---
id: ADR-PFM-QRY-003
title: Person-requested work uses current person access
product_area: platform
module: queries
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Person-requested query work uses the requester or schedule owner context when executing, while
  maintenance, snapshots, indexing and staff validation retain their dedicated service or system
  contexts.
constrains:
  - DOM-PFM-QRY-002
  - DOM-PFM-QRY-003
  - DOM-PFM-QRY-004
  - WF-PFM-QRY-004
  - WF-PFM-QRY-006
  - WF-PFM-QRY-007
  - WF-PFM-QRY-008
  - WF-PFM-QRY-012
  - SVC-PFM-QRY-queries
origin: >-
  docs/migrations/query-scheduling-exports/README.md D4; docs/queries/saved-queries-and-recipes.md;
  docs/queries/report-rendering.md (D6)
alternatives:
  - option: Give background requests unrestricted service authority
    why_not: That could expose records beyond the requester’s access.
  - option: Reuse grants captured at admission
    why_not: A later access withdrawal would not affect queued work.
consequences:
  - Workers reconstruct the person context for the request they execute.
  - Access loss can fail a file or pause a schedule.
  - Sharing a definition does not grant access to its underlying records.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6:
    modules/queries/services/saved-queries/person-execution-context.ts;
    services/exports/run-query-export.ts; services/rendering/api-interception.ts
---

# Person-requested work uses current person access

## Context

A request may execute after access changes. A shared definition must not supply authority to read its records.

## Decision

Person-requested query work uses the requester or schedule owner context when executing, while maintenance, snapshots, indexing and staff validation retain their dedicated service or system contexts.

## Alternatives Considered

Give background requests unrestricted service authority: That could expose records beyond the requester’s access.

Reuse grants captured at admission: A later access withdrawal would not affect queued work.

## Consequences

Workers reconstruct the person context for the request they execute. Access loss can fail a file or pause a schedule. Sharing a definition does not grant access to its underlying records.