---
id: ADR-PFM-DJE-010
title: Staff-driven data runs
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  A run progresses when staff start, resume or read it, forwarding that caller’s
  authority to dataset jobs instead of storing credentials or running a
  background driver.
constrains:
  - DOM-PFM-DJE-005
  - STATE-PFM-DJE-004
  - WF-PFM-DJE-012
  - SVC-PFM-DJE-data-jobs
origin: >-
  services-platform:docs/data-jobs/data-runs.md (PLAT-M22, Proposed);
  CAP-PFM-DJE-016 is product_intent proposed
alternatives:
  - option: Add a scheduled driver with its own service identity
    why_not: >-
      A separate driver needs an explicit identity and authorization design
      beyond the current staff-driven implementation.
  - option: Persist a staff token for later replay
    why_not: The current design deliberately avoids persisting bearer credentials.
consequences:
  - Completed datasets do not automatically advance an unattended run.
  - Concurrent readers can each attempt to drive the same run.
  - Migration clients must continue polling to make progress.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a65: services/runs/run-driver.ts (module comment);
    aws/api/data-runs.routes.ts
---

# Staff-Driven Data Runs

## Context

A migration coordinates changes owned by several services.

## Decision and Origin

A run progresses when staff start, resume or read it, forwarding that caller’s authority to dataset jobs instead of storing credentials or running a background driver. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Add a scheduled driver with its own service identity: A separate driver needs an explicit identity and authorization design beyond the current staff-driven implementation.

Persist a staff token for later replay: The current design deliberately avoids persisting bearer credentials.

## Consequences

Completed datasets do not automatically advance an unattended run.

Concurrent readers can each attempt to drive the same run.

Migration clients must continue polling to make progress.