--- id: CAP-PFM-CSH-014 title: Apply the workspace and person’s application access feature: FEAT-PFM-CSH-04 product_area: platform module: console-shell revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration (built and accepted by Andrew 2026-10-15) - >- services-platform:docs/licensing.md#9. How a licence reaches the permission check (Andrew, 2026-10-14) purpose: The console translates Security’s application and permission answer into visible working surfaces. outcomes: - Application availability and action authority remain separate. - Unknown or restricted authority does not invent access. concepts: - CON-PFM-CSH-004 actors: - ACT-PFM-002 - ACT-PFM-001 - ACT-PFM-004 - ACT-PFM-006 surfaces: - console preconditions: [] postconditions: [] permissions: - key: platform.security-self.read where_checked: api scope: tenant - key: platform.application.access where_checked: api scope: tenant - key: crm.application.access where_checked: api scope: tenant - key: console.access where_checked: console scope: tenant - key: console.system where_checked: console scope: tenant rules: - id: BR-CAP-PFM-CSH-014-01 proved_by: [ATS-PFM-CSH-014-01, ATS-PFM-CSH-014-06, ATS-PFM-CSH-014-12, TST-PFM-CSH-033] statement: >- Only applications listed in the security context enable their mapped console domains, for staff and customer users alike. kind: policy enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#enables only the domains of the applications the context lists origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, items 1 and 3 (built and accepted by Andrew 2026-10-15) - id: BR-CAP-PFM-CSH-014-02 proved_by: [ATS-PFM-CSH-014-09, TST-PFM-CSH-033] statement: >- Platform enables Configuration, Security, Maintenance, Tools and Eligibility; its Accounting, Commerce and Events keys map to their console names, and Publications, Advertising or Subscriptions can enable Publications. kind: calculation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#lets any of several applications switch a shared domain on origin: none - id: BR-CAP-PFM-CSH-014-03 proved_by: [ATS-PFM-CSH-014-02, TST-PFM-CSH-033] statement: A staff wildcard permission grant cannot enable a domain absent from the listed applications. kind: permission enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#gives a staff wildcard no domain the applications did not give origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 3 (built and accepted by Andrew 2026-10-15) - id: BR-CAP-PFM-CSH-014-04 proved_by: [ATS-PFM-CSH-014-03, TST-PFM-CSH-017, TST-PFM-CSH-018] statement: >- Allowed backend permissions grant their mapped console keys, including multiple console keys for one backend permission. kind: calculation enforced_at: - console must_prove: true provenance: test source: 'react-console:lib/authz/__tests__/authz.test.ts#maps aliases onto registry keys' origin: none - id: BR-CAP-PFM-CSH-014-05 proved_by: [ATS-PFM-CSH-014-04, TST-PFM-CSH-033] statement: >- A console domain with no backend aliases receives its item keys while enabled unless denied, and adding any alias makes its mapped authority decisive. kind: calculation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#grants a keyless domain's item keys when its application is enabled origin: none - id: BR-CAP-PFM-CSH-014-06 proved_by: [ATS-PFM-CSH-014-10] statement: >- At least one listed application supplies console access, staff identity supplies console system access, and an enabled domain supplies its domain access key subject to explicit denial. kind: calculation enforced_at: - console must_prove: true provenance: observed source: 'react-console:lib/security-context/entitlements.ts:allowedConsoleKeys' origin: none - id: BR-CAP-PFM-CSH-014-07 proved_by: [ATS-PFM-CSH-014-05, TST-PFM-CSH-017, TST-PFM-CSH-018, TST-PFM-CSH-023] statement: >- In normalized console checks, explicit denies override grants, prefix wildcards cover descendant permissions and keys without covering authority fail. kind: calculation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/authz/__tests__/authz.test.ts#grants exact keys and prefix wildcards, and denies win origin: none - id: BR-CAP-PFM-CSH-014-08 proved_by: [ATS-PFM-CSH-014-05, TST-PFM-CSH-017, TST-PFM-CSH-018, TST-PFM-CSH-023] statement: A permission request with unknown entitlements is refused. kind: invariant enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/console/application-guard.test.ts#refuses a page that asks for something when there are no entitlements at all origin: none - id: BR-CAP-PFM-CSH-014-09 proved_by: [ATS-PFM-CSH-014-11] statement: >- Feature values are copied from the context and do not independently enable application domains. kind: policy enforced_at: - console must_prove: false provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#reads features from the context rather than granting them all origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 5 (built and accepted by Andrew 2026-10-15) - id: BR-CAP-PFM-CSH-014-10 proved_by: [ATS-PFM-CSH-014-07, TST-PFM-CSH-033] statement: >- A scoped permission reveals its surface when no record is checked, permits only its named records when scope is checked, and does not narrow an existing workspace-wide grant. kind: permission enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#holds the key on that object and nowhere else origin: none - id: BR-CAP-PFM-CSH-014-11 proved_by: [ATS-PFM-CSH-014-08, TST-PFM-CSH-018] statement: >- While deriving console permissions, a backend allowed key takes precedence over a contradictory stale deny rule and is not added to the derived denied set. kind: calculation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/authz/__tests__/backend-aliases.test.ts#lets allowed win over a stale deny rule, because allowed is the authority origin: none scenarios: - id: SC-CAP-PFM-CSH-014-01 given: A staff wildcard grant accompanies a context listing only CRM. when: The console derives its application domains. then: CRM is enabled and other unlisted applications remain disabled. provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#gives a staff wildcard no domain the applications did not give - id: SC-CAP-PFM-CSH-014-02 given: An enabled domain has no backend aliases but one item is explicitly denied. when: Console permissions are derived. then: The domain’s other keys are granted while the denied item remains refused. provenance: test source: >- react-console:lib/security-context/entitlements.test.ts#lets a deny rule take one keyless key away edge_cases: [] constraints: [] depends_on: [] related: - CAP-PFM-CSH-006 - CAP-PFM-CSH-015 - CAP-PFM-CSH-016 journeys: - JNY-PFM-CSH-005 open_questions: - OQ-PFM-CSH-002 evidence: - >- react-console at baf6dae: lib/security-context/{entitlements,entitlements.test}.ts, lib/authz/{evaluate,entitlements,backend-aliases}.ts, lib/authz/__tests__/{authz,backend-aliases}.test.ts, lib/console/application-guard.test.ts. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts (getMySecurityContext, getMySecurityContextInTenant, getMyApplications), modules/security/services/access/security-context.ts (applications_of), docs/security/application-access.md, docs/licensing.md §2 and §9, docs/proposals/application-access-and-entitlements.md §6.4, §7.1, §10.1. controls: [TC-AVL-001, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-CSH-04-01, FAS-PFM-CSH-04-02, FAS-PFM-CSH-04-03, FAS-PFM-CSH-04-04] suites: [TST-PFM-CSH-017, TST-PFM-CSH-018, TST-PFM-CSH-023, TST-PFM-CSH-033] --- # Apply the workspace and person’s application access ## Purpose The console translates Security’s application and permission answer into visible working surfaces. ## How It Works The console receives an application and permission context from Security. A shared translator produces the authority used by navigation and page guards. Application domains and individual actions are evaluated separately. Custom-record grants also carry resource scope. The translator accepts the backend’s allowed keys as authoritative rather than reconstructing role evaluation. The product should retain tests for the alias boundary and scoped access as the catalogue grows. ## Relationships - Security owns backend permission evaluation and the applications supplied in the context. - Navigation and page guards consume the translated answer.