--- id: RESP-PFM title: Platform Responsibilities product_area: platform revision: 1 status: draft design_intent: proposed source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 modules: - module: MOD-PFM-CSH owns: - DOM-PFM-CSH-001 - DOM-PFM-CSH-002 - DOM-PFM-CSH-003 - DOM-PFM-CSH-004 exposes: operations: [] events: [] consumes: operations: - getMySecurityContext (MOD-PFM-SEC) - getMySecurityContextInTenant (MOD-PFM-SEC) - getMyApplications (MOD-PFM-SEC) - getCustomObjectsNavigation (MOD-PFM-MTD) - listCustomObjects (MOD-PFM-MTD) - listCustomApps (MOD-PFM-MTD) - listTenantApplicationsForTenant (specified here provisionally; computed by MOD-PFM-OPS) signals: - application refusal (in-browser; any 403 with an application code) delegates: - concern: Identity, sessions, context resolution, reachable workspaces and staff clearance to: MOD-PFM-SEC - concern: Application availability and licensing synchronization to: MOD-PFM-OPS - concern: Customer record definitions, custom apps and navigation placements to: MOD-PFM-MTD - concern: Search and saved-query tools hosted in the frame to: MOD-PFM-QRY - concern: Attention, covering responsibilities and personal responsibility work to: MOD-PFM-ELG - concern: Header notification and alert tools to: MOD-PFM-NOT - concern: Hosted assistant behavior and model invocation to: MOD-PFM-LLM - concern: Recent-record view history to: MOD-PFM-OPS - concern: Header financial working context to: MOD-ACC-BKS - concern: Custom-field capability to: 'none: the shell declares none (R2-ARCH-001)' - concern: Business-record history and persistence to: 'none: the shell writes no service record' - concern: Business pages hosted within console presentation to: the module that owns the records each page administers guarantees: - INV-DOM-PFM-CSH-001-01 - INV-DOM-PFM-CSH-001-02 - INV-DOM-PFM-CSH-001-03 - INV-DOM-PFM-CSH-001-04 - INV-DOM-PFM-CSH-002-01 - INV-DOM-PFM-CSH-002-02 - INV-DOM-PFM-CSH-002-04 - INV-DOM-PFM-CSH-003-01 - INV-DOM-PFM-CSH-003-02 - INV-DOM-PFM-CSH-003-03 - INV-DOM-PFM-CSH-003-05 - INV-DOM-PFM-CSH-004-01 - INV-DOM-PFM-CSH-004-02 - INV-DOM-PFM-CSH-004-05 - module: MOD-PFM-SEC owns: - DOM-PFM-SEC-001 - DOM-PFM-SEC-002 - DOM-PFM-SEC-003 exposes: operations: - createCustomer - listCustomers - getCustomer - updateCustomer - patchCustomer - deleteCustomer - createHqCustomer - listHqCustomers - getHqCustomer - patchHqCustomer - getMyAccess - getMySecurityContext - getMySecurityContextInTenant - getMyApplications - describePortalPool - onboardTenantPortal - listConsoleUsers - getConsoleUser - updateConsoleUserDetails - listCustomerInvitations - listConsoleUserAssignments - grantConsoleUserRole - checkSecurityGrant - checkTenantSecurityGrant - setConsoleUserRoleScope - listSecurityAuditEvents - explainConsoleUserPermissions - withdrawConsoleUserRole - listSecurityPolicies - getSecurityPolicy - createSecurityPolicy - patchSecurityPolicy - duplicateSecurityPolicy - validateSecurityPolicyRules - archiveSecurityPolicy - listSecurityRoles - getSecurityRole - createSecurityRole - patchSecurityRole - setSecurityRoleEligibility - duplicateSecurityRole - archiveSecurityRole - listSecurityRoleMembers - getCustomerPermissionCatalog - getPermissionCatalog - requestHqTenantAccess - listHqTenantAccessRequests - withdrawHqTenantAccessRequest - getHqEmergencyAccessReport - listHqServicePrincipals - suspendHqServicePrincipal - resumeHqServicePrincipal - openHqEmergencyAccess - listHqOwnAccessGrants - endHqOwnAccessGrant - listHqStaffMemberAccessGrants - endHqStaffMemberAccessGrant - listHqStaff - getHqStaffMember - listHqRoles - inviteHqStaff - resendHqStaffInvitation - suspendHqStaff - reinstateHqStaff - revokeHqStaff - listHqTenantRoles - inviteConsoleUser - inviteTenantMember - listTenantMembers - resendConsoleUserInvitation - revokeConsoleUser - suspendConsoleUser - reinstateConsoleUser - activateConsoleUser - resendInvitation - revokeUser - suspendUser - reinstateUser - activateUser - getInvitationSummary - acceptInvitation - beginGoogleAcceptance - completeGoogleAcceptance - getPortalContactMatch - startPortalContactChallenge - verifyPortalContactChallenge - declinePortalContactMatch - signUpPortalMember - signInPortalMember - startPortalPasswordReset - confirmPortalPasswordReset - verifyPortalEmail - resendPortalVerification - signOutPortalMember - listTenantStaffAccess - approveTenantStaffAccess - declineTenantStaffAccess - revokeTenantStaffAccess - giveTenantStaffAccess - resolveTenantUserNames - createUser - listUsers - getCurrentUser - getUser - updateUser - patchUser - deleteUser - listUserIdentities - linkCognitoIdentity - changePassword - resetOwnPassword - resetUserPassword - enterHqTenantLoading - activateHqTenant - resetHqTenant - getHqTenantReset - listMyHqTenantShortcuts - pinMyHqTenantShortcut - unpinMyHqTenantShortcut - recordMyHqTenantShortcutOpened - listTenantApplicationsForTenant - requestTenantDeletion - listTenantDeletionRequests - getTenantDeletionRequest - holdTenantDeletionRequest - releaseTenantDeletionRequest - cancelTenantDeletionRequest - resumeTenantDeletionSchedule - retryTenantPurge - createTenant - getTenantProvisioning - retryTenantProvisioning - initializeTenant - listTenants - getTenant - updateTenant - patchTenant - setTenantHubspotCompany - deleteTenant - getDefaultTenantForCustomer - listByCustomerId - listTenantsByParentId - listHqTenants - getHqTenant - getHqTenantEmailSender - patchHqTenant events: - platform.tenants.provisioning_completed - platform.tenants.provisioning_failed consumes: operations: - Bounded eligibility rule evaluation (MOD-PFM-ELG) - CRM candidate reads and contact creation, including declined-candidate review (MOD-CRM-ENT, MOD-CRM-DQ) - Licensing and application availability answers (MOD-PFM-OPS) - Participant lifecycle description, preparation, verification, reset, purge and inventory (each owning module) - Provisioning notifications and shared message delivery (MOD-PFM-NOT) signals: - Source-owned assignment synchronization from deriving services (MOD-CMT-CMT, MOD-PFM-ELG) - Provider pre-sign-up and post-confirmation callbacks delegates: - concern: Participant-owned workspace preparation and removal under the lifecycle protocol to: MOD-PFM-TNL (and each participating module), pending OQ-PFM-SEC-001 - concern: Initial-import execution admitted while loading to: MOD-PFM-DJE - concern: Durable jobs, reconciliation, licensing, application state and record-view history to: MOD-PFM-OPS - concern: Eligibility rules and batched subject evaluation to: MOD-PFM-ELG - concern: Message delivery and sender identities to: MOD-PFM-NOT - concern: Custom record types used by scoped grants to: MOD-PFM-MTD - concern: CRM contact records and likely-candidate matching to: MOD-CRM-ENT, MOD-CRM-DQ - concern: Appointment facts that supply derived authority to: MOD-CMT-CMT - concern: Console presentation, navigation and application gating to: MOD-PFM-CSH - concern: Custom-field designation and enabling registration to: 'none: no enabling declaration under R2-ARCH-001' - concern: Ordinary record history versus Security event retention to: 'none: Security owns its event writers and lifecycle records, with scoped purge retention' - concern: Model inference responsibilities to: 'none: no model invocation in the examined module' guarantees: - INV-DOM-PFM-SEC-001-01 - INV-DOM-PFM-SEC-001-02 - INV-DOM-PFM-SEC-001-03 - INV-DOM-PFM-SEC-001-04 - INV-DOM-PFM-SEC-001-05 - INV-DOM-PFM-SEC-001-06 - INV-DOM-PFM-SEC-001-07 - INV-DOM-PFM-SEC-002-01 - INV-DOM-PFM-SEC-002-02 - INV-DOM-PFM-SEC-002-03 - INV-DOM-PFM-SEC-002-04 - INV-DOM-PFM-SEC-002-05 - INV-DOM-PFM-SEC-002-06 - INV-DOM-PFM-SEC-002-07 - INV-DOM-PFM-SEC-002-08 - INV-DOM-PFM-SEC-002-09 - INV-DOM-PFM-SEC-002-10 - INV-DOM-PFM-SEC-002-11 - INV-DOM-PFM-SEC-002-12 - INV-DOM-PFM-SEC-003-01 - INV-DOM-PFM-SEC-003-02 - INV-DOM-PFM-SEC-003-03 - INV-DOM-PFM-SEC-003-04 - INV-DOM-PFM-SEC-003-05 - INV-DOM-PFM-SEC-003-06 - INV-DOM-PFM-SEC-003-07 - INV-DOM-PFM-SEC-003-08 - INV-DOM-PFM-SEC-003-09 - INV-DOM-PFM-SEC-003-10 - INV-DOM-PFM-SEC-003-11 - INV-DOM-PFM-SEC-003-12 - INV-DOM-PFM-SEC-003-13 - INV-DOM-PFM-SEC-003-14 - INV-DOM-PFM-SEC-003-15 - INV-DOM-PFM-SEC-003-16 - INV-DOM-PFM-SEC-003-17 - INV-DOM-PFM-SEC-003-19 - INV-DOM-PFM-SEC-003-21 examiner: codex examined_at: '2026-10-23' provenance: observed source: services-platform:modules/customers/aws/api/customers.routes.ts; modules/tenants/aws/api/tenants.routes.ts; modules/security/aws/api (route declarations); react-console:components/security, components/console/hq, components/auth/screens - module: MOD-PFM-MTD owns: - DOM-PFM-MTD-001 - DOM-PFM-MTD-002 - DOM-PFM-MTD-003 - DOM-PFM-MTD-004 - DOM-PFM-MTD-005 - DOM-PFM-MTD-006 exposes: operations: - getMetadataHealth - registerApplication - listFieldTypes - listObjects - describeObject - listCustomFields - createCustomField - getCustomField - updateCustomField - archiveCustomField - restoreCustomField - getCustomFieldRules - setCustomFieldRules - setFieldLabel - removeFieldLabel - getLayoutsHealth - createConsolePageLayout - listConsolePageLayouts - getConsolePageLayout - updateConsolePageLayout - patchConsolePageLayout - deleteConsolePageLayout - createPortalPageLayout - listPortalPageLayouts - getPortalPageLayout - updatePortalPageLayout - patchPortalPageLayout - deletePortalPageLayout - createConsoleForm - listConsoleForms - getConsoleForm - updateConsoleForm - patchConsoleForm - deleteConsoleForm - createPortalForm - listPortalForms - getPortalForm - updatePortalForm - patchPortalForm - deletePortalForm - getCustomObjectsHealth - listCustomObjects - getCustomObjectsNavigation - createCustomObject - getCustomObject - updateCustomObject - activateCustomObject - archiveCustomObject - restoreCustomObject - listCustomApps - createCustomApp - getCustomApp - updateCustomApp - archiveCustomApp - restoreCustomApp - listCustomObjectRecords - createCustomObjectRecord - getCustomObjectRecord - updateCustomObjectRecord - replaceCustomObjectRecord - deleteCustomObjectRecord - publishCustomObjectRecord - archiveCustomObjectRecord - restoreCustomObjectRecord - listCustomObjectRecordHistory - getCustomObjectRecordRevision - listCustomObjectRecordHistoryActors - getAssociationsHealth - listAssociationTypes - createAssociationType - getAssociationType - updateAssociationType - deleteAssociationType - listRecordAssociations - createAssociation - updateAssociation - deleteAssociation - endAssociation - submitAssociationDataJob - listAssociationDataJobs - getAssociationDataJob - listAssociationDataJobResults - listAssociationDataJobRejections - applyAssociationDataJob - pauseAssociationDataJob - resumeAssociationDataJob - cancelAssociationDataJob - retryAssociationDataJob - platform.apply_endpoint_deletion - platform.merge_plan_contacts - platform.merge_plan_organizations - platform.merge_apply_contacts - platform.merge_apply_organizations - getFilesHealth - issueFileUpload events: - objects.record.created - objects.record.updated - objects.record.archived - objects.record.restored - objects.record.published - objects.record.unpublished - objects.record.deleted - objects.association.created - objects.association.ended - objects.association.deleted consumes: operations: - Quick Search field degradation and rebuild requests (MOD-PFM-QRY) - generateQuery and getGeneratedQuery (MOD-PFM-QRY; consumed by SCR-PFM-MTD-014) - Data job engine submission, validation, apply and controls (MOD-PFM-DJE) - Tenant lifecycle reset and purge participation (MOD-PFM-TNL) - Shared asset pipeline preparation and attachment (macroservice-libraries) signals: - Owning services' registration manifests at deploy delegates: - concern: Native record values and enforcement of required fields when those records are saved to: each owning module (MOD-CRM-ENT for contacts and organizations) - concern: Selection and assignment of forms and page layouts to native records to: each purpose owner (MOD-CRM-ENT today) - concern: Roles, policies, scoped assignments and authority checks to: MOD-PFM-SEC - concern: Custom-record datasets, Explorer, indexing, generated queries and exports to: MOD-PFM-QRY - concern: Data-job execution, batching, reconciliation and controls to: MOD-PFM-DJE - concern: Event routing and configured delivery destinations to: MOD-PFM-INT - concern: Eligibility decisions referenced by portal rules to: MOD-PFM-ELG - concern: Coordination of workspace reset and deletion to: MOD-PFM-TNL - concern: Presentation of custom objects and applications in navigation to: MOD-PFM-CSH (consumes the navigation read) - concern: Custom-field capability (R2-ARCH-001) to: 'this module evaluates eligibility; its design objects declare none, while custom records store their declared fields' - concern: Record history to: 'this module captures custom-record changes; presentation of native-record relationship revisions belongs to MOD-CRM-ENT' - concern: Model inference to: 'MOD-PFM-QRY: the record list consumes query generation described by IOP-PFM-MTD-001; MOD-PFM-LLM executes the model operation' guarantees: - INV-DOM-PFM-MTD-001-01 - INV-DOM-PFM-MTD-001-02 - INV-DOM-PFM-MTD-001-04 - INV-DOM-PFM-MTD-001-06 - INV-DOM-PFM-MTD-002-01 - INV-DOM-PFM-MTD-002-02 - INV-DOM-PFM-MTD-002-03 - INV-DOM-PFM-MTD-002-07 - INV-DOM-PFM-MTD-003-01 - INV-DOM-PFM-MTD-003-04 - INV-DOM-PFM-MTD-003-05 - INV-DOM-PFM-MTD-004-01 - INV-DOM-PFM-MTD-004-03 - INV-DOM-PFM-MTD-004-09 - INV-DOM-PFM-MTD-005-01 - INV-DOM-PFM-MTD-005-03 - INV-DOM-PFM-MTD-005-08 - INV-DOM-PFM-MTD-005-09 - INV-DOM-PFM-MTD-005-10 - INV-DOM-PFM-MTD-006-02 - INV-DOM-PFM-MTD-006-03 - INV-DOM-PFM-MTD-006-04 - INV-DOM-PFM-MTD-006-08 - INV-DOM-PFM-MTD-006-10 - module: MOD-PFM-QRY owns: - DOM-PFM-QRY-001 - DOM-PFM-QRY-002 - DOM-PFM-QRY-003 - DOM-PFM-QRY-004 - DOM-PFM-QRY-005 - DOM-PFM-QRY-006 exposes: operations: - getDataExportCoverage - getDataExportsHealth - getDataExportDefinition - saveDataExportDefinition - addDataExportDestination - updateDataExportDestination - removeDataExportDestination - requestDataExportExecution - listDataExportExecutions - getDataExportExecution - getDataExportManifest - cancelDataExportExecution - downloadDataExportVolume - deleteDataExportArtifact - retryDataExportDelivery - listHqDataExportExecutions - getHqDataExportCoverage - getHqDataExportTenantCoverage - getHqDataExportEntitlements - reconcileCoverageAtActivation - dataExportsLifecycleParticipants - startExplorerNavigation - selectExplorerRecordIds - readExplorerNavigation - getExplorerViewPreferences - putExplorerViewPreferences - createExplorerView - listExplorerViews - getExplorerView - updateExplorerView - patchExplorerView - deleteExplorerView - getExplorerHealth - getQuickSearchHealth - issueQuickSearchAccess - listQuickSearchConfigurations - getQuickSearchConfiguration - listQuickSearchFields - replaceQuickSearchConfiguration - rebuildQuickSearchIndex - handleQuickSearchChangeEvents - runQuickSearchRebuild - runQuickSearchMaintenance - quickSearchLifecycleParticipant - getSnapshotsHealth - listSnapshotRunsInHq - getSnapshotRunInHq - getSnapshotPeriodStatusInHq - listOverdueSnapshotRunsInHq - requestSnapshotRunInHq - requestSnapshotBackfillInHq - listSnapshotPoliciesInHq - putSnapshotPolicyInHq - deleteSnapshotPolicyInHq - listSnapshotPeriods - planSnapshotRuns - dispatchSnapshotRuns - runSnapshot - snapshotsLifecycleParticipant - createCustomQueryTable - listCustomQueryTables - revalidateCustomQueryTables - getCustomQueryTable - updateCustomQueryTable - saveCustomQueryTableDraft - analyzeCustomQueryTableDraft - previewCustomQueryTable - publishCustomQueryTable - listCustomQueryTableVersions - getCustomQueryTableVersion - listCustomQueryTableAssignments - assignCustomQueryTable - pinCustomQueryTableAssignment - unassignCustomQueryTable - getCustomQueryTableUsage - listCustomQueryTableEvents - deprecateCustomQueryTable - disableCustomQueryTable - restoreCustomQueryTable - getQueriesHealth - listQueryDatasets - describeQueryDataset - runDatasetQuery - generateDatasetQuery - getQueryGeneration - validateDatasetQuery - resolveDateExpressions - listSystemQueryDatasets - describeSystemQueryDataset - runSystemDatasetQuery - validateSystemDatasetQuery - listSystemQueryRecipes - getSystemQueryRecipe - createSystemQueryRecipeDraft - listQueryRecipes - getQueryRecipe - createQueryRecipeDraft - runQueryRecipe - createSavedQuery - listSavedQueries - getSavedQuery - updateSavedQuery - deleteSavedQuery - runSavedQuery - createReport - listReports - getReport - updateReport - deleteReport - startReportExport - startQueryExport - getQueryExport - downloadQueryExport - downloadQueryExportByLink - listQuerySchedules - createQuerySchedule - getQuerySchedule - replaceQuerySchedule - deleteQuerySchedule - duplicateQuerySchedule - pauseQuerySchedule - resumeQuerySchedule - runQueryScheduleNow - takeQueryScheduleOwnership - useLatestScheduleQuery - getScheduleQueryChanges - listQueryScheduleRuns - previewQuerySchedule - listDeliveryTemplates - getDeliveryTemplateStarter - findRecipientUsers - registerQueryApplication - registerQueryRecipes - runQueryGeneration - reconcileQueryGenerations - dispatchQueryExports - runQueryExport - renderReportExport - dispatchSchedules - runScheduledDelivery - revalidateCustomQueryTablesNightly - pageSavedQueryRecordIds - marketingRecordIds - evaluateSubjectPredicates - queryLayerInProcess events: - communication request (purpose platform.queries.scheduled-report) - schedule run message - export queue message consumes: operations: - runOperation for queries.generate_query (MOD-PFM-LLM) - createPersonExecutionContext and evaluated grants (MOD-PFM-SEC) - submitCommunicationRequest (MOD-PFM-NOT) - storage connections and file-delivery binding adapter (MOD-PFM-INT) - workspace participant invocations (MOD-PFM-TNL) - durable job and recurrence libraries (MOD-PFM-OPS) signals: - 'CRM change events (contacts, organizations, addresses, affiliations)' - 'description table change (database trigger, no event bus)' - CRM configuration change (description stamp) delegates: - concern: >- Business records and owner declarations for querying, recipes, lookup, export coverage and snapshots to: >- the owning applications (MOD-CRM-ENT, Accounting, MOD-PFM-MTD for custom objects) - concern: >- Object vocabulary, workspace configuration and source custom-field declarations to: MOD-PFM-MTD - concern: Permission evaluation and named-person execution contexts to: MOD-PFM-SEC - concern: >- Provider requests, usage accounting, allowances and prompt registration to: MOD-PFM-LLM - concern: >- Template interpretation, outgoing messages and their delivery outcomes to: MOD-PFM-NOT - concern: External storage connections and destination bindings to: MOD-PFM-INT - concern: >- Common job execution, recurrence scheduling, viewed-record audit and allowance licensing to: MOD-PFM-OPS - concern: 'Workspace creation, removal and reset sequencing' to: MOD-PFM-TNL - concern: Custom-field support for this module’s own objects to: 'none: module objects expose no custom-field capability (R2-ARCH-001)' - concern: Business intake publication to: 'none: the module supplies no published intake binding (R2-ARCH-002)' - concern: Business-record history outside definition and execution ledgers to: >- none: definition versions and execution ledgers retain their own history guarantees: - INV-DOM-PFM-QRY-001-01 - INV-DOM-PFM-QRY-001-02 - INV-DOM-PFM-QRY-001-05 - INV-DOM-PFM-QRY-001-09 - INV-DOM-PFM-QRY-002-01 - INV-DOM-PFM-QRY-002-02 - INV-DOM-PFM-QRY-002-05 - INV-DOM-PFM-QRY-002-12 - INV-DOM-PFM-QRY-003-02 - INV-DOM-PFM-QRY-003-06 - INV-DOM-PFM-QRY-003-07 - INV-DOM-PFM-QRY-004-01 - INV-DOM-PFM-QRY-004-04 - INV-DOM-PFM-QRY-004-05 - INV-DOM-PFM-QRY-004-09 - INV-DOM-PFM-QRY-004-11 - INV-DOM-PFM-QRY-005-01 - INV-DOM-PFM-QRY-005-05 - INV-DOM-PFM-QRY-005-07 - INV-DOM-PFM-QRY-006-01 - INV-DOM-PFM-QRY-006-02 - INV-DOM-PFM-QRY-006-03 - module: MOD-PFM-INT owns: - DOM-PFM-INT-001 - DOM-PFM-INT-002 - DOM-PFM-INT-003 - DOM-PFM-INT-004 - DOM-PFM-INT-005 - DOM-PFM-INT-006 exposes: operations: - getExtensionsHealth - listExtensionPoints - getExtensionPoint - listEventTypes - getEventType - listExtensionHandlers - createExtensionHandler - getExtensionHandler - updateExtensionHandler - deleteExtensionHandler - testExtensionHandler - listExtensionBindings - createExtensionBinding - previewExtensionResolution - updateExtensionBinding - deleteExtensionBinding - listExtensionInvocations - getExtensionInvocation - registerServiceExtensions - getIntegrationsHealth - tryIntegrationConnectionCall - listIntegrationWebhookEndpoints - rotateIntegrationWebhookEndpoint - replayIntegrationWebhookEndpoint - listIntegrationWebhookEvents - getIntegrationWebhookEvent - replayIntegrationWebhookEvent - listIntegrationSubscriptions - createIntegrationSubscription - updateIntegrationSubscription - deleteIntegrationSubscription - replayIntegrationSubscription - listIntegrationDeliveries - getIntegrationDelivery - retryIntegrationDelivery - listIntegrationEvents - listIntegrationEventsEverywhere - invokeIntegrationCapabilityFromConsole - listIntegrationExecutions - getIntegrationExecution - listIntegrationExecutionAttempts - retryIntegrationExecution - cancelIntegrationExecution - resolveIntegrationExecution - listIntegrationExecutionsNeedingAttention - resetIntegrationCircuit - invokeIntegrationCapability - renewIntegrationLease - reportIntegrationExecutionProgress - completeIntegrationExecution - emitIntegrationEvents - getIntegrationSyncCursor - putIntegrationSyncCursor - listIntegrationCatalog - getIntegrationCatalogEntry - listIntegrationInstallations - createIntegrationInstallation - getIntegrationInstallation - updateIntegrationInstallation - suspendIntegrationInstallation - resumeIntegrationInstallation - uninstallIntegrationInstallation - listIntegrationConnections - createIntegrationConnection - getIntegrationConnection - listIntegrationConnectionNotices - updateIntegrationConnection - verifyIntegrationConnection - checkIntegrationConnectionHealth - reauthorizeIntegrationConnection - startIntegrationConnectionOauth - completeIntegrationOauth - getIntegrationConnectionCredential - putIntegrationConnectionCredential - suspendIntegrationConnection - resumeIntegrationConnection - disconnectIntegrationConnection - moveIntegrationConnectionBindings - updateIntegrationConnectionVersion - listIntegrationBindings - putIntegrationBinding - listIntegrationBindingRevisions - migrateIntegrationBindings - deleteIntegrationBinding - resolveIntegrationBinding - listIntegrationAuditEvents - getTenantIntegrationHealth - listStaffIntegrationCatalog - publishIntegrationVersion - deprecateIntegrationVersion - retireIntegrationVersion - setIntegrationAvailability - listIntegrationPlatformSecrets - putIntegrationPlatformSecret - registerIntegrationVersion - registerIntegrationEventConsumer - receiveIntegrationWebhook - queryIntegrationDataGrant - projectIntegrationDataGrant - getWorkflowActionsHealth - registerWorkflowActionsManifest - getWorkflowActionsTenantHealth - listWorkflowTriggerPoints - listWorkflowActionTypes - getWorkflowActionType - listWorkflowActionTemplates - createWorkflowActionTemplate - getWorkflowActionTemplate - replaceWorkflowActionTemplate - deleteWorkflowActionTemplate - listWorkflowTemplates - createWorkflowTemplate - getWorkflowTemplate - replaceWorkflowTemplate - deleteWorkflowTemplate - listBusinessCalendars - createBusinessCalendar - getBusinessCalendar - replaceBusinessCalendar - deleteBusinessCalendar - listAutomationRules - createAutomationRule - getAutomationRule - replaceAutomationRule - deleteAutomationRule - saveAutomationRuleDraft - publishAutomationRule - enableAutomationRule - disableAutomationRule - retireAutomationRule - listAutomationRuleVersions - listWorkflowActionRuns - listWorkflowTimers events: - rhythm.integration.execution.completed - Provider-produced integration event types - Subscription deliveries to adapters consumes: operations: - Remote batches from application-owned domain change streams - Read-only eligibility evaluation supplying rule facts - Security audit persistence and principal lookup signals: - Incoming provider requests addressed to registered endpoints - >- Deployment declarations for adapter releases, application consumers, customization and workflow registries delegates: - concern: 'Permission grants, authority evaluation, principals and security audit storage' to: MOD-PFM-SEC - concern: Workspace lifecycle orchestration invoking each service’s deletion or setup participant to: MOD-PFM-TNL - concern: Durable execution and monitoring of account checks to: MOD-PFM-OPS - concern: Rule fact evaluation and shared host-runtime datasets to: MOD-PFM-QRY - concern: Post-commit administrator mail and wider attention presentation to: 'MOD-PFM-NOT, MOD-PFM-ELG' - concern: Payment meaning and business interpretation of provider outcomes to: 'Accounting (MOD-ACC-TRX, MOD-ACC-BIL)' - concern: 'Host-owned action execution, run and timer history, retry and skip' to: 'Host applications, including MOD-SUB-SUB' - concern: 'Host-side handler selection, invocation and outcome recording' to: The applications that declare extension points - concern: Custom-field designation to: 'none: no object enables custom-field capabilities' - concern: Field-level change capture to: 'none: integration lifecycle history uses its event trail and Security audit storage' - concern: Language-model inference to: 'none: no scoped operation invokes a model' guarantees: - INV-DOM-PFM-INT-001-01 - INV-DOM-PFM-INT-001-02 - INV-DOM-PFM-INT-001-03 - INV-DOM-PFM-INT-001-04 - INV-DOM-PFM-INT-001-05 - INV-DOM-PFM-INT-001-06 - INV-DOM-PFM-INT-001-07 - INV-DOM-PFM-INT-001-08 - INV-DOM-PFM-INT-001-09 - INV-DOM-PFM-INT-001-10 - INV-DOM-PFM-INT-002-01 - INV-DOM-PFM-INT-002-02 - INV-DOM-PFM-INT-002-03 - INV-DOM-PFM-INT-002-04 - INV-DOM-PFM-INT-002-05 - INV-DOM-PFM-INT-002-06 - INV-DOM-PFM-INT-002-07 - INV-DOM-PFM-INT-002-08 - INV-DOM-PFM-INT-002-09 - INV-DOM-PFM-INT-002-10 - INV-DOM-PFM-INT-003-01 - INV-DOM-PFM-INT-003-02 - INV-DOM-PFM-INT-003-03 - INV-DOM-PFM-INT-003-04 - INV-DOM-PFM-INT-003-05 - INV-DOM-PFM-INT-003-06 - INV-DOM-PFM-INT-003-07 - INV-DOM-PFM-INT-003-08 - INV-DOM-PFM-INT-003-09 - INV-DOM-PFM-INT-003-10 - INV-DOM-PFM-INT-004-01 - INV-DOM-PFM-INT-004-02 - INV-DOM-PFM-INT-004-03 - INV-DOM-PFM-INT-004-04 - INV-DOM-PFM-INT-004-05 - INV-DOM-PFM-INT-004-06 - INV-DOM-PFM-INT-004-07 - INV-DOM-PFM-INT-004-08 - INV-DOM-PFM-INT-004-09 - INV-DOM-PFM-INT-005-01 - INV-DOM-PFM-INT-005-02 - INV-DOM-PFM-INT-005-03 - INV-DOM-PFM-INT-005-04 - INV-DOM-PFM-INT-005-05 - INV-DOM-PFM-INT-005-06 - INV-DOM-PFM-INT-005-07 - INV-DOM-PFM-INT-005-08 - INV-DOM-PFM-INT-005-09 - INV-DOM-PFM-INT-006-01 - INV-DOM-PFM-INT-006-02 - INV-DOM-PFM-INT-006-03 - INV-DOM-PFM-INT-006-04 - INV-DOM-PFM-INT-006-05 - INV-DOM-PFM-INT-006-06 - INV-DOM-PFM-INT-006-07 - INV-DOM-PFM-INT-006-08 - INV-DOM-PFM-INT-006-09 - module: MOD-PFM-NOT owns: - DOM-PFM-NOT-003 - DOM-PFM-NOT-004 - DOM-PFM-NOT-005 exposes: operations: - getNotificationsHealth - listMyNotifications - getMyNotificationSummary - getMyNotification - markMyNotificationRead - markMyNotificationUnread - archiveMyNotification - unarchiveMyNotification - markAllMyNotificationsRead - sendMyTestNotification - listNotificationHistory - listNotificationRequests - getNotificationRequest - getNotificationInstance - getNotificationDelivery - requestNotification - cancelNotificationRequest - listHqNotificationDefinitions - listHqTenantNotificationHistory - listHqTenantNotificationRequests - listHqNotificationDeadLetters - retryHqNotificationDelivery - registerServiceNotifications (IAM function platform_notifications_registration) - publishOrCancel (IAM function platform_notifications_request) - publishNotification and cancelNotification (producer library, in the producer's transaction) - nudgeNotificationsDispatcher (IAM invoke of platform_notifications_dispatcher) - getCommunicationsHealth - listCommunicationPurposes - listCommunicationTemplates - createCommunicationTemplate - getCommunicationTemplate - updateCommunicationTemplate - archiveCommunicationTemplate - validateCommunicationTemplate - previewCommunicationTemplate - testSendCommunicationTemplate - publishCommunicationTemplate - listCommunicationTemplateVersions - getCommunicationTemplateVersion - getCommunicationReadiness - listCommunicationMessages - getCommunicationMessage - getCommunicationMessageContent - cancelCommunicationMessage - listCommunicationRequests - getCommunicationRequest - requestCommunication - listCommunicationSuppressions - createCommunicationSuppression - releaseCommunicationSuppression - request (IAM operation of platform_communications_request) - submitCommunicationRequest (shared library, in the caller's transaction) - readiness, testSend and renderPreview (IAM operations) - saveOwnedTemplate, clearOwnedTemplate and getOwnedTemplates (IAM operations) - changedMessages (IAM operation) - storeMessageVersionTemplate (IAM function platform_communications_message_templates) - nudgeCommunicationsDispatcher (IAM invoke of platform_communications_dispatcher) events: [] consumes: operations: - Security account, role, permission and granted-support reads (MOD-PFM-SEC) - Current responsibility, delegate and fallback resolution (MOD-PFM-ELG) - Source-record field and merge-data discovery (MOD-PFM-MTD) - Shared job execution and monthly partition maintenance (MOD-PFM-OPS) - Workspace lifecycle orchestration and sender-read entry point (MOD-PFM-TNL) signals: - SES configuration-set events (send, delivery, delivery delay, bounce, complaint, reject, open, click) delegates: - concern: Authenticated identity, evaluated authority, workspace membership and staff grants to: MOD-PFM-SEC - concern: Business responsibility assignment and its notice publication to: MOD-PFM-ELG - concern: The shared header’s attention content to: MOD-PFM-ELG - concern: Customer-managed chat connections for future channels to: MOD-PFM-INT - concern: Business-record field definitions and custom merge values to: MOD-PFM-MTD - concern: Shared execution, partition maintenance and audit storage to: MOD-PFM-OPS - concern: Workspace provisioning and removal, including the HQ sender entry point to: MOD-PFM-TNL - concern: Customer extension of notification and communication records to: 'none: no enabling custom-field declaration is established in the examined scope' - concern: Retained notice and template change history to: 'none: the module retains its operational and publication history; some configuration changes use the shared audit stream' - concern: Model calls used by this module to: 'none: scoped notification and communication execution invokes no model' - concern: Externally published business events to: 'none: queues carry internal work and provider feedback rather than published business events' guarantees: - INV-DOM-PFM-NOT-003-01 - INV-DOM-PFM-NOT-003-02 - INV-DOM-PFM-NOT-003-03 - INV-DOM-PFM-NOT-003-04 - INV-DOM-PFM-NOT-003-05 - INV-DOM-PFM-NOT-003-06 - INV-DOM-PFM-NOT-003-07 - INV-DOM-PFM-NOT-003-08 - INV-DOM-PFM-NOT-003-09 - INV-DOM-PFM-NOT-003-11 - INV-DOM-PFM-NOT-004-01 - INV-DOM-PFM-NOT-004-03 - INV-DOM-PFM-NOT-004-04 - INV-DOM-PFM-NOT-005-01 - INV-DOM-PFM-NOT-005-02 - INV-DOM-PFM-NOT-005-04 - INV-DOM-PFM-NOT-005-06 - INV-DOM-PFM-NOT-005-07 - INV-DOM-PFM-NOT-005-08 - INV-DOM-PFM-NOT-005-10 - module: MOD-PFM-ELG owns: - DOM-PFM-ELG-001 - DOM-PFM-ELG-002 - DOM-PFM-ELG-003 - DOM-PFM-ELG-004 - DOM-PFM-ELG-005 exposes: operations: - getAttentionHealth - getMyAttentionSummary - listMyAttentionItems - getMyAttentionItem - acknowledgeMyAttentionItem - snoozeMyAttentionItem - unsnoozeMyAttentionItem - dismissMyAttentionItem - getMyAttentionPreferences - putMyAttentionPreferences - listAttentionItemsAboutRecord - listUserAttentionItems - listAttentionDefinitions - getAttentionDefinitionSettings - putAttentionDefinitionSettings - resolveAttentionItem - getEligibilityHealth - getEligibilityTenantHealth - listEligibilityConditionTypes - listEligibilityConsumerKinds - listEligibilityDefinitions - createEligibilityDefinition - getEligibilityDefinition - updateEligibilityDefinition - saveEligibilityDefinitionDraft - validateEligibilityDefinition - listEligibilityDefinitionVersions - getEligibilityDefinitionVersion - diffEligibilityDefinitionVersions - publishEligibilityDefinition - republishEligibilityDefinitionVersion - testEligibilityDefinition - getEligibilityDefinitionUsage - duplicateEligibilityDefinition - deprecateEligibilityDefinition - archiveEligibilityDefinition - deleteEligibilityDefinition - restoreEligibilityDefinition - migrateEligibilityDefinitionReferences - createEligibilityBinding - listEligibilityBindings - getEligibilityBinding - updateEligibilityBinding - deleteEligibilityBinding - getEligibilityBindingPlan - createEligibilityBindingForService - listEligibilityBindingsForService - getEligibilityBindingForService - updateEligibilityBindingForService - deleteEligibilityBindingForService - getEligibilityBindingPlanForService - evaluateEligibilityForService - evaluateEligibility - listEligibilityDecisions - getEligibilityDecision - startEligibilityPopulationRun - getEligibilityPopulationRun - startEligibilitySimulation - getEligibilitySimulation - requestEligibilityReconcile - getResponsibilitiesHealth - listResponsibilityDefinitions - getMyResponsibilities - getEffectiveResponsibilityHolders - listResponsibilityAssignments - createResponsibilityAssignment - endResponsibilityAssignment - removeResponsibilityRoleDefault - createResponsibilityDelegation - delegateAllMyResponsibilities - endResponsibilityDelegation - listUnassignedResponsibilities events: - 'Attention state audit events (acknowledged, snoozed, dismissed, escalated)' - 'Security audit events (read others, settings changed, item resolved manually)' - platform.attention.reminder communication requests - platform.eligibility.definition.published - eligibility.change (audit event) - CRM contact and organization change events - 'Responsibility notices (assigned, ended, delegated, delegation confirmed)' - Responsibility audit records consumes: operations: - 'Reporting predicates, projections and enumeration from Queries' - Role membership and recheck processing from Security - Object and subject custom-field declarations from Metadata - Transactional notice publication through Notifications - 'Current reminder acceptance through Communications, pending the approved Notifications migration' signals: - Registered CRM contact and organization streams; current registration is absent - Supported reference reassignment through the Platform record-merge participant delegates: - concern: 'Derived role grants, authorization checks and queued grant reconciliation' to: MOD-PFM-SEC - concern: Dataset interpretation and permitted reporting readers to: MOD-PFM-QRY - concern: Subject object registrations and custom-field declarations to: MOD-PFM-MTD - concern: Notice delivery and the approved reminder delivery boundary to: MOD-PFM-NOT - concern: Shared durable execution and partition maintenance to: MOD-PFM-OPS - concern: Workspace creation and deletion orchestration to: MOD-PFM-TNL - concern: Custom-field opt-in for these objects to: 'none: no examined object declares the opt-in capability' - concern: Transactional mutation history to: Each owning module writes its audit trail in the business transaction - concern: 'Provider condition meaning, source maintenance and use of qualification results' to: The applications responsible for the business records and consumer decisions - concern: Model calls to: 'none: all examined code paths are deterministic' guarantees: - INV-DOM-PFM-ELG-001-01 - INV-DOM-PFM-ELG-001-02 - INV-DOM-PFM-ELG-001-03 - INV-DOM-PFM-ELG-001-04 - INV-DOM-PFM-ELG-001-05 - INV-DOM-PFM-ELG-001-06 - INV-DOM-PFM-ELG-001-07 - INV-DOM-PFM-ELG-001-09 - INV-DOM-PFM-ELG-002-01 - INV-DOM-PFM-ELG-002-03 - INV-DOM-PFM-ELG-002-04 - INV-DOM-PFM-ELG-002-05 - INV-DOM-PFM-ELG-003-01 - INV-DOM-PFM-ELG-003-03 - INV-DOM-PFM-ELG-003-04 - INV-DOM-PFM-ELG-003-05 - INV-DOM-PFM-ELG-003-06 - INV-DOM-PFM-ELG-004-01 - INV-DOM-PFM-ELG-004-02 - INV-DOM-PFM-ELG-004-05 - INV-DOM-PFM-ELG-004-06 - INV-DOM-PFM-ELG-004-09 - INV-DOM-PFM-ELG-005-01 - INV-DOM-PFM-ELG-005-02 - INV-DOM-PFM-ELG-005-04 - INV-DOM-PFM-ELG-005-05 - INV-DOM-PFM-ELG-005-06 - INV-DOM-PFM-ELG-005-10 examiner: codex examined_at: '2026-10-23' provenance: observed source: >- services-platform:modules/eligibility/aws/api; services-platform:modules/responsibilities/aws/api/responsibilities.routes.ts; services-platform:modules/attention/aws/api/attention.routes.ts - module: MOD-PFM-OPS owns: - DOM-PFM-OPS-001 - DOM-PFM-OPS-002 - DOM-PFM-OPS-003 - DOM-PFM-OPS-004 exposes: operations: - getAuditHealth - recordRecordView - listMyRecordViews - listUserRecordViews - getJobsHealth - listJobs - countJobs - listJobKinds - getJob - listJobEvents - listJobsOfTenant - countJobsOfTenant - listJobKindsOfTenant - getJobOfTenant - listJobEventsOfTenant - listJobsInHq - countJobsInHq - listJobKindsInHq - getJobInHq - listJobEventsInHq - getLicensingHealth - getTenantLicensing - getHubspotCompanyLicensing - syncHubspotCompanyLicensing - getLicenceSyncHealth - createTenantLicenceOverride - revokeTenantLicenceOverride - suspendTenantApplication - resumeTenantApplication - retryTenantApplicationProvisioning - receiveHubspotWebhook - listTenantApplicationsForTenant events: [] consumes: operations: - submitAuthorizerFlushJob (MOD-PFM-SEC) - recordSecurityAuditEvent (MOD-PFM-SEC) - initializeTenant for a declared participant (MOD-PFM-SEC; participant work belongs to each owner) - 'Visit-target datasets (MOD-PFM-QRY, MOD-CRM-ENT, MOD-CMT-CMT)' - Company-link changes request synchronization (MOD-PFM-SEC) signals: - 'External commercial contract notifications and reads, enabled by provider configuration' delegates: - concern: 'Workspace identity, workspace type, commercial company linkage, authorization and security history' to: MOD-PFM-SEC - concern: 'Domain-owned job tables, execution tasks, submission authority and failure effects' to: the module that owns the kind - concern: Recent-record presentation and query datasets for jobs to: MOD-PFM-QRY - concern: Administration and enforcement of export allowances to: MOD-PFM-QRY - concern: Application preparation by registered participants to: the services that own each application's participants - concern: Mail transport for requester outcomes to: Shared mail transport; future notification ownership remains with MOD-PFM-NOT - concern: Custom-field support to: 'none: module records have no declared custom-field capability (R2-ARCH-001)' - concern: Model invocation to: 'none: no examined execution path invokes a model' guarantees: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-002-01 - INV-DOM-PFM-OPS-002-02 - INV-DOM-PFM-OPS-002-04 - INV-DOM-PFM-OPS-002-05 - INV-DOM-PFM-OPS-003-03 - INV-DOM-PFM-OPS-003-05 - INV-DOM-PFM-OPS-003-08 - INV-DOM-PFM-OPS-004-04 - INV-DOM-PFM-OPS-004-06 - module: MOD-PFM-DJE owns: - DOM-PFM-DJE-001 - DOM-PFM-DJE-003 - DOM-PFM-DJE-004 - DOM-PFM-DJE-005 - DOM-PFM-DJE-006 exposes: operations: - getCapacityHealth - getCapacityStatePin - pinCapacityState - unpinCapacityState - submitContactDataJob - listContactDataJobs - getContactDataJob - listContactDataJobMappingTargets - readContactsBySourceKey - listContactDataJobResults - listContactDataJobRejections - applyContactDataJob - rollbackContactDataJob - pauseContactDataJob - resumeContactDataJob - cancelContactDataJob - retryContactDataJob - revalidateContactDataJobConflicts - submitOrganizationDataJob - listOrganizationDataJobs - getOrganizationDataJob - listOrganizationDataJobMappingTargets - readOrganizationsBySourceKey - listOrganizationDataJobResults - listOrganizationDataJobRejections - applyOrganizationDataJob - rollbackOrganizationDataJob - pauseOrganizationDataJob - resumeOrganizationDataJob - cancelOrganizationDataJob - retryOrganizationDataJob - revalidateOrganizationDataJobConflicts - submitContactTypesDataJob - listContactTypesDataJobs - getContactTypesDataJob - readContactTypesBySourceKey - listContactTypesDataJobResults - listContactTypesDataJobRejections - applyContactTypesDataJob - pauseContactTypesDataJob - resumeContactTypesDataJob - cancelContactTypesDataJob - retryContactTypesDataJob - revalidateContactTypesDataJobConflicts - submitContactRolesDataJob - listContactRolesDataJobs - getContactRolesDataJob - readContactRolesBySourceKey - listContactRolesDataJobResults - listContactRolesDataJobRejections - applyContactRolesDataJob - pauseContactRolesDataJob - resumeContactRolesDataJob - cancelContactRolesDataJob - retryContactRolesDataJob - revalidateContactRolesDataJobConflicts - submitOrganizationTypesDataJob - listOrganizationTypesDataJobs - getOrganizationTypesDataJob - readOrganizationTypesBySourceKey - listOrganizationTypesDataJobResults - listOrganizationTypesDataJobRejections - applyOrganizationTypesDataJob - pauseOrganizationTypesDataJob - resumeOrganizationTypesDataJob - cancelOrganizationTypesDataJob - retryOrganizationTypesDataJob - revalidateOrganizationTypesDataJobConflicts - submitAddressTypesDataJob - listAddressTypesDataJobs - getAddressTypesDataJob - readAddressTypesBySourceKey - listAddressTypesDataJobResults - listAddressTypesDataJobRejections - applyAddressTypesDataJob - pauseAddressTypesDataJob - resumeAddressTypesDataJob - cancelAddressTypesDataJob - retryAddressTypesDataJob - revalidateAddressTypesDataJobConflicts - submitPhoneNumberTypesDataJob - listPhoneNumberTypesDataJobs - getPhoneNumberTypesDataJob - readPhoneNumberTypesBySourceKey - listPhoneNumberTypesDataJobResults - listPhoneNumberTypesDataJobRejections - applyPhoneNumberTypesDataJob - pausePhoneNumberTypesDataJob - resumePhoneNumberTypesDataJob - cancelPhoneNumberTypesDataJob - retryPhoneNumberTypesDataJob - revalidatePhoneNumberTypesDataJobConflicts - submitRegionsDataJob - listRegionsDataJobs - getRegionsDataJob - readRegionsBySourceKey - listRegionsDataJobResults - listRegionsDataJobRejections - applyRegionsDataJob - pauseRegionsDataJob - resumeRegionsDataJob - cancelRegionsDataJob - retryRegionsDataJob - revalidateRegionsDataJobConflicts - submitActivityTypesDataJob - listActivityTypesDataJobs - getActivityTypesDataJob - readActivityTypesBySourceKey - listActivityTypesDataJobResults - listActivityTypesDataJobRejections - applyActivityTypesDataJob - pauseActivityTypesDataJob - resumeActivityTypesDataJob - cancelActivityTypesDataJob - retryActivityTypesDataJob - revalidateActivityTypesDataJobConflicts - submitActivitiesDataJob - listActivitiesDataJobs - getActivitiesDataJob - readActivitiesBySourceKey - listActivitiesDataJobResults - listActivitiesDataJobRejections - applyActivitiesDataJob - pauseActivitiesDataJob - resumeActivitiesDataJob - cancelActivitiesDataJob - retryActivitiesDataJob - revalidateActivitiesDataJobConflicts - getDataJobsHealth - openDataJobUpload - presignDataJobUploadParts - getDataJobUpload - completeDataJobUpload - abortDataJobUpload - listDataJobUploads - registerDataRun - listDataRuns - getDataRun - listDataRunSteps - startDataRun - pauseDataRun - resumeDataRun - cancelDataRun - submitCustomFieldDataJob - listCustomFieldDataJobs - getCustomFieldDataJob - readCustomFieldsBySourceKey - listCustomFieldDataJobResults - listCustomFieldDataJobRejections - applyCustomFieldDataJob - pauseCustomFieldDataJob - resumeCustomFieldDataJob - cancelCustomFieldDataJob - retryCustomFieldDataJob - submitCustomObjectRecordDataJob - listCustomObjectRecordDataJobs - getCustomObjectRecordDataJob - listCustomObjectRecordDataJobResults - listCustomObjectRecordDataJobRejections - applyCustomObjectRecordDataJob - pauseCustomObjectRecordDataJob - resumeCustomObjectRecordDataJob - cancelCustomObjectRecordDataJob - retryCustomObjectRecordDataJob events: [] consumes: operations: - >- In-process record saves, deletion and rollback planning from MOD-CRM-ENT, MOD-CRM-REG, MOD-CRM-ACT and MOD-PFM-MTD - Workspace load status and reset coordination from MOD-PFM-TNL - Bulk execution orchestration and reconciliation from MOD-PFM-OPS - Fresh submitter execution context and grants from MOD-PFM-SEC signals: - Published capacity bulk factor for adopting-service admission delegates: - concern: 'Domain validation, revisions, record events and derived values' to: >- Record owners: MOD-CRM-ENT, MOD-CRM-REG, MOD-CRM-ACT, MOD-PFM-MTD and MOD-MBR-STR - concern: Custom-field registration to: >- none for engine objects; domain owners register eligible record fields under R2-ARCH-001 - concern: 'Identity, grants and staff authorization' to: MOD-PFM-SEC - concern: 'Workspace load, reset and activation' to: MOD-PFM-TNL - concern: Durable orchestration and reconciliation to: MOD-PFM-OPS - concern: 'Duplicate matching, merges and mapping redirection' to: MOD-CRM-DQ - concern: Result delivery and record exports to: MOD-PFM-QRY - concern: Data Management shell navigation to: MOD-PFM-CSH - concern: Completion notification to: 'undecided: OQ-PFM-DJE-007' - concern: Submissions eligibility declaration to: none published; operation contracts retain reasons under R2-ARCH-002 - concern: Model inference to: none; examined execution paths contain no model calls guarantees: - INV-DOM-PFM-DJE-001-01 - INV-DOM-PFM-DJE-001-02 - INV-DOM-PFM-DJE-001-03 - INV-DOM-PFM-DJE-001-06 - INV-DOM-PFM-DJE-001-07 - INV-DOM-PFM-DJE-001-08 - INV-DOM-PFM-DJE-001-09 - INV-DOM-PFM-DJE-001-10 - INV-DOM-PFM-DJE-001-11 - INV-DOM-PFM-DJE-001-12 - INV-DOM-PFM-DJE-003-02 - INV-DOM-PFM-DJE-003-04 - INV-DOM-PFM-DJE-003-05 - INV-DOM-PFM-DJE-004-01 - INV-DOM-PFM-DJE-004-03 - INV-DOM-PFM-DJE-004-05 - INV-DOM-PFM-DJE-005-01 - INV-DOM-PFM-DJE-005-03 - INV-DOM-PFM-DJE-005-06 - INV-DOM-PFM-DJE-005-07 - INV-DOM-PFM-DJE-006-03 - INV-DOM-PFM-DJE-006-04 - INV-DOM-PFM-DJE-006-06 - module: MOD-PFM-LLM owns: - DOM-PFM-LLM-001 - DOM-PFM-LLM-002 - DOM-PFM-LLM-003 - DOM-PFM-LLM-004 - DOM-PFM-LLM-005 exposes: operations: - getHqLlmUsageSummary - getHqLlmUsageTrend - listHqLlmUsageTenants - getHqLlmUsageBreakdown - listHqLlmUsageExecutions - getHqLlmUsageCatalog - getHqLlmUsageRates - getHqTenantLlmUsage - listHqTenantLlmUsagePeriods - listHqTenantLlmUsageInvocations - getHqTenantLlmUsageInvocation - getHqTenantLlmUsageInvocationEvidence - listHqTenantLlmUsageExecutions - getHqTenantLlmUsageExecution - getHqTenantLlmUsageLimits - listHqTenantLlmUsageOverrides - listHqTenantLlmUsageAdjustments - listHqTenantLlmUsageCrossings - listHqTenantLlmUsageAudit - explainHqTenantLlmUsageInvocation - putHqTenantLlmUsageLimits - previewHqTenantLlmUsageLimits - createHqTenantLlmUsageAdjustment - grantHqTenantLlmUsageOverride - previewHqTenantLlmUsageOverride - revokeHqTenantLlmUsageOverride - getLlmUsageSummary - listLlmUsageFeatures - runOperation - withLlmExecution - providerFor - materializeLlmCatalog - runLlmReconciliation - 'llmParticipant (provision, verifyProvisioned, purge, inventory)' - listAgentProjects (GET /api/agent/projects) - createAgentProject (POST /api/agent/projects) - 'updateAgentProject (PATCH /api/agent/projects/{id})' - 'deleteAgentProject (DELETE /api/agent/projects/{id})' - listAgentConversations (GET /api/agent/conversations) - createAgentConversation (POST /api/agent/conversations) - 'getAgentConversation (GET /api/agent/conversations/{id})' - 'updateAgentConversation (PATCH /api/agent/conversations/{id})' - 'deleteAgentConversation (DELETE /api/agent/conversations/{id})' - >- postAgentConversationMessages (POST /api/agent/conversations/{id}/messages) events: [] consumes: operations: - >- activeStaffAccessGrant, administratorRecipients and recordSecurityAuditEvent (MOD-PFM-SEC) - >- operational organization list and organization time zones (MOD-PFM-SEC, MOD-PFM-TNL) - workspace lifecycle participant steps (MOD-PFM-TNL) - reporting datasets over the AI views (MOD-PFM-QRY) - >- Describe With AI generation, from the Jazz AI query refinement (MOD-PFM-QRY) delegates: - concern: Feature-specific question construction and answer validation to: the consuming module (today MOD-PFM-QRY for Describe With AI) - concern: >- Staff authority, access windows, administrative audiences and audit storage to: MOD-PFM-SEC - concern: Email transport and future notice delivery to: MOD-PFM-NOT - concern: Usage datasets and reusable reports to: MOD-PFM-QRY - concern: Organization purge orchestration to: MOD-PFM-TNL - concern: Hosting of the organization’s HQ page to: MOD-PFM-SEC - concern: Customer-defined field registration to: No designated object enables this capability. - concern: Business-record change history to: >- Security retains AI control audit; these records do not declare business change-history capture. - concern: Provider execution and consumed model questions to: >- The foundation executes declared requests; consumer modules define their model questions. This module also describes the direct general reply and consumed refinement. - concern: Durable conversation ownership to: >- Product has not selected durable ownership; the console retains prototype memory today. guarantees: - INV-DOM-PFM-LLM-001-01 - INV-DOM-PFM-LLM-001-02 - INV-DOM-PFM-LLM-001-03 - INV-DOM-PFM-LLM-001-05 - INV-DOM-PFM-LLM-001-06 - INV-DOM-PFM-LLM-001-08 - INV-DOM-PFM-LLM-001-12 - INV-DOM-PFM-LLM-002-01 - INV-DOM-PFM-LLM-002-02 - INV-DOM-PFM-LLM-002-04 - INV-DOM-PFM-LLM-003-01 - INV-DOM-PFM-LLM-003-02 - INV-DOM-PFM-LLM-003-05 - INV-DOM-PFM-LLM-003-07 - INV-DOM-PFM-LLM-003-09 - INV-DOM-PFM-LLM-003-11 - INV-DOM-PFM-LLM-004-01 - INV-DOM-PFM-LLM-004-04 - INV-DOM-PFM-LLM-004-05 - INV-DOM-PFM-LLM-004-06 - INV-DOM-PFM-LLM-005-03 - module: MOD-PFM-TNL owns: - DOM-PFM-TNL-001 - DOM-PFM-TNL-002 - DOM-PFM-TNL-003 - DOM-PFM-TNL-004 - DOM-PFM-TNL-005 exposes: operations: - createTenant - getTenantProvisioning - retryTenantProvisioning - initializeTenant - deleteTenant - requestTenantDeletion - listTenantDeletionRequests - getTenantDeletionRequest - holdTenantDeletionRequest - releaseTenantDeletionRequest - cancelTenantDeletionRequest - resumeTenantDeletionSchedule - retryTenantPurge - enterHqTenantLoading - activateHqTenant - resetHqTenant - getHqTenantReset - describe - provision - verifyProvisioned - purge - inventory - reset - initialize - export - reconcileBaseline events: - platform.tenants.provisioning_completed - platform.tenants.provisioning_failed consumes: operations: - job engine submission, retry, reconciler and requester notices (MOD-PFM-OPS) - authorizer flush job and grant evaluation (MOD-PFM-SEC) - sender identity validation and creation (MOD-PFM-NOT) - system notification publication (MOD-PFM-NOT) delegates: - concern: Administrative workspace records and HQ browsing to: MOD-PFM-SEC - concern: Authority and staff access to: MOD-PFM-SEC - concern: Durable execution and job inspection to: MOD-PFM-OPS - concern: Import execution to: MOD-PFM-DJE - concern: Whole-package export coordination to: MOD-PFM-QRY - concern: Sender identities and general notifications to: MOD-PFM-NOT - concern: Application business records to: each owning application module - concern: Custom-field capability remains undeclared in this design to: 'none: no lifecycle object declares the capability (R2-ARCH-001)' - concern: Lifecycle decision history to: 'none: lifecycle history is the module''s own job, request and notice records; purges suppress change capture' - concern: Configurable intake publication to: 'none: every operation is staff-only or internal (R2-ARCH-002)' - concern: Model execution to: 'none: no path asks a model' guarantees: - INV-DOM-PFM-TNL-001-01 - INV-DOM-PFM-TNL-001-02 - INV-DOM-PFM-TNL-001-03 - INV-DOM-PFM-TNL-001-04 - INV-DOM-PFM-TNL-001-05 - INV-DOM-PFM-TNL-001-06 - INV-DOM-PFM-TNL-001-07 - INV-DOM-PFM-TNL-001-08 - INV-DOM-PFM-TNL-002-01 - INV-DOM-PFM-TNL-002-02 - INV-DOM-PFM-TNL-002-03 - INV-DOM-PFM-TNL-002-04 - INV-DOM-PFM-TNL-002-05 - INV-DOM-PFM-TNL-002-06 - INV-DOM-PFM-TNL-002-07 - INV-DOM-PFM-TNL-003-01 - INV-DOM-PFM-TNL-003-02 - INV-DOM-PFM-TNL-003-03 - INV-DOM-PFM-TNL-003-04 - INV-DOM-PFM-TNL-003-05 - INV-DOM-PFM-TNL-003-06 - INV-DOM-PFM-TNL-003-07 - INV-DOM-PFM-TNL-003-08 - INV-DOM-PFM-TNL-004-01 - INV-DOM-PFM-TNL-004-02 - INV-DOM-PFM-TNL-004-03 - INV-DOM-PFM-TNL-004-04 - INV-DOM-PFM-TNL-004-05 - INV-DOM-PFM-TNL-004-06 - INV-DOM-PFM-TNL-005-01 - INV-DOM-PFM-TNL-005-02 - INV-DOM-PFM-TNL-005-03 - INV-DOM-PFM-TNL-005-04 - INV-DOM-PFM-TNL-005-05 - INV-DOM-PFM-TNL-005-06 - INV-DOM-PFM-TNL-005-07 - INV-DOM-PFM-TNL-005-08 - INV-DOM-PFM-TNL-005-09 - INV-DOM-PFM-TNL-005-10 evidence: - 'rhythm-v2-docs: specs/PRODUCT-AREAS.md (Platform module rows); specs/platform/*/MODULE.md (the other Platform modules have planning layers only; their rows are added when their design lands).' - 'react-console at baf6dae and services-platform at ad3f6a6: as read for the Console shell design layer.' - 'services-platform at ad3f6a65 and react-console at baf6dae: as read for the Security, Customers and Workspaces design layer (modules/security, modules/tenants, modules/customers; the Security, sign-in and HQ pages).' - >- rhythm-v2-docs: specs/PRODUCT-AREAS.md (Platform module rows); specs/platform/*/MODULE.md (the other Platform modules have planning layers only; their rows are added when their design lands). - >- services-platform at ad3f6a6 and react-console at baf6dae: as read for the Metadata, custom fields, layouts and custom objects design layer (modules/metadata, layouts, custom-objects, associations, files). - >- react-console at baf6dae and services-platform at ad3f6a6: as read for the Console shell design layer. - >- rhythm-v2-docs: specs/PRODUCT-AREAS.md (Platform module rows); specs/platform/*/MODULE.md (the other Platform modules have planning layers only; their rows are added when their design lands). - >- services-platform at ad3f6a6: modules/queries, explorer, quick-search, snapshots and data-exports, as read for the Queries design layer (specs/platform/queries/design). - >- react-console at baf6dae and services-platform at ad3f6a6: as read for the Console shell design layer. - 'services-platform:modules/notifications; modules/communications; react-console:components/notifications (notification design examination).' - 'services-platform at ad3f6a6 and react-console at baf6dae: Eligibility, Responsibilities and Attention design examination.' - >- rhythm-v2-docs: specs/PRODUCT-AREAS.md (Platform module rows); specs/platform/*/MODULE.md (Platform modules without a design layer gain their rows when their design lands). - >- services-platform at ad3f6a6, macroservice-libraries at 54536a4 and react-console at baf6dae: as read for the Operations design layer (modules/jobs, modules/audit, modules/licensing, packages/jobs and the Maintenance and Rhythm HQ job and licensing screens). - >- services-platform at ad3f6a6 and react-console at baf6dae: as read for the LLM and AI teammate design layer (modules/llm, docs/llm.md and its records; the Jazz AI routes, store and screens; the Rhythm HQ AI Usage pages). - 'services-platform at ad3f6a65 (modules/tenants lifecycle routes, services, jobs, scripts) and services-crm, services-commerce, services-committees, services-membership, services-submissions, services-websites, services-marketing at their pinned commits (modules/tenant-lifecycle): as read for the Workspace lifecycle design layer.' --- # Platform Responsibilities ## How the Product Area Is Divided Platform supplies the shared foundation for application work. Its modules separate identity and workspace authority, console presentation, metadata, queries, integrations, attention, notifications, operational jobs, data jobs, inference and workspace lifecycle. This document records the console-shell and security divisions; other modules gain ownership rows when their design is authored. ## Console Shell and Navigation The shell owns four presentation designs: the common frame, navigation, console addresses and application-access presentation. It also specifies start-up and refusal states, workspace entry and switching, compatibility redirects and the read-only Applications overview. These client objects have no business tables, and the shell exposes no service operation. Security supplies identity and authority. Metadata supplies customer record placements. Operations owns the licensing computation behind the workspace application answer. The consumed administrative read is documented here provisionally, with its eventual home retained as an ownership finding. An in-browser refusal signal can request a fresh personal application list. Production pages wait for an answered context, and workspace content waits for a matching selected workspace. Entry clears shared SWR data and remounts the keyed subtree. Switching removes record identities from the address. Application checks precede page-permission checks where the route or page guard classifies the application. Navigation filtering never replaces the service’s own authority. ## Security, Customers and Workspaces Security owns the three planning objects: Customer, Workspace and User Account. The account design retains separate membership, definition, assignment and staff-grant aggregates. Customers owns the organization record, Workspaces owns readiness and staff lifecycle intent, and the Security service owns identity and evaluated authority. Machine principals and Security events belong to the same module. The operation and notification inventories agree with the three Service Contracts. The object invariants identify the guarantees and their enforcement limits; unknown concurrency and history protections remain findings. Fresh authority, gateway decisions, signed contexts, availability and external provider state have separate consistency bounds. None of the examined operations declares a Submissions binding or custom-field capability, and no module path invokes a model. ## Metadata, Custom Fields, Layouts and Custom Objects Metadata owns registered record descriptions, customer-defined fields and their rules, labels, forms, page layouts, custom applications and custom record types. It evaluates registered capabilities to determine which configuration operations are available. Record owners choose assignments for native records and store their field values; Metadata stores custom records, their relationships, change history and business-event ledger. Files provides upload staging, while custom-record saves attach prepared assets. Relationship deletion and merge functions allow native-record owners to apply link rules inside the caller's transaction. Registration commits each manifest atomically and retains missing definitions, but overlapping manifest calls have no application-wide serialization guarantee. Custom-record persistence enforces active definitions, typed values and transactional history capture. Supported changes append business events in the same transaction; delivery and search updates complete later. Composite screen saves, external asset cleanup and routed delivery need their documented failure boundaries. No operation is published to Submissions. The record list consumes generated queries through Queries, which delegates model execution to the shared inference foundation. ## Questions, Record Exploration and Data Delivery Queries realizes the six planning concepts through query, Explorer, Quick Search, snapshot and workspace export services. It retains reusable definitions, derived results and execution history while source applications retain their business records. The ownership and exposed-operation rows identify the facet boundaries. Person-requested queries and deliveries use the requester or schedule owner context; maintenance, search indexing, snapshot generation and staff validation use their dedicated execution boundaries. Queue consumers produce files and recurring deliveries, while durable jobs coordinate search rebuilds and snapshot attempts. Workspace package generation has no deployed runner, and its console integration remains defective. Applications declare source vocabulary and processing interfaces. Metadata, Security, the LLM foundation, Communications, Integrations, Operations and workspace lifecycle each retain their delegated responsibilities. This module’s objects declare no custom fields, and its operations publish no Submissions bindings. ## Integrations, Extensions and Workflow Actions Six planning objects retain their numbers across three service boundaries. Integrations owns provider offers and installations, account links and credentials, capability execution and binding history, and message receipt and delivery. Extensions owns customization declarations, handlers, scoped bindings and invocation history. Workflow configuration owns reusable templates, calendars, automation and registry declarations; host applications retain their runtime records. The operation inventory covers administration, provider invocation, adapter callbacks, incoming provider requests and deployment registration. Completion and interpreted provider events reach registered application consumers, while subscriptions send declared domain changes to adapters. Shared views expose host-owned runs and timers without transferring their ownership. The invariant references identify each object’s guarantees and enforcement limits. External secret writes, repeated transport, reconciliation and material retained after workspace deletion remain explicit findings. The examined services do not publish intake bindings, enable custom fields or call a language model. ## Staff Notifications and Association Communications Notifications owns application declarations, staff request processing, personal notices and their channel history. Communications owns association content publication, recipient mail, provider outcomes and address protection. The three owned objects cover those separate records, including stored configuration for later notification channels. The notification service exposes personal inbox operations, administrative history, authorized support reads and producer publication. The communication service exposes content authoring, sending requests, outcome inspection and suppression management. Its provider feedback is an external input; the work queues remain internal transport. Both services perform no model inference. Business owners determine the communication trigger and source data. Security supplies identity and authority, Eligibility supplies responsibility audiences, Metadata supplies merge-field definitions, and Operations and workspace lifecycle supply shared execution. The contract and invariant rows retain the exact ownership boundaries and implementation limits, including incomplete recovery and audit behavior. ## Eligibility, Responsibilities and Attention Five domain designs describe rules and vocabulary, consumer uses, decisions and run records, accountability, and attention occurrences. Eligibility, Responsibilities and Attention are their three owning service modules within Platform. Eligibility explains qualification and requests role refresh while Security maintains grants. Responsibilities resolves effective accountability without granting access. Attention stores provider conditions, resolves current audiences and maintains personal responses independently of occurrence lifecycle. Providers retain their business-record meaning and transactional source writes. The operation inventory lists all seventy-two contracted routes. Mutation concurrency and history protections differ by path, so the object invariants state their actual limits. Post-commit work has partial scheduled repair, with no recovery for lost display history. The examined registrations enable no custom fields, publish no domain intake to Submissions and invoke no model. ## Jobs, Audit and Licensing Operations owns the common account of background work, workspace record activity, commercial licence standing and application readiness. The shared engine records execution history while each job owner supplies its domain tasks and recovery effects. Platform reconciles its own jobs on a five-minute schedule and combines published service views for customer, workspace and HQ monitoring. Requester messages record delivery outcomes without guaranteeing a further attempt after failure. Record visits and other owners’ activity use a shared append-only store with workspace isolation. Licensing retains reasoned staff overrides and local commercial coverage, coordinates declared application preparation and computes availability for Security. Database decisions commit before security history and cache-refresh requests; failed follow-up can leave those later effects incomplete. Security retains workspace identity and access decisions, while Queries owns export-allowance administration. The module declares no custom fields, publishes no operation for configurable intake and invokes no model. ## Data Job Engine The module owns shared bulk execution and five design objects: jobs, uploads, producer mappings, data runs and capacity state. Adopting services keep jobs and mappings beside their domain records. Platform owns upload and run storage, while its capacity sentinel publishes protection decisions. Membership declares operations but has no runnable job storage at the examined revision. The exposed operations match the service contracts: CRM record jobs, Platform definition and custom-record jobs, multipart upload, staff-driven migration runs, capacity pins and health checks. Internal queues, schedules and file orchestration are execution infrastructure. Capacity publication writes shared storage rather than emitting a business event. Domain owners retain record validation, persistence, history and change events. Workspace lifecycle coordinates loading, reset and activation; shared operations provide durable orchestration. The invariant references describe enforcement boundaries, including producer-key insertion races, request-runner recovery gaps, explicit overwrite policy and missing retention sweeps. Partition maintenance remains provisionally assigned here. Engine objects enable no custom fields, operations publish no Submissions bindings, and examined paths make no model calls. ## LLM and the AI Teammate The module owns model-request and task bookkeeping, routing and price histories, monthly allowance records, temporary capacity, corrections, crossings, captured evidence and derived daily usage. Consuming features define their questions and validate the answers. Queries uses the declared metered operation, while general Jazz AI replies call a gateway directly outside that foundation. The conversation service owns only the console’s sample memory records; durable ownership remains open. Admission conditionally reserves credits and a running slot in one period update. Controls and their security audit commit together. Request settlement and task increments precede a separate period movement, so interruption can leave the monthly account inconsistent. Hourly recovery closes stale work at the estimate, checks recent task totals, retries eligible notices and rebuilds reporting; it does not repair every accounting gap. Sensitive evidence reads require qualifying access and completed audit, with failed-read coverage remaining incomplete. HQ staff receive historical and diagnostic views and privileged service controls; customer administrators receive scoped credit and feature summaries. Console controls for editing, grants and evidence remain disabled, and the planned customer dashboard has no page. The objects declare no custom fields, operations expose no intake bindings and no business events are declared. Security retains authority and audit storage, Queries retains generation and reporting semantics, shared email handles notices, and workspace lifecycle orchestrates removal. ## Workspace Lifecycle Across Applications Workspace lifecycle owns system readiness facts, construction attempts, participant contracts and registers, initial-load and reset records, and deletion decisions with notices and retained evidence. Platform exposes staff lifecycle operations; application functions supply their internal participant work. CRM also reconciles declared starter configuration during release updates. The structured contracts identify the owning objects and exact operations. Locked decisions, scoped resource keys and database standing constraints supply specific safeguards rather than a universal guarantee of complete removal. Participant omissions, copied availability rules, separate-commit recovery and finalization gaps, and unverified console implementation remain findings. Ordinary workspace administration, authority, shared execution, import processing, export packaging and general sending retain their own module boundaries. The reviewed lifecycle dispatchers make no model calls and expose no configurable intake operation. ## What Is Delegated to Platform and Other Areas Identity, sessions and reach remain with Security; licensing and recent-record history remain with Operations; record definitions and placements remain with Metadata. Queries, Eligibility, Notifications, the LLM module and Accounting own the tools hosted in the frame. Business pages belong to the modules responsible for their records. The shell performs no model inference and declares no custom fields or business-save operation. Security can still write bookkeeping during consumed reads, and it owns session termination. These effects are distinct from shell presentation ownership. Security consumes participant-owned preparation/removal, import execution from the Data Job Engine, generic job execution and licensing from Operations, rule evaluation from Eligibility, delivery from Notifications, contacts from CRM and appointment-derived synchronization from Committees. The final workspace-module split remains an open planning decision; shared source scope does not establish a second rule owner.