---
id: SCR-PFM-OPS-004
title: Rhythm HQ workspace licensing section
product_area: platform
module: operations
revision: 1
status: draft
design_intent: confirmed
implementation_evidence: inconsistent
inference: []
origin: >-
  services-platform:docs/proposals/application-access-and-entitlements.md#7.3 (built and accepted by Andrew
  2026-10-15)
route: '/hq/tenants/{tenantId} (Licensing & Applications section)'
surface: console
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Explain workspace licensing to staff and expose management actions under the implemented permissions.
supports:
  - JNY-PFM-OPS-004
  - CAP-PFM-OPS-013
  - CAP-PFM-OPS-011
  - CAP-PFM-OPS-015
permission: hq.licensing.read to see the section; hq.licensing.manage for its actions
entry_from:
  - The workspace’s Rhythm HQ page
exits_to:
  - 'The same page, refreshed after each action'
displays:
  - field: 'Each application with its licence, operation and availability states'
    source: getTenantLicensing
  - field: 'Current overrides with reason, author and dates; past overrides folded away'
    source: 'getTenantLicensing (overrides), with author names resolved by the console'
actions:
  - label: Grant Override
    operation_id: createTenantLicenceOverride
    permission: hq.licensing.manage
    confirm: true
  - label: Withhold Override
    operation_id: createTenantLicenceOverride
    permission: hq.licensing.manage
    confirm: true
  - label: Revoke Override
    operation_id: revokeTenantLicenceOverride
    permission: hq.licensing.manage
    confirm: true
  - label: Suspend Application
    operation_id: suspendTenantApplication
    permission: hq.licensing.manage
    confirm: true
  - label: Resume Application
    operation_id: resumeTenantApplication
    permission: hq.licensing.manage
    confirm: true
  - label: Retry Provisioning
    operation_id: retryTenantApplicationProvisioning (the console calls a hyphenated address the backend does not serve)
    permission: hq.licensing.manage
    confirm: true
states:
  - hidden without the read permission
  - loading
  - error with retry
  - read-only without the manage permission
  - dialog validation (reason of at least twenty characters; end date for a grant on a customer workspace)
  - success toast and refresh
validation:
  - BR-CAP-PFM-OPS-013-01
  - BR-CAP-PFM-OPS-013-02
  - BR-CAP-PFM-OPS-013-03
  - BR-CAP-PFM-OPS-013-04
  - BR-CAP-PFM-OPS-013-05
  - BR-CAP-PFM-OPS-013-06
  - BR-CAP-PFM-OPS-013-07
  - BR-CAP-PFM-OPS-011-01
  - BR-CAP-PFM-OPS-011-02
  - BR-CAP-PFM-OPS-015-02
  - BR-CAP-PFM-OPS-015-03
patterns:
  - HQ card with HqCardHeader
  - per-application DropdownMenu of actions
  - ReasonDialog and ConfirmDialog
  - Badge states
  - toast on success
component: >-
  components/console/hq/tenant-licensing-section.tsx, tenant-licensing-card.tsx, licensing-dialogs.tsx;
  lib/hq/licensing.ts, use-hq-licensing.ts
evidence:
  - >-
    react-console at baf6dae: components/console/hq/tenant-detail.tsx (host), tenant-licensing-section.tsx,
    tenant-licensing-card.tsx, licensing-dialogs.tsx, lib/hq/licensing.ts, licensing-types.ts,
    use-hq-licensing.ts, permissions.ts; e2e/dev/hq-licensing.dev.spec.ts,
    e2e/mock/application-access.mock.spec.ts.
  - 'services-platform at ad3f6a6: modules/licensing/aws/api/licensing.routes.ts.'
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Rhythm HQ Workspace Licensing Section

## What the Screen Is For

The licensing section answers why a workspace application can or cannot be used. It is embedded in the workspace administration page, while its application and licence contract belongs to Operations.

## What It Shows and Lets People Do

Each application presents licence, readiness and availability. Override entries retain reason, author and period, with historical entries collapsed. Managers can grant, withhold, withdraw, suspend, resume or request failed-preparation retry using dialogs. Successful actions refresh licensing and show a toast; client refresh does not establish atomicity with the server decision.

## States and Errors

The read permission controls whether the section appears, and management authority controls its actions. The console requires twenty trimmed reason characters and an expiry for customer grants. It collects a withdrawal reason that the route ignores. Failed-preparation retry uses an address differing from the served route, so the intended operation is unreachable through that action. Company details and synchronization health have no implemented panel here.

## Patterns It Must Respect

The built section uses HqCardHeader, application DropdownMenu actions, ReasonDialog, ConfirmDialog, state Badges and success toasts. Pending dialogs and inline errors keep unsuccessful actions visible.