---
id: ADR-PFM-CSH-005
title: Application Gating Precedes Page Permissions
product_area: platform
module: console-shell
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Enable console domains from the context application list and evaluate
  application availability before page permissions.
constrains:
  - DOM-PFM-CSH-004
  - DOM-PFM-CSH-002
  - WF-PFM-CSH-008
  - SCR-PFM-CSH-012
  - SCR-PFM-CSH-003
origin: >-
  services-platform:docs/proposals/application-access-and-entitlements.md#6.4
  items 1 to 3 and #10.1 D1 (decided 2026-10-11; built and accepted by Andrew
  2026-10-15)
alternatives:
  - option: Derive availability in the console from permissions
    why_not: Permissions do not establish the workspace’s licensing state.
  - option: Let a staff allow-everything grant reveal every application
    why_not: Broad staff grants do not establish customer application availability.
consequences:
  - Application and page-permission refusals remain separate.
  - >-
    Platform’s keyless-application rule governs products without catalog
    permissions.
  - Paths outside the route registry retain page-specific guards.
supersedes: []
evidence:
  - >-
    react-console at baf6dae: lib/security-context/entitlements.ts;
    lib/console/application-guard.ts;
    components/console/application-route-gate.tsx
  - >-
    services-platform at ad3f6a6:
    docs/proposals/application-access-and-entitlements.md
---
# Application Gating Precedes Page Permissions

## Context

Availability and personal permission answer different access questions. Security and Operations provide the inputs rather than leaving the console to infer licensing.

## Decision

Use the context application list to enable domains and explain a missing application before evaluating page permission. Wildcard permissions alone add no domain.

## Alternatives Considered

Permission-derived licensing could mislabel unavailable work as a personal refusal. Staff wildcards that exposed every application would ignore workspace availability.

## Consequences

The refusal presentation distinguishes application access from page permission, although current copy can overstate the organization-level reason. Keyless applications use Platform’s special rule. Other destinations still need their own guards.