---
id: ADR-PFM-MTD-007
title: Record identity scoped to its object
product_area: platform
module: metadata
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: One deployment-defined record permission set uses object scope, and roles-only categories additionally
  require active assignments specifically scoped to that object.
constrains:
- DOM-PFM-MTD-004
- DOM-PFM-MTD-005
- SVC-PFM-MTD-custom-objects
- SCR-PFM-MTD-014
- SCR-PFM-MTD-016
origin: 'Custom objects architecture D-09 (approved 2026-10-18) and D-19 (Andrew, 2026-10-18: the delete key archives
  and restores); PLAT-M5 D10 (Andrew, 2026-10-19: roles-only visibility, built in PLAT-M5)'
alternatives:
- option: Creating permission keys at object creation
  why_not: Permission keys are deployment-managed, whereas object definitions are runtime configuration.
- option: Applying built-in reach to every object
  why_not: Sensitive categories need an object-specific mode that does not rely on broad built-in grants.
consequences:
- The published record-key tiers define administrator, user and read-only reach.
- Object invisibility is expressed as not found on scoped record access.
- System contexts without a permission slice have workspace-wide object reach.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/custom-objects/services/access/record-access.ts; aws/platform.service.ts;
  docs/custom-objects.md §8 and §18'
---

# Record identity scoped to its object

## Context

Runtime categories need separately scoped staff access while the permission catalogue remains deployment-managed.

## Decision

One deployment-defined record permission set uses object scope, and roles-only categories additionally require active assignments specifically scoped to that object.

## Alternatives Considered

Creating permission keys at object creation: Permission keys are deployment-managed, whereas object definitions are runtime configuration. Applying built-in reach to every object: Sensitive categories need an object-specific mode that does not rely on broad built-in grants.

## Consequences

The published record-key tiers define administrator, user and read-only reach. Object invisibility is expressed as not found on scoped record access. System contexts without a permission slice have workspace-wide object reach.