--- id: CAP-PFM-QRY-004 title: Answer operational questions across customers feature: FEAT-PFM-QRY-01 product_area: platform module: queries revision: 1 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: [] purpose: >- Let Rhythm staff investigate platform operations across customers while keeping customer record datasets on their separate workspace surface. outcomes: - HQ investigation can span customers. - System questions stay separate from customer records. concepts: - CON-PFM-QRY-001 actors: - ACT-PFM-015 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: hq.queries.read where_checked: api scope: global - key: >- each system dataset's own key (hq.customers.read, hq.tenants.read, hq.jobs.read, hq.staff.read, hq.llm-usage.read) where_checked: service scope: global rules: - id: BR-CAP-PFM-QRY-004-01 proved_by: [ATS-PFM-QRY-004-01, TST-PFM-QRY-235] statement: >- Rhythm HQ queries require both the system-query permission and the chosen system dataset’s permission; the surface permission alone leaves every dataset unauthorized. kind: permission enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers every dataset as unauthorized for a caller holding the surface key alone origin: none - id: BR-CAP-PFM-QRY-004-02 proved_by: [ATS-PFM-QRY-004-02, ATS-PFM-QRY-004-09, TST-PFM-QRY-235] statement: The system catalog exposes only HQ datasets and treats workspace datasets requested there as missing. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant dataset as one that does not exist, with 404 and never 403 origin: none - id: BR-CAP-PFM-QRY-004-03 proved_by: [ATS-PFM-QRY-004-03, TST-PFM-QRY-235] statement: System datasets and their single-hop references read across customers without a workspace restriction. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers the tenants of every customer at once, which no tenant route could ever do origin: none - id: BR-CAP-PFM-QRY-004-04 proved_by: [ATS-PFM-QRY-004-04, ATS-PFM-QRY-004-08, TST-PFM-QRY-235] statement: A system query cannot join a workspace dataset into its system model. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a model that joins a tenant’s dataset to the system’s, the two having no tenant in common origin: none - id: BR-CAP-PFM-QRY-004-05 proved_by: [ATS-PFM-QRY-004-05, TST-PFM-QRY-235] statement: >- System datasets offer the all-records scope without workspace custom fields or label overrides and reject Recently Viewed. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses the recently_viewed scope: it answers what a person viewed in a tenant, and this dataset has none origin: none - id: BR-CAP-PFM-QRY-004-06 proved_by: [ATS-PFM-QRY-004-06, TST-PFM-QRY-228, TST-PFM-QRY-235] statement: >- System and workspace recipe libraries remain separate, and either surface reports the other’s recipes as missing. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#refuses a tenant’s recipe as one that does not exist, with 404 origin: none - id: BR-CAP-PFM-QRY-004-07 proved_by: [ATS-PFM-QRY-004-07, TST-PFM-QRY-228] statement: A workspace’s AI request records cannot be queried through the HQ system surface. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js#keeps the organization’s requests out of a staff query on the system surface, with 404 origin: none - id: BR-CAP-PFM-QRY-004-08 proved_by: [] statement: HQ permissions are reserved for Rhythm staff and cannot be granted to customer users at any scope. kind: permission enforced_at: - api must_prove: false provenance: observed source: 'services-platform:aws/platform.service.ts:HQ_APP' origin: none scenarios: - id: SC-CAP-PFM-QRY-004-01 given: A Rhythm support user holds the HQ reader policy. when: They query workspaces with the associated customer names. then: The result spans customers on the system surface. provenance: test source: >- services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js#answers a tenant beside its customer’s name, the one-hop join compiled without a tenant predicate edge_cases: [] constraints: [] depends_on: - CAP-PFM-QRY-001 related: - CAP-PFM-QRY-002 - CAP-PFM-QRY-005 journeys: [] open_questions: [] operations: - listSystemQueryDatasets - describeSystemQueryDataset - runSystemDatasetQuery - validateSystemDatasetQuery - listSystemQueryRecipes - getSystemQueryRecipe - createSystemQueryRecipeDraft tables: [] evidence: - 'Pinned reference: services-platform:aws/platform.service.ts' - 'Pinned reference: services-platform:modules/queries/tests/e2e/llm-usage.e2e.spec.js' - 'Pinned reference: services-platform:modules/queries/tests/e2e/system-queries.e2e.spec.js' controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-IAM-003, TC-LOG-001, TC-LOG-005, TC-PI-001, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-QRY-01-04] suites: [TST-PFM-QRY-228, TST-PFM-QRY-235] --- # Answer operational questions across customers ## Purpose Let Rhythm staff investigate platform operations across customers while keeping customer record datasets on their separate workspace surface. ## How It Works Rhythm staff open the system query surface for operational investigation. They browse HQ datasets and choose a question about customers, workspaces, jobs, staff or usage. Dataset access remains a separate check from access to the surface. The shared query engine handles descriptions, validation and results. These questions span customers because their subject is the platform’s own records. Workspace datasets remain unavailable on this surface. Staff assistance inside a customer workspace instead uses the security module’s grant process. ## Relationships Cross-customer questions use the same language over system datasets; customer-specific tables have a separate staff-authoring outcome.