---
id: ADR-PFM-OPS-014
title: Licensing records carry no row-level policy; staff-only routes keep them private
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Read licensing without workspace row policies, using staff routes, explicit query scope and a reduced
  customer response to protect commercial details.
constrains:
  - DOM-PFM-OPS-003
  - DOM-PFM-OPS-004
  - SVC-PFM-OPS-licensing
origin: >-
  services-platform:docs/licensing.md#10. The HubSpot source (none carries a tenant or row-level security);
  docs/row-level-security.md
alternatives:
  - option: Workspace policies on all licensing tables
    why_not: Company coverage can serve several workspaces and is needed before one workspace is entered.
consequences:
  - Workspace-scoped statements include explicit workspace predicates.
  - 'Customer responses omit staff decisions, names and commercial source details.'
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/licensing/db/*.table.ts headers; db/row-level-security.ts
    exemptions; aws/api/licensing-api-mapper.ts.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# Licensing records carry no row-level policy; staff-only routes keep them private

## Context

Availability is evaluated across workspaces, and company-level coverage is shared.

## Decision

Keep these records outside workspace row policies. Restrict full commercial reads to staff and map customer reads to the deliberately smaller answer.

## Alternatives Considered

Workspace-only policies cannot naturally represent shared company coverage or cross-workspace access resolution.

## Consequences

Privacy depends on route authority, query scope and response mapping for these records.