--- id: CAP-PFM-CSH-015 title: Explain why an application page cannot open feature: FEAT-PFM-CSH-04 product_area: platform module: console-shell revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration (built and accepted by Andrew 2026-10-15) purpose: >- Deep links distinguish unavailable applications from missing authority within an available application. outcomes: - A unavailable application receives a useful explanation. - The person has a return destination from a blocked page. concepts: - CON-PFM-CSH-004 actors: - ACT-PFM-001 - ACT-PFM-002 surfaces: - console preconditions: [] postconditions: [] permissions: - key: console.access where_checked: console scope: tenant - key: configuration.applications.view where_checked: console scope: tenant rules: - id: BR-CAP-PFM-CSH-015-01 proved_by: [ATS-PFM-CSH-014-12, ATS-PFM-CSH-015-01, ATS-PFM-CSH-015-04, TST-PFM-CSH-023] statement: >- When a page’s declared or permission-derived application is disabled, its guard shows application unavailability rather than permission denial. kind: policy enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/console/application-guard.test.ts#says the application is not available, not that access was denied origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 2 (built and accepted by Andrew 2026-10-15) - id: BR-CAP-PFM-CSH-015-02 proved_by: [ATS-PFM-CSH-015-01, TST-PFM-CSH-023] statement: Availability is evaluated before the page’s action permissions. kind: policy enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/console/application-guard.test.ts#prefers the application's answer: nobody can grant a permission inside an application they do not have origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 2 (built and accepted by Andrew 2026-10-15) - id: BR-CAP-PFM-CSH-015-03 proved_by: [ATS-PFM-CSH-014-12, ATS-PFM-CSH-015-02, ATS-PFM-CSH-017-14] statement: >- A missing permission inside an enabled application renders Access Denied with a readable permission description and Back to Home. kind: permission enforced_at: - console must_prove: true provenance: observed source: 'react-console:lib/authz/guard.tsx:RequirePermission, AccessDenied' origin: none - id: BR-CAP-PFM-CSH-015-04 proved_by: [ATS-PFM-CSH-015-03, TST-PFM-CSH-023] statement: >- A declared application takes precedence over inferred applications; multiple inferred candidates need one enabled application and the page still requires a passing permission. kind: calculation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/console/application-guard.test.ts#takes the domain a page names over the domain its permissions imply origin: none - id: BR-CAP-PFM-CSH-015-05 proved_by: [ATS-PFM-CSH-015-04, ATS-PFM-CSH-015-06] statement: >- The route-body gate checks registry-owned application paths, including record descendants, only after the address workspace matches the current context. kind: policy enforced_at: - console must_prove: true provenance: observed source: 'react-console:components/console/application-route-gate.tsx:ApplicationRouteGate' origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 2 (built and accepted by Andrew 2026-10-15) note: The linked finding records the evidence limitation or implementation gap. - id: BR-CAP-PFM-CSH-015-06 proved_by: [ATS-PFM-CSH-015-04, ATS-PFM-CSH-015-07] statement: >- The unavailable page names the console application, explains administrator and Rhythm responsibilities, and offers Back to Home and View Applications. kind: policy enforced_at: - console must_prove: false provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#a deep link into one of them says the application isn't available origin: none - id: BR-CAP-PFM-CSH-015-07 proved_by: [] statement: >- Current route-gate callers omit the unavailability reason even though the Applications overview can display one. kind: policy enforced_at: - console must_prove: false provenance: observed source: 'react-console:components/console/application-route-gate.tsx:ApplicationRouteGate' origin: none note: The linked finding records the evidence limitation or implementation gap. - id: BR-CAP-PFM-CSH-015-08 proved_by: [ATS-PFM-CSH-015-05, TST-PFM-CSH-023] statement: A page declaring neither an application nor a permission passes the shared page decision. kind: validation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/console/application-guard.test.ts#lets a page with no permission and no domain through origin: none scenarios: - id: SC-CAP-PFM-CSH-015-01 given: The workspace context omits Membership. when: The person follows a Members link. then: The body explains application unavailability and provides return links. provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#a deep link into one of them says the application isn't available - id: SC-CAP-PFM-CSH-015-02 given: The application is enabled but the person lacks the requested action key. when: The page guard evaluates the destination. then: It displays permission denial rather than application unavailability. provenance: observed source: 'react-console:lib/authz/guard.tsx:RequirePermission, AccessDenied' edge_cases: [] constraints: [] depends_on: - CAP-PFM-CSH-014 related: - CAP-PFM-CSH-017 - CAP-PFM-CSH-009 journeys: - JNY-PFM-CSH-005 open_questions: [] evidence: - >- react-console at baf6dae: lib/console/{application-guard,application-guard.test,domains}.ts, lib/authz/guard.tsx, components/console/{application-route-gate,application-unavailable,console-shell}.tsx, e2e/mock/application-access.mock.spec.ts. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts (getMySecurityContext, getMySecurityContextInTenant, getMyApplications), modules/security/services/access/security-context.ts (applications_of), docs/security/application-access.md, docs/licensing.md §2 and §9, docs/proposals/application-access-and-entitlements.md §6.4, §7.1, §10.1. controls: [TC-AVL-001, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-CSH-04-01, FAS-PFM-CSH-04-04] suites: [TST-PFM-CSH-023] --- # Explain why an application page cannot open ## Purpose Deep links distinguish unavailable applications from missing authority within an available application. ## How It Works A person follows a page link whose availability may have changed. The route-body gate and page guard use the application answer before action authority. Different failures lead to different explanations. A generic unavailable page points toward home and the administrator’s overview. Settings and tools still rely on their individual page checks outside registered application paths. The product should pass a useful availability reason into the unavailable explanation when it can be sourced. ## Relationships - Application access supplies enabled domains and permissions. - The Applications overview gives administrators a broader workspace explanation.