---
id: ADR-PFM-CSH-003
title: Workspace Addresses Require Strict Entry
product_area: platform
module: console-shell
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Require the held workspace context to match the identifier in the address
  before mounting requested workspace content.
constrains:
  - DOM-PFM-CSH-003
  - STATE-PFM-CSH-002
  - WF-PFM-CSH-002
  - SCR-PFM-CSH-009
origin: >-
  react-console:docs/url-architecture.md#2.2 and #6. Tenant from the URL
  (decided by Andrew 2026-10-14; final acceptance 2026-10-15)
alternatives:
  - option: Keep the workspace in browser storage and out of the address
    why_not: >-
      A browser preference cannot make shared links select the same workspace
      for every person.
  - option: Fall back to the default workspace when the named one is refused
    why_not: >-
      Default substitution would display another organization’s work beneath the
      requested address.
consequences:
  - Shared links preserve the requested workspace.
  - 'Entry distinguishes absence, reach refusal and operational unavailability.'
  - Context-free compatibility links still need their temporary resolver.
supersedes: []
evidence:
  - >-
    react-console at baf6dae: docs/url-architecture.md;
    components/console/tenant-id-gate.tsx; lib/security-context/tenant-id.ts
---
# Workspace Addresses Require Strict Entry

## Context

A shared record link needs to identify the organization’s workspace independently of browser preferences.

## Decision

Put the workspace identifier in the address and withhold requested content until Security answers for that workspace. A response naming another workspace is rejected.

## Alternatives Considered

Browser-only selection makes identical links context-dependent. Replacing a refused workspace with the default would misrepresent where the requested record belongs.

## Consequences

Bookmarks preserve context. Refused entry has explicit outcomes, and older context-free addresses require temporary compatibility mapping.