---
id: ADR-PFM-OPS-010
title: 'Licence overrides are revoked, never edited, and a withhold beats everything'
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Preserve each reasoned override as a decision, withdraw it by recording author and time, and give any active
  withhold priority over grants and contracts.
constrains:
  - DOM-PFM-OPS-003
  - STATE-PFM-OPS-004
  - WF-PFM-OPS-010
  - SCR-PFM-OPS-004
origin: >-
  services-platform:docs/proposals/application-access-and-entitlements.md#10.1 (decided by Andrew 2026-10-11;
  built and accepted 2026-10-15)
alternatives:
  - option: Editable licence values
    why_not: Replacing a value would erase the reasons for earlier access.
  - option: Latest decision takes precedence
    why_not: A new grant could accidentally negate an intentional withhold.
  - option: Scheduled expiry transitions
    why_not: Period membership can be evaluated directly without a scheduled writer.
consequences:
  - The staff view retains decisions and withdrawals as history.
  - Clock-based expiry does not submit an access refresh.
  - Customer-workspace grants require an end rather than becoming permanent exceptions.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/licensing/db/licence-overrides.table.ts,
    services/persistence/licence-overrides.ts, services/availability/application-availability.ts;
    docs/licensing.md §3.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# Licence overrides are revoked, never edited, and a withhold beats everything

## Context

Staff access exceptions need to remain explainable after their periods end.

## Decision

Create a decision with a reason and period, then withdraw it rather than rewriting it. Evaluate the period at read time and give active withholds priority.

## Alternatives Considered

Mutable values lose the account of earlier decisions. Recency-based precedence can erase deliberate refusals. Scheduled expiry would introduce unnecessary execution dependence.

## Consequences

Staff can inspect historical authors, reasons and withdrawals rather than only today’s licence value.