PFM-NOT-001-10]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations']
  - key: the platform-notifications-request-invoke managed policy
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: [publishOrCancel (IAM function platform_notifications_request)]
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-002-04, BR-CAP-PFM-NOT-002-05, BR-CAP-PFM-NOT-002-08]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations']
  - key: the request-store policy and the rhythm_communications_submitter capability role
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: ['submitCommunicationRequest (shared library, in the caller''s transaction)']
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-017-05, BR-CAP-PFM-NOT-017-11, BR-CAP-PFM-NOT-017-16]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md#operations']
  - key: 'the rhythm_notifications_submitter capability role (insert only, own workspace)'
    intent: 'Use the documented public, internal or machine-access boundary without treating this description as a grantable permission.'
    operations: ['publishNotification and cancelNotification (producer library, in the producer''s transaction)']
    surfaces: [service]
    guarded_by: [BR-CAP-PFM-NOT-002-04, BR-CAP-PFM-NOT-002-05, BR-CAP-PFM-NOT-002-08, BR-CAP-PFM-NOT-014-02, BR-CAP-PFM-NOT-014-04, BR-CAP-PFM-NOT-014-06, BR-CAP-PFM-NOT-014-07, BR-CAP-PFM-NOT-014-10]
    kind: non-permission-boundary
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md#operations']
  - key: tools.queries.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    derived_from: [platform.queries.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-006-find-my-way-through-the-applications-menu.md#permissions']
  - key: tools.reports.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    derived_from: [platform.reports.read]
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-006-find-my-way-through-the-applications-menu.md#permissions']
  - key: tools.tasks.view
    intent: Present the corresponding console destination or action from evaluated backend entitlements.
    operations: []
    surfaces: [console]
    guarded_by: []
    kind: console-entitlement
    provenance: documented
    source: ['rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-006-find-my-way-through-the-applications-menu.md#permissions']
staff_access: >-
  Rhythm staff use platform-scoped HQ roles. Customer work requires recorded scoped clearance, including
  approved, standing or reasoned emergency entry; staff identity alone does not grant customer record access.
baseline_access:
  key: platform.security-self.read
  administered: false
  provenance: observed
  source: 'services-platform:modules/security/services/persistence/assignments.ts:selfAccessGrant'
evidence:
  - 'services-committees:aws/committees.service.ts:COMMITTEE_PERMISSIONS'
  - 'services-platform:aws/platform.service.ts'
  - 'services-crm:aws/crm.service.ts'
  - 'macroservice-libraries:packages/authorization/src/permission-catalog.ts'
  - 'services-platform:modules/security/services/catalog/reconcile-catalog.ts'
  - 'services-platform:modules/security/services/catalog/hq-roles.ts'
  - 'services-platform:modules/security/authorizer/authorize.ts'
  - 'services-platform:modules/security/authorizer/grants/possible-grant.ts'
  - 'services-platform:modules/security/authorizer/policy/refusal-context.ts'
  - 'services-platform:modules/security/db/security-assignments.table.ts'
  - 'services-platform:modules/security/aws/resources/identity-pool.cognito.ts'
  - 'react-console:lib/authz/evaluate.ts'
  - 'react-console:lib/authz/backend-aliases.ts'
  - 'react-console:lib/security-context/entitlements.ts'
  - 'rhythm-v2-docs:specs/platform/security/MODULE.md'
  - 'rhythm-v2-docs:specs/platform/security/planning/capabilities/'
  - 'rhythm-v2-docs:specs/platform/security/design/'
  - 'rhythm-v2-docs:specs/platform/console-shell/design/contracts/SVC-PFM-CSH-console-shell.md'
  - 'rhythm-v2-docs:specs/platform/console-shell/design/contracts/SVC-PFM-CSH-tenant-applications.md'
  - 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-capacity.md'
  - 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-crm-data-jobs.md'
  - 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-data-jobs.md'
  - 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-engine.md'
  - 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-membership-data-jobs.md'
  - 'rhythm-v2-docs:specs/platform/data-job-engine/design/contracts/SVC-PFM-DJE-partitions.md'
  - 'rhythm-v2-docs:specs/platform/eligibility/design/contracts/SVC-PFM-ELG-attention.md'
  - 'rhythm-v2-docs:specs/platform/eligibility/design/contracts/SVC-PFM-ELG-eligibility.md'
  - 'rhythm-v2-docs:specs/platform/eligibility/design/contracts/SVC-PFM-ELG-responsibilities.md'
  - 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-extensions.md'
  - 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-integrations.md'
  - 'rhythm-v2-docs:specs/platform/integrations/design/contracts/SVC-PFM-INT-workflow-actions.md'
  - 'rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-console-agent.md'
  - 'rhythm-v2-docs:specs/platform/llm/design/contracts/SVC-PFM-LLM-llm.md'
  - 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-associations.md'
  - 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-custom-objects.md'
  - 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-files.md'
  - 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-layouts.md'
  - 'rhythm-v2-docs:specs/platform/metadata/design/contracts/SVC-PFM-MTD-metadata.md'
  - 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-communications.md'
  - 'rhythm-v2-docs:specs/platform/notifications/design/contracts/SVC-PFM-NOT-notifications.md'
  - 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-audit.md'
  - 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-jobs.md'
  - 'rhythm-v2-docs:specs/platform/operations/design/contracts/SVC-PFM-OPS-licensing.md'
  - 'rhythm-v2-docs:specs/platform/queries/design/contracts/SVC-PFM-QRY-data-exports.md'
  - 'rhythm-v2-docs:specs/platform/queries/design/contracts/SVC-PFM-QRY-explorer.md'
  - 'rhythm-v2-docs:specs/platform/queries/design/contracts/SVC-PFM-QRY-queries.md'
  - 'rhythm-v2-docs:specs/platform/queries/design/contracts/SVC-PFM-QRY-quick-search.md'
  - 'rhythm-v2-docs:specs/platform/queries/design/contracts/SVC-PFM-QRY-snapshots.md'
  - 'rhythm-v2-docs:specs/platform/security/design/contracts/SVC-PFM-SEC-customers.md'
  - 'rhythm-v2-docs:specs/platform/security/design/contracts/SVC-PFM-SEC-security.md'
  - 'rhythm-v2-docs:specs/platform/security/design/contracts/SVC-PFM-SEC-tenants.md'
  - 'rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-commerce-tenant-lifecycle.md'
  - 'rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-committees-tenant-lifecycle.md'
  - 'rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-crm-tenant-lifecycle.md'
  - 'rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-marketing-tenant-lifecycle.md'
  - 'rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-membership-tenant-lifecycle.md'
  - >-
    rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-submissions-tenant-lifecycle.md
  - 'rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-tenants.md'
  - 'rhythm-v2-docs:specs/platform/tenant-lifecycle/design/contracts/SVC-PFM-TNL-websites-tenant-lifecycle.md'
narrative_sources:
  - section: Authorization Boundary
    provenance: observed
    source: 'services-platform:modules/security/authorizer/authorize.ts:authorize'
  - section: Scopes
    provenance: observed
    source: 'services-platform:modules/security/db/security-assignments.table.ts:securityAssignments'
  - section: Roles
    provenance: observed
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInRoles'
  - section: Permission Catalogue
    provenance: observed
    source: 'services-platform:aws/platform.service.ts; react-console:lib/security-context/entitlements.ts'
  - section: Role Entitlement Matrix
    provenance: inferred
    source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:builtInPolicies, builtInRoles; services-platform:aws/platform.service.ts; services-crm:aws/crm.service.ts'
    note: 'Expand released tier and explicit policies over the concrete keys consumed by this area; this is a static baseline, not an effective-access result.'
  - section: Protected Actions
    provenance: documented
    source: [BR-CAP-PFM-SEC-010-02, BR-CAP-PFM-SEC-016-03, BR-CAP-PFM-SEC-017-10, BR-CAP-PFM-LLM-016-01]
  - section: Guards Distinguished From Permissions
    provenance: documented
    source: [BR-CAP-PFM-SEC-015-09, BR-CAP-PFM-QRY-006-01, BR-CAP-PFM-QRY-002-01]
  - section: What People See When Refused
    provenance: observed
    source: 'services-platform:modules/security/authorizer/policy/refusal-context.ts; react-console:lib/authz/evaluate.ts:denialReason'
---

# Platform Authorization Model

## Authorization Boundary

Public identity flows and deployment-health reads use their own declared entry boundaries. Protected customer work requires an admitted identity and scoped authority. Portal identity stays within its workspace; console identity stays within its customer unless a recorded staff-entry grant permits customer work.

Rhythm HQ requires staff authority and the operation’s permission. A customer Administrator role supplies no HQ entry, and a platform staff role supplies no ordinary customer-record access. Internal jobs, deployment registrations and application functions use their declared machine boundaries. A public or internal operation’s access description is not a customer permission.

## Scopes

Platform scope serves Rhythm staff system work. Customer scope reaches the customer’s workspaces, workspace scope reaches one workspace, and record scope narrows authority by resource type and identity. The stored assignment types do not establish a separate organizational-unit level; an application can interpret its supported unit as a resource scope.

A role describes possible authority. Its assignment supplies the scope, validity and conditions. A gateway admission can therefore succeed while a service refuses a particular record or condition. The service remains responsible for that narrower check.

## Roles

The released customer roles are Administrator, Power User, Standard User, Read Only and Portal Member. The first four compose generated application policies. Administrator additionally carries the declared security-administration and workspace-export policies. Those separate powers do not follow from the Power User role’s application-administration policies.

Support Representative and Software Engineer share the declared HQ reader policy. Support additionally holds deletion reading and holding; Engineering additionally holds deletion reading and tailored-dataset authoring. Rhythm Administrator carries HQ authority and the explicitly listed staff-only Platform powers. Customer workspace entry remains a separate grant.

Customers can compose their own roles and policies within delegation safeguards. These are customer records rather than additional universal roles. The caller’s own evaluated-access read comes from active membership, so the matrix does not present it as an administered role entitlement. The Portal Member row shows Platform account powers; peer applications add their portal grants only while their catalogues publish them.

## Permission Catalogue

The structured catalogue gives each requirement its intent, operation references, surfaces and further guard rules. Concrete permissions are grantable keys. Console entitlements are derived presentation checks, permission patterns match released keys, and compound expressions combine requirements rather than create new powers. Non-permission boundaries identify public, machine or internal entry without adding a grant.

Existing contracts sometimes store a complete requirement description in the permission field. The catalogue retains that spelling for traceability and separately identifies its concrete keys. Source applications retain ownership of dataset and record permissions; Platform consumes those keys when it processes their information. Shared questions, reports and layouts confer no additional access to the underlying records.

## Role Entitlement Matrix

This matrix expands the released roles over the concrete keys consumed in this area. A checkmark means the baseline role includes the key; a dash means it does not. Scope, explicit denies, assignment conditions, availability and protected-action guards still decide an actual request. Console aliases, compound expressions, machine policies and membership-derived self access are excluded because they are not independent role grants.

| Permission | Administrator | Power User | Standard User | Read Only | Portal Member | Support Representative | Software Engineer | Rhythm Administrator |
|---|---|---|---|---|---|---|---|---|
| `committees.committees.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `crm.activities.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.activities.delete` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `crm.activities.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `crm.activity-types.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.activity-types.update` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.address-types.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.address-types.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.address-types.update` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.application.access` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `crm.contact-layouts.create` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contact-layouts.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contact-layouts.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `crm.contact-layouts.update` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contact-roles.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contact-roles.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contact-roles.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `crm.contact-types.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contact-types.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contact-types.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `crm.contacts.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contacts.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.contacts.query` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `crm.contacts.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `crm.contacts.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `crm.organization-types.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.organization-types.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.organization-types.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `crm.organizations.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.organizations.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.organizations.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `crm.organizations.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `crm.phone-number-types.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.phone-number-types.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.phone-number-types.update` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.regions.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `crm.regions.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `hq.audit.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.capacity.manage` | — | — | — | — | — | — | — | ✓ |
| `hq.custom-query-tables.assign` | — | — | — | — | — | — | ✓ | ✓ |
| `hq.custom-query-tables.author` | — | — | — | — | — | — | ✓ | ✓ |
| `hq.custom-query-tables.publish` | — | — | — | — | — | — | ✓ | ✓ |
| `hq.custom-query-tables.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.customers.create` | — | — | — | — | — | — | — | ✓ |
| `hq.customers.delete` | — | — | — | — | — | — | — | ✓ |
| `hq.customers.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.customers.update` | — | — | — | — | — | — | — | ✓ |
| `hq.data-exports.operate` | — | — | — | — | — | — | — | ✓ |
| `hq.data-exports.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.data-runs.manage` | — | — | — | — | — | — | — | ✓ |
| `hq.emergency-access.use` | — | — | — | — | — | — | — | ✓ |
| `hq.integrations.operate` | — | — | — | — | — | — | — | ✓ |
| `hq.integrations.publish` | — | — | — | — | — | — | — | ✓ |
| `hq.jobs.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.jobs.retry` | — | — | — | — | — | — | — | ✓ |
| `hq.licensing.manage` | — | — | — | — | — | — | — | ✓ |
| `hq.licensing.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.llm-usage.manage` | — | — | — | — | — | — | — | ✓ |
| `hq.llm-usage.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.llm-usage.read-evidence` | — | — | — | — | — | — | — | ✓ |
| `hq.notifications.operate` | — | — | — | — | — | — | — | ✓ |
| `hq.notifications.read` | — | — | — | — | — | — | — | ✓ |
| `hq.queries.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.roles.manage` | — | — | — | — | — | — | — | ✓ |
| `hq.roles.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.service-principals.manage` | — | — | — | — | — | — | — | ✓ |
| `hq.service-principals.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.snapshots.manage` | — | — | — | — | — | — | — | ✓ |
| `hq.snapshots.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.staff.disable` | — | — | — | — | — | — | — | ✓ |
| `hq.staff.invite` | — | — | — | — | — | — | — | ✓ |
| `hq.staff.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.staff.update` | — | — | — | — | — | — | — | ✓ |
| `hq.tenant-access.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.tenant-access.request` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.tenants.activate` | — | — | — | — | — | — | — | ✓ |
| `hq.tenants.provision` | — | — | — | — | — | — | — | ✓ |
| `hq.tenants.read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `hq.tenants.update` | — | — | — | — | — | — | — | ✓ |
| `platform.application.access` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.association-types.create` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.association-types.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.association-types.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.association-types.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.associations.create` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.associations.delete` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.associations.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.associations.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.attention.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.attention.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.attention.read-others` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.attention.resolve-manually` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.attention.use` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.audit-events.read` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-messages.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.communication-messages.read-content` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-messages.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.communication-suppressions.create` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-suppressions.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.communication-suppressions.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-templates.create` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-templates.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-templates.publish` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-templates.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.communication-templates.test-send` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communication-templates.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.communications.request` | — | — | — | — | — | — | — | ✓ |
| `platform.custom-fields.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-fields.create` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-fields.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-fields.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.custom-fields.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-objects.create` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-objects.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-objects.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.custom-objects.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-records.create` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.custom-records.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-records.export` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-records.history` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.custom-records.publish` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.custom-records.query` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.custom-records.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.custom-records.update` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.customers.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.customers.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.data-exports.download` | ✓ | — | — | — | — | — | — | — |
| `platform.data-exports.execute` | ✓ | — | — | — | — | — | — | — |
| `platform.data-exports.manage` | ✓ | — | — | — | — | — | — | — |
| `platform.data-exports.read` | ✓ | — | — | — | — | — | — | — |
| `platform.data-jobs.upload` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.eligibility-bindings.manage` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.eligibility.population` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.eligibility.publish` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.eligibility.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.eligibility.reconcile` | — | — | — | — | — | — | — | ✓ |
| `platform.eligibility.retire` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.eligibility.write` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.explorer-views.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.explorer-views.share` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.explorer-views.use` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.extension-bindings.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.extension-handlers.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.extension-handlers.test` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.extension-invocations.read` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.extension-points.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.extension-rules.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.field-labels.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.files.upload` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.integration-credentials.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.integration-executions.operate` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.integration-executions.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.integrations.invoke` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.integrations.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.integrations.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.jobs.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.layouts.create` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.layouts.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.layouts.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.layouts.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.llm-usage.read` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.metadata.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.notifications.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.notifications.publish` | — | — | — | — | — | — | — | ✓ |
| `platform.notifications.use` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.queries.generate` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.queries.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.query-schedules.external-recipients` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.query-schedules.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.query-schedules.use` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.quick-search-settings.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.quick-search-settings.rebuild` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.quick-search-settings.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.quick-search.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.record-views.create` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.record-views.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.reports.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.reports.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.reports.share` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.reports.use` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.responsibilities.delegate-own` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.responsibilities.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.responsibilities.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.saved-queries.manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.saved-queries.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.saved-queries.share` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.saved-queries.use` | ✓ | ✓ | ✓ | — | — | — | — | — |
| `platform.security-access.explain` | ✓ | — | — | — | — | — | — | — |
| `platform.security-access.manage` | ✓ | — | — | — | — | — | — | — |
| `platform.security-policies.manage` | ✓ | — | — | — | — | — | — | — |
| `platform.security-policies.read` | ✓ | — | — | — | — | — | — | — |
| `platform.security-roles.manage` | ✓ | — | — | — | — | — | — | — |
| `platform.security-roles.read` | ✓ | — | — | — | — | — | — | — |
| `platform.security-self.read` | — | — | — | — | — | — | — | — |
| `platform.snapshots.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.staff-access.manage` | ✓ | — | — | — | — | — | — | — |
| `platform.staff-access.read` | ✓ | — | — | — | — | — | — | — |
| `platform.tenant-applications.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.tenants.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.tenants.deletion-cancel` | — | — | — | — | — | — | — | ✓ |
| `platform.tenants.deletion-hold` | — | — | — | — | — | ✓ | — | ✓ |
| `platform.tenants.deletion-read` | — | — | — | — | — | ✓ | ✓ | ✓ |
| `platform.tenants.deletion-request` | — | — | — | — | — | — | — | ✓ |
| `platform.tenants.manage-commercial-link` | — | — | — | — | — | — | — | ✓ |
| `platform.tenants.manage-status` | — | — | — | — | — | — | — | ✓ |
| `platform.tenants.onboard` | — | — | — | — | — | — | — | ✓ |
| `platform.tenants.read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.tenants.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.users.bulk` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.users.change-password` | ✓ | ✓ | ✓ | — | ✓ | — | — | — |
| `platform.users.create` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.users.delete` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.users.manage-identities` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.users.manage-passwords` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.users.read` | ✓ | ✓ | ✓ | ✓ | ✓ | — | — | — |
| `platform.users.update` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.workflow-actions.automation-manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.workflow-actions.calendars-manage` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.workflow-actions.registry-read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.workflow-actions.registry-register` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.workflow-actions.runs-read` | ✓ | ✓ | ✓ | ✓ | — | — | — | — |
| `platform.workflow-actions.runs-resolve` | ✓ | ✓ | — | — | — | — | — | — |
| `platform.workflow-actions.templates-manage` | ✓ | ✓ | — | — | — | — | — | — |

## Protected Actions

Access administration checks delegation at the target scopes and refuses self-widening or a change that removes the required administrator coverage. Customer operations cannot create platform staff authority. Inviting a Rhythm Administrator needs the additional role-management authority.

Customer entry for staff requires the appropriate approved, standing or emergency grant and its scope and duration. Reading captured AI content additionally requires live customer clearance and audit completion. Workspace removal, activation and recovery remain constrained by their lifecycle state and reviewed decision requirements. A permission does not bypass those guards.

## Guards Distinguished From Permissions

Permissions admit an operation; guards determine whether the requested action is valid for the reached subject. Ownership, narrower record reach, current versions, lifecycle state, active staff clearance and delegation are guards. Dataset permissions are additional authority requirements, while workspace availability and application licensing are separate admission decisions. Platform and HQ are exempt from the application-access step.

The gateway uses a coarse cached admission result. Services evaluate the signed context and narrower restrictions for each request. Access changes can remain usable during the documented cache and context lifetimes; a successful flush request does not establish immediate eviction. The control findings preserve that limitation and the currently optional second factor for privileged sign-in.

## What People See When Refused

Unusable identity produces an unauthorized response. A known caller refused at the gateway receives a forbidden response with a coarse access, workspace or permission cause and the required keys. That explanation exposes no other person’s identity or grants. Record handlers can present an inaccessible record as not found, while workspace and application gates can provide their own unavailability explanation.

The console can hide a destination or leave an action disabled with a reason. Its explanations distinguish access that has not loaded, an explicit deny, a missing grant and a scope mismatch. Where a grant is missing, the person is directed to their administrator. A presentation check never substitutes for service enforcement, and individual screen contracts retain their own refusal states.