---
id: ADR-PFM-OPS-005
title: 'Customer, workspace and Rhythm HQ monitors are separate declarations of one read'
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Provide separate customer, workspace and HQ declarations for the same five reads, sharing handlers while
  restricting staff-wide reach to HQ.
constrains:
  - SVC-PFM-OPS-jobs
  - WF-PFM-OPS-007
  - SCR-PFM-OPS-001
  - SCR-PFM-OPS-002
  - SCR-PFM-OPS-003
origin: >-
  services-platform:docs/hq/rhythm-hq-plan.md#D1 (rule S1, approved K8); docs/jobs.md#A tenant's job runs
  (Andrew, 2026-10-16)
alternatives:
  - option: Widen the customer route for staff
    why_not: >-
      Cross-customer authority belongs on staff routes; widening the customer route would weaken that
      boundary.
  - option: Use a workspace filter on the customer route
    why_not: Workspace entry grants require a workspace-addressed route rather than a filter on a customer read.
consequences:
  - Each additional monitor read needs matching audience declarations.
  - A job outside read scope appears absent.
  - HQ snapshots add subject and requester details omitted from customer snapshots.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/jobs/aws/api/jobs.routes.ts, services/scope/job-read-scope.ts;
    modules/jobs/tests/e2e.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# Customer, workspace and Rhythm HQ monitors are separate declarations of one read

## Context

Customers, workspace entrants and Rhythm staff inspect the same job records with different authority.

## Decision

Declare list, count, kind, snapshot and history reads for each audience. Share their implementation and apply the appropriate scope before returning records.

## Alternatives Considered

One widened route would blur audience authority. A filter alone would not admit workspace-grant callers.

## Consequences

The route groups make audience boundaries explicit while reusing the recording and query contracts.