---
id: ADR-PFM-OPS-011
title: A licensing decision commits first and later steps never undo it
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Commit a staff licensing decision before preparation, security-history insertion and cache refresh; failure
  in later work does not undo the decision.
constrains:
  - WF-PFM-OPS-010
  - WF-PFM-OPS-011
  - WF-PFM-OPS-012
  - SVC-PFM-OPS-licensing
  - DOM-PFM-OPS-004
origin: 'services-platform:docs/licensing.md#Granting one (the override is committed first)'
alternatives:
  - option: One transaction spanning preparation and history
    why_not: 'Preparation may call other services, so the transaction would hold locks across a network boundary.'
  - option: Undo the grant if preparation fails
    why_not: The commercial decision remains real even when subsequent preparation cannot finish.
consequences:
  - The grant survives a recorded preparation failure.
  - A failed history insertion can leave an access-changing decision unaudited.
  - Overrides attempt history before refresh; operational moves request refresh before history.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/licensing/services/enablement/grant-licence-override.ts,
    provision-tenant-application.ts; aws/api/licensing.routes.ts.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# A licensing decision commits first and later steps never undo it

## Context

One staff decision can change commercial access, require application preparation and invalidate cached authority.

## Decision

Commit the decision first, then perform the remaining work. Follow the actual ordering of each caller and contain refresh submission errors. Leave the committed decision intact if preparation or auditing fails.

## Alternatives Considered

A transaction spanning remote preparation would hold locks too long. Compensating the grant would erase a decision staff need to explain.

## Consequences

The persisted decision is durable, but follow-up work needs stronger recovery and audit guarantees.