---
id: ADR-PFM-ELG-009
title: Security owns derived roles; eligibility answers and queues rechecks
product_area: platform
module: eligibility
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Eligibility supplies authorization answers and requests rechecks; Security
  alone maintains derived role assignments.
constrains:
  - DOM-PFM-ELG-003
  - SVC-PFM-ELG-eligibility
  - WF-PFM-ELG-008
  - RESP-PFM
origin: >-
  Eligibility Engine architecture D-22, D-23 and D-25 (materialised derived
  assignments with a 24-hour TTL, event, sign-in and nightly reconcile;
  eligibility conditions answered from materialised decisions), approved by
  Andrew 2026-10-17 (PLAT-M11 "Decisions")
alternatives:
  - option: Write role grants from eligibility
    why_not: A second grant writer would split ownership of authorization guarantees.
  - option: Evaluate all role rules on every request
    why_not: >-
      Repeated synchronous evaluation would add cost and availability
      dependencies to every request.
consequences:
  - Publication and record changes can request rechecks.
  - Failed refresh leaves existing grants until their documented expiry.
  - One missing use can fail a subject’s whole recheck batch.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6:
    docs/proposals/eligibility/17-decision-register.md;
    docs/milestones/PLAT-M11-eligibility-rules.md (Decisions)
  - >-
    services-platform at ad3f6a6: docs/eligibility.md §12, §13; docs/queued-
    work.md
---
# Security owns derived roles; eligibility answers and queues rechecks

## Context

Rule-based role membership is still a Security grant.

## Decision

Eligibility supplies authorization answers and requests rechecks; Security alone maintains derived role assignments.

## Alternatives Considered

Write role grants from eligibility: A second grant writer would split ownership of authorization guarantees.

Evaluate all role rules on every request: Repeated synchronous evaluation would add cost and availability dependencies to every request.

## Consequences

Publication and record changes can request rechecks. Failed refresh leaves existing grants until their documented expiry. One missing use can fail a subject’s whole recheck batch.