---
id: ADR-PFM-NOT-014
title: The Person Is Always the Signed Caller; Support Reads Need a Grant
product_area: platform
module: notifications
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Personal actions use signed-caller identity, workspace History uses management authority and
  HQ customer lists require an active access grant.
constrains:
- SVC-PFM-NOT-notifications
- SCR-PFM-NOT-001
- SCR-PFM-NOT-003
- SCR-PFM-NOT-005
- DOM-PFM-NOT-003
origin: PLAT-M23-S04 (approved plan scenario), services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md#9.
  Acceptance scenarios; D2 every built-in console role, 2026-10-21 18:05 ET
alternatives:
- option: A user parameter checked against permissions
  why_not: A selectable inbox owner adds an authorization check that personal routes can avoid entirely.
- option: Global HQ read without grants
  why_not: Unrestricted HQ customer content would bypass the approved support-grant boundary.
consequences:
- Personal reads treat another person’s notice as missing.
- Operator dead-letter and retry content lacks the History grant check and remains an open question.
- HQ notification keys currently belong to the administrator role pending broader support policy.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/notifications/aws/api/notifications.routes.ts (begin, ownState);
  services/centre/hq-notifications.ts:supportContextOf.'
---
# The Person Is Always the Signed Caller; Support Reads Need a Grant

## Context

Personal inbox, administrative History and HQ support expose related records under different authority.

## Decision

Personal actions use signed-caller identity, workspace History uses management authority and HQ customer lists require an active access grant.

## Alternatives Considered

A selectable inbox owner adds an authorization check that personal routes can avoid entirely. Unrestricted HQ customer content would bypass the approved support-grant boundary.

## Consequences

Personal reads treat another person’s notice as missing. Operator dead-letter and retry content lacks the History grant check and remains an open question. HQ notification keys currently belong to the administrator role pending broader support policy.