---
id: ADR-PFM-INT-011
title: Accepted access is checked where it is used
product_area: platform
module: integrations
revision: 1
status: proposed
design_intent: open
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Persist the administrator’s accepted access and enforce it at each use: capability selection, subscriptions,
  provider authorization and credential leases. Declared data access remains unimplemented.
constrains:
  - DOM-PFM-INT-001
  - DOM-PFM-INT-003
  - DOM-PFM-INT-004
  - WF-PFM-INT-002
  - WF-PFM-INT-008
  - WF-PFM-INT-011
  - SVC-PFM-INT-integrations
alternatives:
  - option: Validate access only during installation.
    why_not: Later withdrawal would not constrain subsequent use.
  - option: Use the adapter declaration as authorization instead of accepted access.
    why_not: The administrator’s narrower choice would have no effect.
consequences:
  - Withdrawal pauses affected subscriptions and prevents later bound provider admission.
  - >-
    Reaccepting withdrawn access is currently allowed by implementation despite the narrow-only product
    decision and remains unresolved.
  - Data-scope declarations provide no working grant until their service operations are implemented.
origin: docs/milestones/INTG-M1-find-install-connect.md#Decisions D4 (access narrowable); FND-PFM-INT-025
supersedes: []
---

# Accepted access is checked where it is used

## Context

A declaration requests access; an installation records what the administrator accepted.

## Decision

Persist the administrator’s accepted access and enforce it at each use: capability selection, subscriptions, provider authorization and credential leases. Declared data access remains unimplemented.

## Alternatives Considered

Validate access only during installation. Later withdrawal would not constrain subsequent use.

Use the adapter declaration as authorization instead of accepted access. The administrator’s narrower choice would have no effect.

## Consequences

Withdrawal pauses affected subscriptions and prevents later bound provider admission.

Reaccepting withdrawn access is currently allowed by implementation despite the narrow-only product decision and remains unresolved.

Data-scope declarations provide no working grant until their service operations are implemented.