---
id: SCR-PFM-CSH-009
title: Workspace entry refusal
route: '/console/{tenantId}/** (while the named workspace is not current)'
surface: console
product_area: platform
module: console-shell
revision: 1
status: draft
design_intent: confirmed
origin: >-
  react-console:docs/url-architecture.md#6. Tenant from the URL (DEF-CRM-0545;
  decided by Andrew 2026-10-14; final acceptance 2026-10-15)
implementation_evidence: observed
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: >-
  Workspace entry holds the requested page until its workspace context is
  available.
supports:
  - JNY-PFM-CSH-003
  - JNY-PFM-CSH-004
  - CAP-PFM-CSH-010
  - CAP-PFM-CSH-011
permission: platform.security-self.read
entry_from:
  - 'Any workspace address, link, bookmark or switch'
exits_to:
  - The page the address names (on entry)
  - Back to the current or another reachable workspace
  - Back to Rhythm HQ (staff)
inference: []
displays:
  - field: Workspace-resolution progress
    source: DOM-PFM-CSH-003 entry in progress
  - field: Classified refusal or unexpected failure
    source: getMySecurityContext strict answer
  - field: Return destination when another workspace is reachable
    source: DOM-PFM-CSH-001 working context and reachable workspaces
actions:
  - label: Back to the named workspace
    operation_id: 'none: console navigation'
    permission: platform.security-self.read
    confirm: false
  - label: Back to Rhythm HQ
    operation_id: 'none: console navigation'
    permission: console.system
    confirm: false
states:
  - workspace loading
  - workspace not found
  - reach refused
  - workspace unavailable
  - unexpected entry failure
validation:
  - BR-CAP-PFM-CSH-010-01
  - BR-CAP-PFM-CSH-010-02
  - BR-CAP-PFM-CSH-010-03
  - BR-CAP-PFM-CSH-010-04
  - BR-CAP-PFM-CSH-010-05
  - BR-CAP-PFM-CSH-010-06
  - BR-CAP-PFM-CSH-010-07
  - BR-CAP-PFM-CSH-010-08
  - BR-CAP-PFM-CSH-010-09
  - BR-CAP-PFM-CSH-010-10
  - BR-CAP-PFM-CSH-011-07
patterns:
  - 'State panels (not found, permission denied, unavailable) with a back link'
  - Loading indicator panel
component: components/console/tenant-id-gate.tsx; components/console/hq/state-panels.tsx
evidence:
  - >-
    react-console at baf6dae: components/console/tenant-id-gate.tsx;
    lib/security-context/tenant-id.ts;
    components/console/__tests__/tenant-id-gate.test.tsx.
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---
# Workspace entry refusal

## What the Screen Is For

Workspace entry holds the requested page until its workspace context is available. Refusal panels explain an unsuccessful entry within the existing frame.

## What It Shows and Lets People Do

Not found, denied and unavailable have distinct presentations. Denied customer users can return to their current or another reachable workspace, with no link if none exists. Unavailable workspaces offer HQ to staff or another workspace to customer users. Other failures display their message. Denied staff leave for HQ and receive a notice there.

## States and Errors

The gate shows loading while resolving. It retains one refusal for ten seconds across remounts and can ask again on a later visit. A recently left workspace waits six seconds before retrying while the address still requests it.

## Patterns It Must Respect

The gate uses shared loading and refusal panels with BackLink where appropriate. Internal wording visible in the current implementation remains a copy finding.