---
id: WF-PFM-QRY-019
title: Admit a workspace data export
trigger: A permitted workspace administrator requests an immediate complete data export.
product_area: platform
module: queries
revision: 1
status: draft
design_intent: confirmed
implementation_evidence: partially-observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
inference: []
implements:
  - CAP-PFM-QRY-018
moves:
  - STATE-PFM-QRY-009
crosses:
  - SVC-PFM-QRY-data-exports
idempotency: >-
  A repeat request is refused while a queued or running execution occupies the workspace’s single
  active slot; admission is not a reusable request-token operation.
concurrency: >-
  Admission locks the settings row and relies on the active-execution unique index as its database
  backstop.
hops:
  - 'n': 1
    actor_or_service: Request execution route
    action: >-
      Authorize the customer execute action and enter admission; system staff access does not use
      this customer route.
    anchor: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:requestDataExportExecution'
    seam: sync
    on_failure: Return the route authorization refusal.
    left_inconsistent: No execution is admitted by an authorization refusal.
    observer: the administrator
    provenance: observed
    source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts'
  - 'n': 2
    actor_or_service: Admission
    action: >-
      Check live non-sandbox eligibility, lock settings and reject suspension or an existing
      unfinished execution.
    anchor: 'services-platform:modules/data-exports/services/executions/admit-execution.ts:admitExecution'
    seam: sync
    on_failure: Return the eligibility or conflict code and roll back admission.
    left_inconsistent: The prior workspace export state remains.
    observer: the administrator
    provenance: observed
    source: 'services-platform:modules/data-exports/services/executions/admit-execution.ts'
  - 'n': 3
    actor_or_service: Admission
    action: >-
      Copy settings and cutoff into a queued execution and record allowance-use metadata and its
      access-widening audit event.
    anchor: 'services-platform:modules/data-exports/services/persistence/executions.ts'
    seam: sync
    on_failure: Rollback execution and audit on write failure.
    left_inconsistent: A committed queued row occupies the active slot.
    observer: export history; security audit events
    provenance: observed
    source: 'services-platform:modules/data-exports/services/persistence/executions.ts'
  - 'n': 4
    actor_or_service: Generation dispatcher (not yet built)
    action: >-
      The registered future job design describes planning, extraction, collection, assembly,
      verification and publication, but no generation dispatcher starts it.
    anchor: 'services-platform:modules/data-exports/services/generation/data-export-job-type.ts'
    seam: state_machine
    on_failure: No deployed generation failure or recovery policy executes here.
    left_inconsistent: The admitted execution remains queued and blocks later workspace requests.
    observer: the administrator sees a queued export that never runs
    provenance: observed
    source: 'services-platform:docs/data-exports.md'
branches:
  - >-
    Entitlement, reservation, minimum-interval and cluster-admission protections remain later design
    work.
  - >-
    Customer download, cancellation, early deletion and delivery retry currently return not
    implemented.
waits: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/data-exports/services/executions/admit-execution.ts;
    services/persistence/executions.ts, definitions.ts; services/generation/data-export-job-type.ts;
    aws/api/executions.routes.ts; docs/data-exports.md;
    docs/proposals/tenant-data-export/08-generation-engine.md, 11-execution-lifecycle.md,
    20-risks-tradeoffs-decisions.md
  - 'react-console at baf6dae: components/data-management/data-exports/export-now-sheet.tsx'
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Admit a workspace data export

## What It Does

A permitted workspace administrator requests an immediate complete data export. Entitlement, reservation, minimum-interval and cluster-admission protections remain later design work.

## The Flow

```mermaid
sequenceDiagram
  participant C as Request or schedule
  participant H0 as Request execution route
  participant H1 as Admission
  participant H2 as Admission
  participant H3 as Generation dispatcher not yet built
  C->>H0: Authorize the customer execute action and enter admission
  H0->>H1: Check live non-sandbox eligibility, lock settings and reject suspension or an existing unfinished ex
  H1->>H2: Copy settings and cutoff into a queued execution and record allowance-use metadata and its access-wi
  Note over H3: No generation dispatcher is deployed
```

Authorize the customer execute action and enter admission; system staff access does not use this customer route. Check live non-sandbox eligibility, lock settings and reject suspension or an existing unfinished execution. Copy settings and cutoff into a queued execution and record allowance-use metadata and its access-widening audit event. The registered future job design describes planning, extraction, collection, assembly, verification and publication, but no generation dispatcher starts it.

## When Something Fails

Return the route authorization refusal. No execution is admitted by an authorization refusal. Return the eligibility or conflict code and roll back admission. The prior workspace export state remains. Rollback execution and audit on write failure. A committed queued row occupies the active slot.

## Idempotency and Concurrency

A repeat request is refused while a queued or running execution occupies the workspace’s single active slot; admission is not a reusable request-token operation. Admission locks the settings row and relies on the active-execution unique index as its database backstop.