---
id: MOD-PFM-SEC
title: 'Security, Customers and Workspaces'
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
repositories:
  - name: services-platform
    paths:
      - modules/security
      - modules/tenants
      - modules/customers
      - aws/platform.service.ts
      - aws/api/platform.routes.ts
      - docs/security
      - docs/tenants
      - docs/hq/rhythm-hq-plan.md
      - docs/standards
      - docs/milestones/PLAT-M13-eligibility-roles-and-permissions.md
  - name: react-console
    paths:
      - 'app/(console)/console/[tenantId]/security'
      - 'app/(console)/hq (home, customers, tenants, staff)'
      - app/(auth)
      - app/api/auth
      - lib/auth
      - lib/security-context
      - e2e/security
      - >-
        e2e/dev (sign-in, session, social-sign-in, password-recovery,
        invitations, permissions, rhythm-access, hq-home, hq-ops, hq-staff-flow)
      - >-
        e2e/controlled (security-context, tenant-unavailable, staff-deep-link,
        invitation-expired, reset-code-expired, social-callback)
      - >-
        e2e/mock (security-*, hq-home, hq-lists, hq-ops, staff-landing,
        application-access)
owns:
  - >-
    Customer ownership, readable identity, classification and commercial
    references
  - >-
    Workspace identity, sandbox relationships, calendar, business status and
    lifecycle information
  - >-
    Staff-facing workspace setup, initial-loading, reset, activation and
    retirement requests
  - >-
    Human memberships, invitation offers, sign-in identities, account lifecycle
    and retained actor names
  - Permission catalogs and shared or customer-owned role and policy definitions
  - >-
    Manual and derived role assignments, delegation checks and administrator
    protection
  - >-
    Evaluated security context, access explanations and permitted actor-name
    lookup
  - >-
    Person-request authorization, signed authority and gateway decision-cache
    behavior
  - Security change history and recorded administrative refusals
  - >-
    Staff customer-entry requests and approved, given, emergency and standing
    grants
  - Registered machine principals and status administration
  - >-
    Portal-pool setup, member identity operations and the membership-to-contact
    link
does_not_own:
  - record: Cross-service provisioning and removal protocols and participant execution
    owner: MOD-PFM-TNL (OQ-PFM-SEC-001)
  - record: 'Data-import execution, durable jobs, licensing and record-view audit'
    owner: MOD-PFM-OPS
  - record: 'Eligibility definitions, evaluations and responsibility presentation'
    owner: MOD-PFM-ELG
  - record: Sender-identity records and message delivery
    owner: MOD-PFM-NOT
  - record: 'Websites, hostnames and portal-enabling site configuration'
    owner: MOD-WEB-WEB
  - record: Custom record types referenced by scoped grants
    owner: MOD-PFM-MTD
  - record: CRM contact storage and match calculation
    owner: 'MOD-CRM-ENT, MOD-CRM-DQ'
  - record: Appointment and authority facts that derive assignments
    owner: MOD-CMT-CMT
  - record: 'AI accounting, custom-query-table authoring and other specialized HQ work'
    owner: 'MOD-PFM-LLM, MOD-PFM-QRY'
hosted_screens:
  - route: '/console/{tenantId}/security'
    purpose: Open the Security administration area
  - route: '/console/{tenantId}/security/users'
    purpose: Find memberships and invitation status
  - route: '/console/{tenantId}/security/users/{userId}'
    purpose: 'Inspect a membership’s profile, assignments, access and history'
  - route: '/console/{tenantId}/security/users/{userId}/edit'
    purpose: Edit membership profile and assignments
  - route: '/console/{tenantId}/security/roles'
    purpose: Browse access-role definitions
  - route: '/console/{tenantId}/security/roles/new'
    purpose: Compose a customer access role
  - route: '/console/{tenantId}/security/roles/{roleRef}'
    purpose: Inspect a role’s holders and history
  - route: '/console/{tenantId}/security/roles/{roleRef}/edit'
    purpose: Change a customer role definition
  - route: '/console/{tenantId}/security/policies'
    purpose: Browse reusable permission policies
  - route: '/console/{tenantId}/security/policies/new'
    purpose: Create a customer permission policy
  - route: '/console/{tenantId}/security/policies/{policyRef}'
    purpose: Inspect policy usage and history
  - route: '/console/{tenantId}/security/policies/{policyRef}/edit'
    purpose: Change a customer policy’s rules
  - route: '/console/{tenantId}/security/rhythmAccess'
    purpose: Review requests and grants for staff workspace entry
  - route: >-
      /login, /logout, /forgotPassword, /resetPassword, /checkEmail,
      /sessionEnded, /mfa, /auth/callback
    purpose: 'Authenticate, recover credentials and handle session endings'
  - route: '/acceptInvite, /invite'
    purpose: Review and accept an invitation
  - route: /hq
    purpose: Return to pinned or recently used workspaces in HQ
  - route: '/hq/customers, /hq/customers/{id}'
    purpose: Browse customer records and inspect one customer
  - route: '/hq/tenants, /hq/tenants/{id}'
    purpose: Browse workspaces and inspect their operating details
  - route: /hq/tenants/provision
    purpose: Request workspace setup through the wizard
  - route: '/hq/staff, /hq/staff/{userId}, /hq/staff/roles'
    purpose: Review Rhythm memberships and their HQ role definitions
supersedes: []
evidence:
  - >-
    Pinned backend scope: modules/security, modules/tenants and
    modules/customers; aws/platform.service.ts and the registered security,
    workspace, HQ and standard records. The coverage catalog below names the
    inspected inventory and distinguishes mapping from behavioral proof.
  - >-
    Pinned console scope: registered Security, authentication and HQ pages,
    authentication and context libraries, and the named security, dev,
    controlled and mock browser suites.
  - >-
    Independent inventory: 146 operation names, 50 table declarations, 52
    selected published permissions, 37 backend end-to-end files, seven
    state-machine declarations, two primary work queues with two dead-letter
    queues, three schedules, 32 pages and 32 browser specification files.
coverage_catalog: >
  ### Inventory at the pinned sources


  A mapping identifies a specification home. It does not certify every
  assertion, constraint or side effect; outstanding behavioral proof belongs to
  the findings.


  | Inventory | Mapped / Total | Qualification |

  |---|---|---|

  | Operation identifiers, excluding health | 146 / 146 | Unique names
  independently extracted from the three modules’ route files |

  | Table declarations | 50 / 50 | Independently counted files |

  | Selected published permissions | 52 / 52 | 31 Platform and 21 HQ keys;
  unused declarations have a finding |

  | Backend end-to-end files | 37 / 37 | File mapping, not test execution |

  | State-machine declarations | 7 / 7 | Setup, reset, retirement schedule,
  purge, portal setup, derived reconciliation and authorizer flush |

  | Primary work queues and schedules | 5 / 5 | Two queues and three schedules;
  two additional dead-letter companions |

  | Console pages | 32 / 32 | Thirteen Security, ten authentication and nine HQ
  pages |

  | Browser specification files | 32 / 32 | File homes below; mock and
  controlled evidence is qualified in acceptance scenarios |


  ### Operation-name mapping


  | Operation | Capability |

  |---|---|

  | `acceptInvitation` | `CAP-PFM-SEC-005` |

  | `activateConsoleUser` | `CAP-PFM-SEC-008` |

  | `activateHqTenant` | `CAP-PFM-SEC-003` |

  | `activateUser` | `CAP-PFM-SEC-008` |

  | `approveTenantStaffAccess` | `CAP-PFM-SEC-017` |

  | `archiveSecurityPolicy` | `CAP-PFM-SEC-012` |

  | `archiveSecurityRole` | `CAP-PFM-SEC-012` |

  | `beginGoogleAcceptance` | `CAP-PFM-SEC-005` |

  | `cancelTenantDeletionRequest` | `CAP-PFM-SEC-004` |

  | `changePassword` | `CAP-PFM-SEC-006` |

  | `checkSecurityGrant` | `CAP-PFM-SEC-010` |

  | `checkTenantSecurityGrant` | `CAP-PFM-SEC-010` |

  | `completeGoogleAcceptance` | `CAP-PFM-SEC-005` |

  | `confirmPortalPasswordReset` | `CAP-PFM-SEC-019` |

  | `createCustomer` | `CAP-PFM-SEC-001` |

  | `createHqCustomer` | `CAP-PFM-SEC-001` |

  | `createSecurityPolicy` | `CAP-PFM-SEC-012` |

  | `createSecurityRole` | `CAP-PFM-SEC-012` |

  | `createTenant` | `CAP-PFM-SEC-003` |

  | `createUser` | `CAP-PFM-SEC-009` |

  | `declinePortalContactMatch` | `CAP-PFM-SEC-020` |

  | `declineTenantStaffAccess` | `CAP-PFM-SEC-017` |

  | `deleteCustomer` | `CAP-PFM-SEC-001` |

  | `deleteTenant` | `CAP-PFM-SEC-002` |

  | `deleteUser` | `CAP-PFM-SEC-009` |

  | `describePortalPool` | `CAP-PFM-SEC-019` |

  | `duplicateSecurityPolicy` | `CAP-PFM-SEC-012` |

  | `duplicateSecurityRole` | `CAP-PFM-SEC-012` |

  | `endHqOwnAccessGrant` | `CAP-PFM-SEC-017` |

  | `endHqStaffMemberAccessGrant` | `CAP-PFM-SEC-017` |

  | `enterHqTenantLoading` | `CAP-PFM-SEC-003` |

  | `explainConsoleUserPermissions` | `CAP-PFM-SEC-010` |

  | `getConsoleUser` | `CAP-PFM-SEC-009` |

  | `getCurrentUser` | `CAP-PFM-SEC-006` |

  | `getCustomer` | `CAP-PFM-SEC-001` |

  | `getCustomerPermissionCatalog` | `CAP-PFM-SEC-012` |

  | `getDefaultTenantForCustomer` | `CAP-PFM-SEC-002` |

  | `getHqCustomer` | `CAP-PFM-SEC-001` |

  | `getHqEmergencyAccessReport` | `CAP-PFM-SEC-017` |

  | `getHqStaffMember` | `CAP-PFM-SEC-016` |

  | `getHqTenant` | `CAP-PFM-SEC-002` |

  | `getHqTenantEmailSender` | `CAP-PFM-SEC-002` |

  | `getHqTenantReset` | `CAP-PFM-SEC-003` |

  | `getInvitationSummary` | `CAP-PFM-SEC-005` |

  | `getMyAccess` | `CAP-PFM-SEC-007` |

  | `getMyApplications` | `CAP-PFM-SEC-007` |

  | `getMySecurityContext` | `CAP-PFM-SEC-007` |

  | `getMySecurityContextInTenant` | `CAP-PFM-SEC-007` |

  | `getPermissionCatalog` | `CAP-PFM-SEC-012` |

  | `getPortalContactMatch` | `CAP-PFM-SEC-020` |

  | `getSecurityPolicy` | `CAP-PFM-SEC-012` |

  | `getSecurityRole` | `CAP-PFM-SEC-012` |

  | `getTenant` | `CAP-PFM-SEC-002` |

  | `getTenantDeletionRequest` | `CAP-PFM-SEC-004` |

  | `getTenantProvisioning` | `CAP-PFM-SEC-003` |

  | `getUser` | `CAP-PFM-SEC-009` |

  | `giveTenantStaffAccess` | `CAP-PFM-SEC-017` |

  | `grantConsoleUserRole` | `CAP-PFM-SEC-010` |

  | `holdTenantDeletionRequest` | `CAP-PFM-SEC-004` |

  | `initializeTenant` | `CAP-PFM-SEC-003` |

  | `inviteConsoleUser` | `CAP-PFM-SEC-008` |

  | `inviteHqStaff` | `CAP-PFM-SEC-016` |

  | `inviteTenantMember` | `CAP-PFM-SEC-008` |

  | `linkCognitoIdentity` | `CAP-PFM-SEC-009` |

  | `listByCustomerId` | `CAP-PFM-SEC-002` |

  | `listConsoleUserAssignments` | `CAP-PFM-SEC-010` |

  | `listConsoleUsers` | `CAP-PFM-SEC-009` |

  | `listCustomerInvitations` | `CAP-PFM-SEC-008` |

  | `listCustomers` | `CAP-PFM-SEC-001` |

  | `listHqCustomers` | `CAP-PFM-SEC-001` |

  | `listHqOwnAccessGrants` | `CAP-PFM-SEC-017` |

  | `listHqRoles` | `CAP-PFM-SEC-016` |

  | `listHqServicePrincipals` | `CAP-PFM-SEC-018` |

  | `listHqStaff` | `CAP-PFM-SEC-016` |

  | `listHqStaffMemberAccessGrants` | `CAP-PFM-SEC-017` |

  | `listHqTenantAccessRequests` | `CAP-PFM-SEC-017` |

  | `listHqTenantRoles` | `CAP-PFM-SEC-017` |

  | `listHqTenants` | `CAP-PFM-SEC-002` |

  | `listMyHqTenantShortcuts` | `CAP-PFM-SEC-002` |

  | `listSecurityAuditEvents` | `CAP-PFM-SEC-011` |

  | `listSecurityPolicies` | `CAP-PFM-SEC-012` |

  | `listSecurityRoleMembers` | `CAP-PFM-SEC-010` |

  | `listSecurityRoles` | `CAP-PFM-SEC-012` |

  | `listTenantApplicationsForTenant` | `CAP-PFM-SEC-002` |

  | `listTenantDeletionRequests` | `CAP-PFM-SEC-004` |

  | `listTenantMembers` | `CAP-PFM-SEC-008` |

  | `listTenantStaffAccess` | `CAP-PFM-SEC-017` |

  | `listTenants` | `CAP-PFM-SEC-002` |

  | `listTenantsByParentId` | `CAP-PFM-SEC-002` |

  | `listUserIdentities` | `CAP-PFM-SEC-009` |

  | `listUsers` | `CAP-PFM-SEC-009` |

  | `onboardTenantPortal` | `CAP-PFM-SEC-019` |

  | `openHqEmergencyAccess` | `CAP-PFM-SEC-017` |

  | `patchCustomer` | `CAP-PFM-SEC-001` |

  | `patchHqCustomer` | `CAP-PFM-SEC-001` |

  | `patchHqTenant` | `CAP-PFM-SEC-002` |

  | `patchSecurityPolicy` | `CAP-PFM-SEC-012` |

  | `patchSecurityRole` | `CAP-PFM-SEC-012` |

  | `patchTenant` | `CAP-PFM-SEC-002` |

  | `patchUser` | `CAP-PFM-SEC-009` |

  | `pinMyHqTenantShortcut` | `CAP-PFM-SEC-002` |

  | `recordMyHqTenantShortcutOpened` | `CAP-PFM-SEC-002` |

  | `reinstateConsoleUser` | `CAP-PFM-SEC-009` |

  | `reinstateHqStaff` | `CAP-PFM-SEC-016` |

  | `reinstateUser` | `CAP-PFM-SEC-009` |

  | `releaseTenantDeletionRequest` | `CAP-PFM-SEC-004` |

  | `requestHqTenantAccess` | `CAP-PFM-SEC-017` |

  | `requestTenantDeletion` | `CAP-PFM-SEC-004` |

  | `resendConsoleUserInvitation` | `CAP-PFM-SEC-008` |

  | `resendHqStaffInvitation` | `CAP-PFM-SEC-016` |

  | `resendInvitation` | `CAP-PFM-SEC-008` |

  | `resendPortalVerification` | `CAP-PFM-SEC-019` |

  | `resetHqTenant` | `CAP-PFM-SEC-003` |

  | `resetOwnPassword` | `CAP-PFM-SEC-006` |

  | `resetUserPassword` | `CAP-PFM-SEC-006` |

  | `resolveTenantUserNames` | `CAP-PFM-SEC-007` |

  | `resumeHqServicePrincipal` | `CAP-PFM-SEC-018` |

  | `resumeTenantDeletionSchedule` | `CAP-PFM-SEC-004` |

  | `retryTenantProvisioning` | `CAP-PFM-SEC-003` |

  | `retryTenantPurge` | `CAP-PFM-SEC-004` |

  | `revokeConsoleUser` | `CAP-PFM-SEC-008` |

  | `revokeHqStaff` | `CAP-PFM-SEC-016` |

  | `revokeTenantStaffAccess` | `CAP-PFM-SEC-017` |

  | `revokeUser` | `CAP-PFM-SEC-008` |

  | `setConsoleUserRoleScope` | `CAP-PFM-SEC-010` |

  | `setSecurityRoleEligibility` | `CAP-PFM-SEC-014` |

  | `setTenantHubspotCompany` | `CAP-PFM-SEC-002` |

  | `signInPortalMember` | `CAP-PFM-SEC-019` |

  | `signOutPortalMember` | `CAP-PFM-SEC-019` |

  | `signUpPortalMember` | `CAP-PFM-SEC-019` |

  | `startPortalContactChallenge` | `CAP-PFM-SEC-020` |

  | `startPortalPasswordReset` | `CAP-PFM-SEC-019` |

  | `suspendConsoleUser` | `CAP-PFM-SEC-009` |

  | `suspendHqServicePrincipal` | `CAP-PFM-SEC-018` |

  | `suspendHqStaff` | `CAP-PFM-SEC-016` |

  | `suspendUser` | `CAP-PFM-SEC-009` |

  | `unpinMyHqTenantShortcut` | `CAP-PFM-SEC-002` |

  | `updateConsoleUserDetails` | `CAP-PFM-SEC-009` |

  | `updateCustomer` | `CAP-PFM-SEC-001` |

  | `updateTenant` | `CAP-PFM-SEC-002` |

  | `updateUser` | `CAP-PFM-SEC-009` |

  | `validateSecurityPolicyRules` | `CAP-PFM-SEC-012` |

  | `verifyPortalContactChallenge` | `CAP-PFM-SEC-020` |

  | `verifyPortalEmail` | `CAP-PFM-SEC-019` |

  | `withdrawConsoleUserRole` | `CAP-PFM-SEC-010` |

  | `withdrawHqTenantAccessRequest` | `CAP-PFM-SEC-017` |


  ### Table-declaration mapping


  | Table file | Capabilities |

  |---|---|

  | `authentication-identities.table.ts` | `CAP-PFM-SEC-005` |

  | `authorizer-flush-job-events.table.ts` | `CAP-PFM-SEC-015` |

  | `authorizer-flush-job-steps.table.ts` | `CAP-PFM-SEC-015` |

  | `authorizer-flush-jobs.table.ts` | `CAP-PFM-SEC-015` |

  | `customers.table.ts` | `CAP-PFM-SEC-001` |

  | `derived-assignment-reconcile-job-events.table.ts` | `CAP-PFM-SEC-014` |

  | `derived-assignment-reconcile-job-steps.table.ts` | `CAP-PFM-SEC-014` |

  | `derived-assignment-reconcile-jobs.table.ts` | `CAP-PFM-SEC-014` |

  | `derived-assignment-reconciles.table.ts` | `CAP-PFM-SEC-014` |

  | `external-identities.table.ts` | `CAP-PFM-SEC-005` |

  | `former-users.table.ts` | `CAP-PFM-SEC-009` |

  | `identity-link-sessions.table.ts` | `CAP-PFM-SEC-005` |

  | `identity-pools.table.ts` | `CAP-PFM-SEC-006`, `CAP-PFM-SEC-015`,
  `CAP-PFM-SEC-019` |

  | `pool-account-removals.table.ts` | `CAP-PFM-SEC-009` |

  | `portal-contact-challenges.table.ts` | `CAP-PFM-SEC-020` |

  | `security-assignments.table.ts` | `CAP-PFM-SEC-007`, `CAP-PFM-SEC-010` |

  | `security-audit-events.table.ts` | `CAP-PFM-SEC-011` |

  | `security-catalog-releases.table.ts` | `CAP-PFM-SEC-013` |

  | `security-permissions.table.ts` | `CAP-PFM-SEC-013` |

  | `security-policies.table.ts` | `CAP-PFM-SEC-012` |

  | `security-role-policies.table.ts` | `CAP-PFM-SEC-012` |

  | `security-roles.table.ts` | `CAP-PFM-SEC-012` |

  | `security-rules.table.ts` | `CAP-PFM-SEC-012` |

  | `service-principals.table.ts` | `CAP-PFM-SEC-018` |

  | `staff-access-grants.table.ts` | `CAP-PFM-SEC-017` |

  | `staff-tenant-shortcuts.table.ts` | `CAP-PFM-SEC-002` |

  | `tenant-deletion-notices.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-deletion-requests.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-deletion-schedule-job-events.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-deletion-schedule-job-steps.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-deletion-schedule-jobs.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-portal-onboarding-job-events.table.ts` | `CAP-PFM-SEC-019` |

  | `tenant-portal-onboarding-job-steps.table.ts` | `CAP-PFM-SEC-019` |

  | `tenant-portal-onboarding-jobs.table.ts` | `CAP-PFM-SEC-019` |

  | `tenant-provisioning-job-events.table.ts` | `CAP-PFM-SEC-003` |

  | `tenant-provisioning-job-steps.table.ts` | `CAP-PFM-SEC-003` |

  | `tenant-provisioning-jobs.table.ts` | `CAP-PFM-SEC-003` |

  | `tenant-purge-job-events.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-purge-job-steps.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-purge-jobs.table.ts` | `CAP-PFM-SEC-004` |

  | `tenant-reset-job-events.table.ts` | `CAP-PFM-SEC-003` |

  | `tenant-reset-job-steps.table.ts` | `CAP-PFM-SEC-003` |

  | `tenant-reset-jobs.table.ts` | `CAP-PFM-SEC-003` |

  | `tenant-resources.table.ts` | `CAP-PFM-SEC-003` |

  | `tenant-seed-applications.table.ts` | `CAP-PFM-SEC-003` |

  | `tenants.table.ts` | `CAP-PFM-SEC-002` |

  | `user-invitations.table.ts` | `CAP-PFM-SEC-005`, `CAP-PFM-SEC-008` |

  | `user-lifecycle-events.table.ts` | `CAP-PFM-SEC-008`, `CAP-PFM-SEC-009`,
  `CAP-PFM-SEC-011` |

  | `user-password-events.table.ts` | `CAP-PFM-SEC-006` |

  | `users.table.ts` | `CAP-PFM-SEC-007`, `CAP-PFM-SEC-008`, `CAP-PFM-SEC-009`,
  `CAP-PFM-SEC-016` |


  ### Published permission mapping


  | Permission key | Capability or evidence home |

  |---|---|

  | `platform.customers.read` | CAP-PFM-SEC-001 |

  | `platform.customers.update` | CAP-PFM-SEC-001 |

  | `platform.customers.bulk` | FND-PFM-SEC-005; CAP-PFM-SEC-001 evidence |

  | `platform.tenants.read` | CAP-PFM-SEC-002 |

  | `platform.tenants.update` | CAP-PFM-SEC-002 |

  | `platform.tenants.bulk` | FND-PFM-SEC-005; CAP-PFM-SEC-002 evidence |

  | `platform.tenants.onboard` | CAP-PFM-SEC-019 |

  | `platform.tenants.manage-status` | CAP-PFM-SEC-002 |

  | `platform.tenants.manage-commercial-link` | CAP-PFM-SEC-002 |

  | `platform.tenants.deletion-request` | CAP-PFM-SEC-004 |

  | `platform.tenants.deletion-hold` | CAP-PFM-SEC-004 |

  | `platform.tenants.deletion-cancel` | CAP-PFM-SEC-004 |

  | `platform.tenants.deletion-read` | CAP-PFM-SEC-004 |

  | `platform.users.read` | CAP-PFM-SEC-006, CAP-PFM-SEC-008, CAP-PFM-SEC-009,
  CAP-PFM-SEC-010 |

  | `platform.users.create` | CAP-PFM-SEC-009 |

  | `platform.users.update` | CAP-PFM-SEC-009 |

  | `platform.users.delete` | CAP-PFM-SEC-009 |

  | `platform.users.bulk` | FND-PFM-SEC-005; CAP-PFM-SEC-009 evidence |

  | `platform.users.change-password` | CAP-PFM-SEC-006 |

  | `platform.users.manage-passwords` | CAP-PFM-SEC-006 |

  | `platform.users.manage-identities` | CAP-PFM-SEC-009 |

  | `platform.security-access.manage` | CAP-PFM-SEC-008, CAP-PFM-SEC-009,
  CAP-PFM-SEC-010 |

  | `platform.security-access.explain` | CAP-PFM-SEC-010, CAP-PFM-SEC-011 |

  | `platform.security-policies.read` | CAP-PFM-SEC-012 |

  | `platform.security-policies.manage` | CAP-PFM-SEC-012 |

  | `platform.security-roles.read` | CAP-PFM-SEC-012 |

  | `platform.security-roles.manage` | CAP-PFM-SEC-012, CAP-PFM-SEC-014 |

  | `platform.security-self.read` | CAP-PFM-SEC-007, CAP-PFM-SEC-015,
  CAP-PFM-SEC-019, CAP-PFM-SEC-020 |

  | `platform.staff-access.read` | CAP-PFM-SEC-017 |

  | `platform.staff-access.manage` | CAP-PFM-SEC-017 |

  | `platform.application.access` | CAP-PFM-SEC-007, CAP-PFM-SEC-015;
  FND-PFM-SEC-005 |

  | `hq.customers.read` | CAP-PFM-SEC-001 |

  | `hq.customers.create` | CAP-PFM-SEC-001 |

  | `hq.customers.update` | CAP-PFM-SEC-001 |

  | `hq.customers.delete` | CAP-PFM-SEC-001 |

  | `hq.tenants.read` | CAP-PFM-SEC-002, CAP-PFM-SEC-003, CAP-PFM-SEC-017 |

  | `hq.tenants.update` | CAP-PFM-SEC-002 |

  | `hq.tenants.provision` | CAP-PFM-SEC-003 |

  | `hq.tenants.activate` | CAP-PFM-SEC-003 |

  | `hq.data-runs.manage` | CAP-PFM-SEC-003 (shared with MOD-PFM-OPS) |

  | `hq.staff.read` | CAP-PFM-SEC-016 |

  | `hq.staff.invite` | CAP-PFM-SEC-016 |

  | `hq.staff.disable` | CAP-PFM-SEC-016 |

  | `hq.staff.update` | FND-PFM-SEC-005; CAP-PFM-SEC-016 evidence |

  | `hq.roles.read` | FND-PFM-SEC-005; CAP-PFM-SEC-016 evidence |

  | `hq.roles.manage` | CAP-PFM-SEC-016 |

  | `hq.service-principals.read` | CAP-PFM-SEC-018 |

  | `hq.service-principals.manage` | CAP-PFM-SEC-018 |

  | `hq.tenant-access.read` | CAP-PFM-SEC-017 |

  | `hq.tenant-access.request` | CAP-PFM-SEC-017 |

  | `hq.emergency-access.use` | CAP-PFM-SEC-017 |

  | `hq.audit.read` | CAP-PFM-SEC-017 |


  ### Backend end-to-end file mapping


  | Spec file | Capabilities |

  |---|---|

  | `customers.e2e.spec.js` (customers) | CAP-PFM-SEC-001 |

  | `hq-customers.e2e.spec.js` (customers) | CAP-PFM-SEC-001 |

  | `hq-tenant-loading.e2e.spec.js` (tenants) | CAP-PFM-SEC-003 |

  | `hq-tenant-shortcuts.e2e.spec.js` (tenants) | CAP-PFM-SEC-002 |

  | `hq-tenants.e2e.spec.js` (tenants) | CAP-PFM-SEC-002 |

  | `tenant-availability-gate.e2e.spec.js` (tenants) | CAP-PFM-SEC-002 |

  | `tenant-deletion-recovery.e2e.spec.js` (tenants) | CAP-PFM-SEC-004 |

  | `tenant-deletion-requests.e2e.spec.js` (tenants) | CAP-PFM-SEC-004,
  CAP-PFM-SEC-002 |

  | `tenant-email-sender.e2e.spec.js` (tenants) | CAP-PFM-SEC-002 |

  | `tenant-hubspot-link.e2e.spec.js` (tenants) | CAP-PFM-SEC-002 |

  | `tenant-provisioning-alerts.e2e.spec.js` (tenants) | CAP-PFM-SEC-003 |

  | `tenant-provisioning.e2e.spec.js` (tenants) | CAP-PFM-SEC-003 |

  | `tenants.e2e.spec.js` (tenants) | CAP-PFM-SEC-002, CAP-PFM-SEC-003,
  CAP-PFM-SEC-007 |

  | `access.e2e.spec.js` (security) | CAP-PFM-SEC-007, CAP-PFM-SEC-019 |

  | `application-access-enforced.e2e.spec.js` (security) | CAP-PFM-SEC-015,
  CAP-PFM-SEC-007 |

  | `application-access.e2e.spec.js` (security) | CAP-PFM-SEC-015 |

  | `approved-access.e2e.spec.js` (security) | CAP-PFM-SEC-017 |

  | `built-in-administrator-staff-access.e2e.spec.js` (security) |
  CAP-PFM-SEC-017 |

  | `console-users.e2e.spec.js` (security) | CAP-PFM-SEC-009, CAP-PFM-SEC-010,
  CAP-PFM-SEC-011 |

  | `definitions.e2e.spec.js` (security) | CAP-PFM-SEC-012, CAP-PFM-SEC-010 |

  | `derived-assignments.e2e.spec.js` (security) | CAP-PFM-SEC-014 |

  | `eligibility-conditions.e2e.spec.js` (security) | CAP-PFM-SEC-014 |

  | `grant-checks.e2e.spec.js` (security) | CAP-PFM-SEC-010 |

  | `hq-staff-and-roles.e2e.spec.js` (security) | CAP-PFM-SEC-016 |

  | `hq-staff-detail.e2e.spec.js` (security) | CAP-PFM-SEC-016, CAP-PFM-SEC-017
  |

  | `hq-staff-resend.e2e.spec.js` (security) | CAP-PFM-SEC-016 |

  | `hq-tenant-roles.e2e.spec.js` (security) | CAP-PFM-SEC-017 |

  | `invitations.e2e.spec.js` (security) | CAP-PFM-SEC-005, CAP-PFM-SEC-008,
  CAP-PFM-SEC-009 |

  | `licensing.e2e.spec.js` (security) | CAP-PFM-SEC-015 (licence step;
  licensing itself is MOD-PFM-OPS) |

  | `power-user-staff-access.e2e.spec.js` (security) | CAP-PFM-SEC-017 |

  | `resource-scoped-grants.e2e.spec.js` (security) | CAP-PFM-SEC-010 |

  | `role-eligibility.e2e.spec.js` (security) | CAP-PFM-SEC-014 |

  | `security-context.e2e.spec.js` (security) | CAP-PFM-SEC-007 |

  | `staff-access.e2e.spec.js` (security) | CAP-PFM-SEC-017 |

  | `staff-separation.e2e.spec.js` (security) | CAP-PFM-SEC-015 |

  | `user-names.e2e.spec.js` (security) | CAP-PFM-SEC-007 |

  | `users.e2e.spec.js` (security) | CAP-PFM-SEC-006, CAP-PFM-SEC-009,
  CAP-PFM-SEC-019 |


  Additional dependency keys: `platform.tenant-applications.read` (licensing,
  MOD-PFM-OPS), named in CAP-PFM-SEC-002 evidence, and
  `platform.eligibility.reconcile` (MOD-PFM-ELG), named in CAP-PFM-SEC-014.


  ### Asynchronous resource mapping


  | Declaration | Home |

  |---|---|

  | `SecurityPoolAccountRemovalsQueue` | `CAP-PFM-SEC-009` |

  | `SecurityPoolAccountRemovalsDeadLetterQueue` | `FND-PFM-SEC-036` |

  | `SecurityDerivedAssignmentReconcilesQueue` | `CAP-PFM-SEC-014` |

  | `SecurityDerivedAssignmentReconcilesDeadLetterQueue` | `FND-PFM-SEC-036` |

  | `SecurityPoolRemovalDispatcherSchedule` | `CAP-PFM-SEC-009` |

  | `SecurityReconcileDispatcherSchedule` | `CAP-PFM-SEC-014` |

  | `SecurityDerivedAssignmentSchedulerSchedule` | `CAP-PFM-SEC-014` |


  ### Browser specification mapping


  | File | Specification home |

  |---|---|

  | `e2e/controlled/invitation-expired.controlled.spec.ts` | `CAP-PFM-SEC-005`,
  `CAP-PFM-SEC-008` |

  | `e2e/controlled/reset-code-expired.controlled.spec.ts` | `CAP-PFM-SEC-006` |

  | `e2e/controlled/security-context.controlled.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/controlled/social-callback.controlled.spec.ts` | `CAP-PFM-SEC-006` |

  | `e2e/controlled/staff-deep-link.controlled.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/controlled/tenant-unavailable.controlled.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/dev/hq-home.dev.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/dev/hq-ops.dev.spec.ts` | `CAP-PFM-SEC-001`, `CAP-PFM-SEC-002`,
  `CAP-PFM-SEC-003` |

  | `e2e/dev/hq-staff-flow.dev.spec.ts` | `CAP-PFM-SEC-016` |

  | `e2e/dev/invitations.dev.spec.ts` | `CAP-PFM-SEC-005`, `CAP-PFM-SEC-008` |

  | `e2e/dev/password-recovery.dev.spec.ts` | `CAP-PFM-SEC-006` |

  | `e2e/dev/permissions.dev.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/dev/rhythm-access.dev.spec.ts` | `CAP-PFM-SEC-017` |

  | `e2e/dev/session.dev.spec.ts` | `CAP-PFM-SEC-006` |

  | `e2e/dev/sign-in.dev.spec.ts` | `CAP-PFM-SEC-006` |

  | `e2e/dev/social-sign-in.dev.spec.ts` | `CAP-PFM-SEC-006` |

  | `e2e/mock/application-access.mock.spec.ts` | `CAP-PFM-SEC-015` |

  | `e2e/mock/hq-home.mock.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/mock/hq-lists.mock.spec.ts` | `CAP-PFM-SEC-017` |

  | `e2e/mock/hq-ops.mock.spec.ts` | `CAP-PFM-SEC-001`, `CAP-PFM-SEC-002`,
  `CAP-PFM-SEC-003` |

  | `e2e/mock/security-admin.mock.spec.ts` | `CAP-PFM-SEC-009`,
  `CAP-PFM-SEC-010` |

  | `e2e/mock/security-editor-bar.mock.spec.ts` | `CAP-PFM-SEC-012` |

  | `e2e/mock/security-granted-tenant.mock.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/mock/security-scoped-roles.mock.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/mock/security-view-edit.mock.spec.ts` | `CAP-PFM-SEC-009`,
  `CAP-PFM-SEC-010` |

  | `e2e/mock/staff-landing.mock.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/security/access.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/security/invitations.spec.ts` | `CAP-PFM-SEC-005`, `CAP-PFM-SEC-008` |

  | `e2e/security/navigation.spec.ts` | `CAP-PFM-SEC-007` |

  | `e2e/security/policies.spec.ts` | `CAP-PFM-SEC-012` |

  | `e2e/security/roles.spec.ts` | `CAP-PFM-SEC-012` |

  | `e2e/security/users.spec.ts` | `CAP-PFM-SEC-009`, `CAP-PFM-SEC-010` |
testing_artifacts:
  capability_specifications:
    - design/tests/ATS-PFM-SEC-001-onboard-a-customer-and-keep-its-record.md
    - >-
      design/tests/ATS-PFM-SEC-002-keep-a-workspace-s-details-status-and-commercial-link.md
    - >-
      design/tests/ATS-PFM-SEC-003-provision-a-workspace-and-bring-it-into-service.md
    - >-
      design/tests/ATS-PFM-SEC-004-retire-a-workspace-through-a-deliberate-reversible-deletion.md
    - design/tests/ATS-PFM-SEC-005-accept-an-invitation-and-set-up-an-account.md
    - >-
      design/tests/ATS-PFM-SEC-006-sign-in-stay-signed-in-and-recover-a-password.md
    - design/tests/ATS-PFM-SEC-007-know-what-i-may-do-in-a-workspace.md
    - design/tests/ATS-PFM-SEC-008-invite-people-and-follow-their-invitations.md
    - design/tests/ATS-PFM-SEC-009-maintain-people-s-console-accounts.md
    - >-
      design/tests/ATS-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md
    - >-
      design/tests/ATS-PFM-SEC-011-review-who-changed-access-and-what-was-refused.md
    - design/tests/ATS-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md
    - >-
      design/tests/ATS-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md
    - >-
      design/tests/ATS-PFM-SEC-014-grant-roles-automatically-from-appointments-and-eligibility.md
    - >-
      design/tests/ATS-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md
    - >-
      design/tests/ATS-PFM-SEC-016-run-rhythm-s-own-staff-accounts-and-hq-roles.md
    - >-
      design/tests/ATS-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md
    - >-
      design/tests/ATS-PFM-SEC-018-stop-and-restart-another-service-s-calls-into-rhythm.md
    - >-
      design/tests/ATS-PFM-SEC-019-let-members-sign-up-and-sign-in-on-a-workspace-s-portal.md
    - >-
      design/tests/ATS-PFM-SEC-020-link-a-portal-member-to-their-contact-record.md
  feature_acceptance_suites:
    - planning/acceptance/FAS-PFM-SEC-01-customers-and-workspaces.md
    - planning/acceptance/FAS-PFM-SEC-02-signing-in.md
    - planning/acceptance/FAS-PFM-SEC-03-console-user-administration.md
    - >-
      planning/acceptance/FAS-PFM-SEC-04-roles-policies-and-request-authorization.md
    - planning/acceptance/FAS-PFM-SEC-05-rhythm-staff-and-their-access.md
    - planning/acceptance/FAS-PFM-SEC-06-portal-identity.md
  executable_suites:
    - implementation/tests/TST-PFM-SEC-001-ra-acc-0200.md
    - implementation/tests/TST-PFM-SEC-002-ra-acc-0201.md
    - implementation/tests/TST-PFM-SEC-003-ra-acc-0202.md
    - implementation/tests/TST-PFM-SEC-004-invitation-expired.md
    - implementation/tests/TST-PFM-SEC-005-reset-code-expired.md
    - implementation/tests/TST-PFM-SEC-006-security-context.md
    - implementation/tests/TST-PFM-SEC-007-social-callback.md
    - implementation/tests/TST-PFM-SEC-008-staff-deep-link.md
    - implementation/tests/TST-PFM-SEC-009-workspace-unavailable.md
    - implementation/tests/TST-PFM-SEC-010-hq-home.md
    - implementation/tests/TST-PFM-SEC-011-hq-ops.md
    - implementation/tests/TST-PFM-SEC-012-hq-staff-flow.md
    - implementation/tests/TST-PFM-SEC-013-invitations.md
    - implementation/tests/TST-PFM-SEC-014-password-recovery.md
    - implementation/tests/TST-PFM-SEC-015-permissions.md
    - implementation/tests/TST-PFM-SEC-016-rhythm-access.md
    - implementation/tests/TST-PFM-SEC-017-session.md
    - implementation/tests/TST-PFM-SEC-018-sign-in.md
    - implementation/tests/TST-PFM-SEC-019-social-sign-in.md
    - implementation/tests/TST-PFM-SEC-020-application-access.md
    - implementation/tests/TST-PFM-SEC-021-hq-home.md
    - implementation/tests/TST-PFM-SEC-022-hq-lists.md
    - implementation/tests/TST-PFM-SEC-023-hq-ops.md
    - implementation/tests/TST-PFM-SEC-024-security-admin.md
    - implementation/tests/TST-PFM-SEC-025-security-editor-bar.md
    - implementation/tests/TST-PFM-SEC-026-security-granted-workspace.md
    - implementation/tests/TST-PFM-SEC-027-security-scoped-roles.md
    - implementation/tests/TST-PFM-SEC-028-security-view-edit.md
    - implementation/tests/TST-PFM-SEC-029-staff-landing.md
    - implementation/tests/TST-PFM-SEC-030-access.md
    - implementation/tests/TST-PFM-SEC-031-invitations.md
    - implementation/tests/TST-PFM-SEC-032-navigation.md
    - implementation/tests/TST-PFM-SEC-033-policies.md
    - implementation/tests/TST-PFM-SEC-034-roles.md
    - implementation/tests/TST-PFM-SEC-035-users.md
    - implementation/tests/TST-PFM-SEC-036-invitation-flow.md
    - implementation/tests/TST-PFM-SEC-037-invitations.md
    - implementation/tests/TST-PFM-SEC-038-refresh-refusal.md
    - implementation/tests/TST-PFM-SEC-039-safe-next.md
    - implementation/tests/TST-PFM-SEC-040-session.md
    - implementation/tests/TST-PFM-SEC-041-customers.md
    - implementation/tests/TST-PFM-SEC-042-hq-customers.md
    - implementation/tests/TST-PFM-SEC-043-customers-table.md
    - implementation/tests/TST-PFM-SEC-044-customers.md
    - implementation/tests/TST-PFM-SEC-045-customers-queries.md
    - implementation/tests/TST-PFM-SEC-046-access.md
    - implementation/tests/TST-PFM-SEC-047-application-access-enforced.md
    - implementation/tests/TST-PFM-SEC-048-application-access.md
    - implementation/tests/TST-PFM-SEC-049-approved-access.md
    - >-
      implementation/tests/TST-PFM-SEC-050-built-in-administrator-staff-access.md
    - implementation/tests/TST-PFM-SEC-051-console-users.md
    - implementation/tests/TST-PFM-SEC-052-definitions.md
    - implementation/tests/TST-PFM-SEC-053-derived-assignments.md
    - implementation/tests/TST-PFM-SEC-054-eligibility-conditions.md
    - implementation/tests/TST-PFM-SEC-055-grant-checks.md
    - implementation/tests/TST-PFM-SEC-056-hq-staff-and-roles.md
    - implementation/tests/TST-PFM-SEC-057-hq-staff-detail.md
    - implementation/tests/TST-PFM-SEC-058-hq-staff-resend.md
    - implementation/tests/TST-PFM-SEC-059-hq-workspace-roles.md
    - implementation/tests/TST-PFM-SEC-060-invitations.md
    - implementation/tests/TST-PFM-SEC-061-licensing.md
    - implementation/tests/TST-PFM-SEC-062-power-user-staff-access.md
    - implementation/tests/TST-PFM-SEC-063-resource-scoped-grants.md
    - implementation/tests/TST-PFM-SEC-064-role-eligibility.md
    - implementation/tests/TST-PFM-SEC-065-security-context.md
    - implementation/tests/TST-PFM-SEC-066-staff-access.md
    - implementation/tests/TST-PFM-SEC-067-staff-separation.md
    - implementation/tests/TST-PFM-SEC-068-user-names.md
    - implementation/tests/TST-PFM-SEC-069-users.md
    - implementation/tests/TST-PFM-SEC-070-authorizer-flush-job-events-table.md
    - implementation/tests/TST-PFM-SEC-071-authorizer-flush-job-steps-table.md
    - implementation/tests/TST-PFM-SEC-072-former-users-table.md
    - implementation/tests/TST-PFM-SEC-073-role-holders.md
    - implementation/tests/TST-PFM-SEC-074-security-definition-integrity.md
    - implementation/tests/TST-PFM-SEC-075-security-roles-eligibility-table.md
    - implementation/tests/TST-PFM-SEC-076-service-principals-table.md
    - >-
      implementation/tests/TST-PFM-SEC-077-workspace-portal-onboarding-job-events-table.md
    - >-
      implementation/tests/TST-PFM-SEC-078-workspace-portal-onboarding-job-steps-table.md
    - implementation/tests/TST-PFM-SEC-079-user-display-name.md
    - implementation/tests/TST-PFM-SEC-080-authorizer-flush-correlation.md
    - implementation/tests/TST-PFM-SEC-081-authorizer-flush-workflow.md
    - implementation/tests/TST-PFM-SEC-082-nightly-reconcile.md
    - implementation/tests/TST-PFM-SEC-083-invitation-arc.md
    - implementation/tests/TST-PFM-SEC-084-user-provisioning.md
    - implementation/tests/TST-PFM-SEC-085-access-document.md
    - implementation/tests/TST-PFM-SEC-086-portal-pool-discovery.md
    - implementation/tests/TST-PFM-SEC-087-security-context-by-id.md
    - implementation/tests/TST-PFM-SEC-088-security-context-round-trips.md
    - implementation/tests/TST-PFM-SEC-089-staff-self-access.md
    - implementation/tests/TST-PFM-SEC-090-authorizer-eligibility.md
    - implementation/tests/TST-PFM-SEC-091-authorizer-portal-contact.md
    - implementation/tests/TST-PFM-SEC-092-authorizer-ports.md
    - implementation/tests/TST-PFM-SEC-093-export-authority.md
    - implementation/tests/TST-PFM-SEC-094-hq-roles.md
    - implementation/tests/TST-PFM-SEC-095-reconcile-catalog.md
    - implementation/tests/TST-PFM-SEC-096-release-manifest-built-ins.md
    - implementation/tests/TST-PFM-SEC-097-staff-access-authority.md
    - implementation/tests/TST-PFM-SEC-098-definition-flush.md
    - implementation/tests/TST-PFM-SEC-099-eligibility-conditions.md
    - implementation/tests/TST-PFM-SEC-100-manage-policies.md
    - implementation/tests/TST-PFM-SEC-101-manage-roles.md
    - implementation/tests/TST-PFM-SEC-102-role-request-scope.md
    - implementation/tests/TST-PFM-SEC-103-reconcile.md
    - implementation/tests/TST-PFM-SEC-104-sign-in-reconcile.md
    - implementation/tests/TST-PFM-SEC-105-acceptance-administrator.md
    - implementation/tests/TST-PFM-SEC-106-acceptance-definitions.md
    - implementation/tests/TST-PFM-SEC-107-acceptance-workspace-access.md
    - implementation/tests/TST-PFM-SEC-108-content-editor-fixtures.md
    - implementation/tests/TST-PFM-SEC-109-dev-fixture-workspaces.md
    - implementation/tests/TST-PFM-SEC-110-portal-fixtures.md
    - implementation/tests/TST-PFM-SEC-111-require-well-known-records.md
    - implementation/tests/TST-PFM-SEC-112-websites-editor-fixtures.md
    - implementation/tests/TST-PFM-SEC-113-derived-assignment-reconciles.md
    - implementation/tests/TST-PFM-SEC-114-pool-account-removals.md
    - implementation/tests/TST-PFM-SEC-115-evaluated-route-keys.md
    - implementation/tests/TST-PFM-SEC-116-grant-slice-trimming.md
    - implementation/tests/TST-PFM-SEC-117-delete-user.md
    - implementation/tests/TST-PFM-SEC-118-inviter-authority.md
    - implementation/tests/TST-PFM-SEC-119-resend-staff-invitation.md
    - implementation/tests/TST-PFM-SEC-120-resolve-current-user.md
    - implementation/tests/TST-PFM-SEC-121-revoke-lockout.md
    - implementation/tests/TST-PFM-SEC-122-amend-grant.md
    - implementation/tests/TST-PFM-SEC-123-concurrent-grants.md
    - implementation/tests/TST-PFM-SEC-124-console-users.md
    - implementation/tests/TST-PFM-SEC-125-effective-permissions.md
    - implementation/tests/TST-PFM-SEC-126-grant-history.md
    - implementation/tests/TST-PFM-SEC-127-live-grant-migration.md
    - implementation/tests/TST-PFM-SEC-128-manage-assignments.md
    - implementation/tests/TST-PFM-SEC-129-resource-scopes.md
    - implementation/tests/TST-PFM-SEC-130-set-role-scope.md
    - implementation/tests/TST-PFM-SEC-131-user-names.md
    - implementation/tests/TST-PFM-SEC-132-ensure-workspace-portal.md
    - implementation/tests/TST-PFM-SEC-133-portal-pool-removal.md
    - implementation/tests/TST-PFM-SEC-134-reserve-portal-pool.md
    - implementation/tests/TST-PFM-SEC-135-assignments-derived.md
    - implementation/tests/TST-PFM-SEC-136-assignments-derived-queries.md
    - implementation/tests/TST-PFM-SEC-137-assignments-eligibility-queries.md
    - implementation/tests/TST-PFM-SEC-138-assignments-grants-queries.md
    - implementation/tests/TST-PFM-SEC-139-assignments.md
    - implementation/tests/TST-PFM-SEC-140-assignments-queries.md
    - implementation/tests/TST-PFM-SEC-141-audit-events.md
    - implementation/tests/TST-PFM-SEC-142-audit-events-queries.md
    - implementation/tests/TST-PFM-SEC-143-authentication-identities.md
    - implementation/tests/TST-PFM-SEC-144-authentication-identities-queries.md
    - implementation/tests/TST-PFM-SEC-145-authorizer-flush-jobs.md
    - implementation/tests/TST-PFM-SEC-146-authorizer-flush-jobs-queries.md
    - implementation/tests/TST-PFM-SEC-147-catalog-releases.md
    - implementation/tests/TST-PFM-SEC-148-catalog-releases-queries.md
    - implementation/tests/TST-PFM-SEC-149-identity-link-sessions.md
    - implementation/tests/TST-PFM-SEC-150-identity-link-sessions-queries.md
    - implementation/tests/TST-PFM-SEC-151-identity-pools.md
    - implementation/tests/TST-PFM-SEC-152-identity-pools-queries.md
    - implementation/tests/TST-PFM-SEC-153-invitations.md
    - implementation/tests/TST-PFM-SEC-154-invitations-queries.md
    - implementation/tests/TST-PFM-SEC-155-permissions.md
    - implementation/tests/TST-PFM-SEC-156-permissions-queries.md
    - implementation/tests/TST-PFM-SEC-157-policies.md
    - implementation/tests/TST-PFM-SEC-158-policies-queries.md
    - implementation/tests/TST-PFM-SEC-159-pool-account-removals.md
    - implementation/tests/TST-PFM-SEC-160-portal-contact-challenges.md
    - implementation/tests/TST-PFM-SEC-161-portal-contact-challenges-queries.md
    - implementation/tests/TST-PFM-SEC-162-roles-eligibility.md
    - implementation/tests/TST-PFM-SEC-163-roles.md
    - implementation/tests/TST-PFM-SEC-164-roles-queries.md
    - implementation/tests/TST-PFM-SEC-165-rules.md
    - implementation/tests/TST-PFM-SEC-166-rules-queries.md
    - implementation/tests/TST-PFM-SEC-167-service-principals.md
    - implementation/tests/TST-PFM-SEC-168-service-principals-queries.md
    - implementation/tests/TST-PFM-SEC-169-staff-access-grants-queries.md
    - implementation/tests/TST-PFM-SEC-170-workspace-portal-onboarding-jobs.md
    - >-
      implementation/tests/TST-PFM-SEC-171-workspace-portal-onboarding-jobs-queries.md
    - implementation/tests/TST-PFM-SEC-172-users.md
    - implementation/tests/TST-PFM-SEC-173-users-portal-members.md
    - implementation/tests/TST-PFM-SEC-174-users-queries.md
    - implementation/tests/TST-PFM-SEC-175-contact-match.md
    - implementation/tests/TST-PFM-SEC-176-ensure-founding-staff.md
    - implementation/tests/TST-PFM-SEC-177-ensure-service-principals.md
    - implementation/tests/TST-PFM-SEC-178-post-confirmation.md
    - implementation/tests/TST-PFM-SEC-179-register-console-pool.md
    - implementation/tests/TST-PFM-SEC-180-resolve-grant-slice.md
    - implementation/tests/TST-PFM-SEC-181-resource-scoped-gateway.md
    - implementation/tests/TST-PFM-SEC-182-get-security-context.md
    - implementation/tests/TST-PFM-SEC-183-licensed-applications.md
    - implementation/tests/TST-PFM-SEC-184-hq-service-principals-routes.md
    - implementation/tests/TST-PFM-SEC-185-registered-principals.md
    - implementation/tests/TST-PFM-SEC-186-approved-workspace-access.md
    - implementation/tests/TST-PFM-SEC-187-customer-named-security-routes.md
    - implementation/tests/TST-PFM-SEC-188-customer-standing-access.md
    - implementation/tests/TST-PFM-SEC-189-ensure-standing-access.md
    - implementation/tests/TST-PFM-SEC-190-open-emergency-access.md
    - >-
      implementation/tests/TST-PFM-SEC-191-rhythm-administrator-standing-access.md
    - implementation/tests/TST-PFM-SEC-192-staff-customer-administration.md
    - implementation/tests/TST-PFM-SEC-193-staff-member-access-grants.md
    - implementation/tests/TST-PFM-SEC-194-authorize.md
    - implementation/tests/TST-PFM-SEC-195-authorizer-source.md
    - implementation/tests/TST-PFM-SEC-196-registry-manifest.md
    - implementation/tests/TST-PFM-SEC-197-registry-publish.md
    - implementation/tests/TST-PFM-SEC-198-service-function-rules.md
    - implementation/tests/TST-PFM-SEC-199-security-context.md
    - implementation/tests/TST-PFM-SEC-200-catalog-plan.md
    - implementation/tests/TST-PFM-SEC-201-export-authority.md
    - implementation/tests/TST-PFM-SEC-202-reconcile-catalog.md
    - implementation/tests/TST-PFM-SEC-203-staff-access-authority.md
    - implementation/tests/TST-PFM-SEC-204-link-cognito-identity.md
    - implementation/tests/TST-PFM-SEC-205-accept-invitation.md
    - implementation/tests/TST-PFM-SEC-206-activate-user.md
    - implementation/tests/TST-PFM-SEC-207-google-acceptance.md
    - implementation/tests/TST-PFM-SEC-208-invitation-email.md
    - implementation/tests/TST-PFM-SEC-209-invitation-summary.md
    - implementation/tests/TST-PFM-SEC-210-invite-user.md
    - implementation/tests/TST-PFM-SEC-211-resend-invitation.md
    - implementation/tests/TST-PFM-SEC-212-suspend-revoke.md
    - implementation/tests/TST-PFM-SEC-213-widening.md
    - implementation/tests/TST-PFM-SEC-214-permission-matcher.md
    - implementation/tests/TST-PFM-SEC-215-rule-validation.md
    - implementation/tests/TST-PFM-SEC-216-candidate-token.md
    - implementation/tests/TST-PFM-SEC-217-contact-match-rules.md
    - implementation/tests/TST-PFM-SEC-218-portal-identity.md
    - implementation/tests/TST-PFM-SEC-219-verification-code-sender.md
    - implementation/tests/TST-PFM-SEC-220-hq-workspace-loading.md
    - implementation/tests/TST-PFM-SEC-221-hq-workspace-shortcuts.md
    - implementation/tests/TST-PFM-SEC-222-hq-workspaces.md
    - implementation/tests/TST-PFM-SEC-223-workspace-availability-gate.md
    - implementation/tests/TST-PFM-SEC-224-workspace-deletion-recovery.md
    - implementation/tests/TST-PFM-SEC-225-workspace-deletion-requests.md
    - implementation/tests/TST-PFM-SEC-226-workspace-email-sender.md
    - implementation/tests/TST-PFM-SEC-227-workspace-hubspot-link.md
    - implementation/tests/TST-PFM-SEC-228-workspace-provisioning-alerts.md
    - implementation/tests/TST-PFM-SEC-229-workspace-provisioning.md
    - implementation/tests/TST-PFM-SEC-230-workspaces.md
    - implementation/tests/TST-PFM-SEC-231-workspace-declaration-completeness.md
    - implementation/tests/TST-PFM-SEC-232-workspaces-table.md
    - implementation/tests/TST-PFM-SEC-233-reconciled-job-failure.md
    - implementation/tests/TST-PFM-SEC-234-get-default-workspace.md
    - implementation/tests/TST-PFM-SEC-235-begin-destruction.md
    - implementation/tests/TST-PFM-SEC-236-deletion-holds.md
    - implementation/tests/TST-PFM-SEC-237-request-deletion.md
    - implementation/tests/TST-PFM-SEC-238-workspace-deletion-schedule.md
    - implementation/tests/TST-PFM-SEC-239-workspace-purge-functions.md
    - implementation/tests/TST-PFM-SEC-240-workspace-purge-recovery.md
    - implementation/tests/TST-PFM-SEC-241-workspace-purge.md
    - implementation/tests/TST-PFM-SEC-242-first-administrator.md
    - implementation/tests/TST-PFM-SEC-243-staff-workspace-shortcuts.md
    - implementation/tests/TST-PFM-SEC-244-staff-workspace-shortcuts-queries.md
    - implementation/tests/TST-PFM-SEC-245-workspace-deletion-requests.md
    - >-
      implementation/tests/TST-PFM-SEC-246-workspace-deletion-requests-queries.md
    - >-
      implementation/tests/TST-PFM-SEC-247-workspace-deletion-schedule-jobs-queries.md
    - >-
      implementation/tests/TST-PFM-SEC-248-workspace-provisioning-jobs-queries.md
    - implementation/tests/TST-PFM-SEC-249-workspace-purge-jobs-queries.md
    - implementation/tests/TST-PFM-SEC-250-workspace-reset-jobs-queries.md
    - implementation/tests/TST-PFM-SEC-251-workspace-resources.md
    - implementation/tests/TST-PFM-SEC-252-workspace-seed-applications.md
    - implementation/tests/TST-PFM-SEC-253-workspaces.md
    - implementation/tests/TST-PFM-SEC-254-workspaces-queries.md
    - implementation/tests/TST-PFM-SEC-255-initialize-workspace.md
    - implementation/tests/TST-PFM-SEC-256-provision-existing-workspace.md
    - >-
      implementation/tests/TST-PFM-SEC-257-provision-workspace-development-licences.md
    - implementation/tests/TST-PFM-SEC-258-provision-workspace.md
    - implementation/tests/TST-PFM-SEC-259-provisioning-notices.md
    - implementation/tests/TST-PFM-SEC-260-repair-stranded-provisioning.md
    - implementation/tests/TST-PFM-SEC-261-workspace-email-strategy.md
    - implementation/tests/TST-PFM-SEC-262-workspace-hubspot-link.md
    - implementation/tests/TST-PFM-SEC-263-reset-workspace.md
    - implementation/tests/TST-PFM-SEC-264-hq-workspace-list-mapper.md
    - implementation/tests/TST-PFM-SEC-265-workspace-provisioning-mapper.md
    - implementation/tests/TST-PFM-SEC-266-workspace-availability.md
---
# Security, Customers and Workspaces

## Purpose

This module connects customers and workspaces to the memberships and access used for Rhythm work. Customer administrators manage their colleagues’ access; Rhythm staff prepare customer environments and administer staff work through HQ. The planning layer separates product decisions from behavior observed in the pinned implementation.

## Boundary

The charter owns the records and administrative outcomes listed above. Cross-service lifecycle execution, data jobs, licensing, eligibility, notifications and CRM matching inputs remain dependencies with separate owners. The precise division of staff-facing lifecycle rules still needs the ownership decision recorded in the open questions. The reader projects these specifications and supplies no independent requirement authority.

## Features

| Feature | Owned active concepts | Capabilities | Journeys |
|---|---:|---:|---:|
| `FEAT-PFM-SEC-01` — Customer and Workspace Administration | 2 | 4 | 1 |
| `FEAT-PFM-SEC-02` — Console Entry and Sessions | 1 | 3 | 1 |
| `FEAT-PFM-SEC-03` — People and Access Administration | 0 | 4 | 1 |
| `FEAT-PFM-SEC-04` — Access Definitions and Authorization | 0 | 4 | 1 |
| `FEAT-PFM-SEC-05` — Staff Administration and Customer Entry | 0 | 3 | 1 |
| `FEAT-PFM-SEC-06` — Portal Membership and Identity | 0 | 2 | 0 |

## Capabilities

| Id | Title | Feature | Product intent | Implementation evidence |
|---|---|---|---|---|
| `CAP-PFM-SEC-001` | Establish and administer a customer | `FEAT-PFM-SEC-01` | confirmed | observed |
| `CAP-PFM-SEC-002` | Maintain workspace information and operating status | `FEAT-PFM-SEC-01` | confirmed | observed |
| `CAP-PFM-SEC-003` | Prepare a workspace for customer use | `FEAT-PFM-SEC-01` | confirmed | observed |
| `CAP-PFM-SEC-004` | Manage a workspace retirement request | `FEAT-PFM-SEC-01` | proposed | observed |
| `CAP-PFM-SEC-005` | Join through an invitation | `FEAT-PFM-SEC-02` | confirmed | observed |
| `CAP-PFM-SEC-006` | Use and recover a console sign-in | `FEAT-PFM-SEC-02` | confirmed | observed |
| `CAP-PFM-SEC-007` | Understand available workspace access | `FEAT-PFM-SEC-02` | confirmed | observed |
| `CAP-PFM-SEC-008` | Offer and manage an invitation | `FEAT-PFM-SEC-03` | confirmed | observed |
| `CAP-PFM-SEC-009` | Maintain console memberships | `FEAT-PFM-SEC-03` | confirmed | observed |
| `CAP-PFM-SEC-010` | Assign roles within a controlled scope | `FEAT-PFM-SEC-03` | confirmed | observed |
| `CAP-PFM-SEC-011` | Review security changes and refused attempts | `FEAT-PFM-SEC-03` | proposed | observed |
| `CAP-PFM-SEC-012` | Model customer responsibilities with roles and policies | `FEAT-PFM-SEC-04` | confirmed | observed |
| `CAP-PFM-SEC-013` | Publish shared access definitions from releases | `FEAT-PFM-SEC-04` | confirmed | observed |
| `CAP-PFM-SEC-014` | Derive member access from appointments and eligibility | `FEAT-PFM-SEC-04` | proposed | partially-observed |
| `CAP-PFM-SEC-015` | Enforce access at request boundaries | `FEAT-PFM-SEC-04` | confirmed | observed |
| `CAP-PFM-SEC-016` | Administer Rhythm staff memberships | `FEAT-PFM-SEC-05` | confirmed | observed |
| `CAP-PFM-SEC-017` | Control staff access to customer workspaces | `FEAT-PFM-SEC-05` | confirmed | observed |
| `CAP-PFM-SEC-018` | Suspend and resume service principals | `FEAT-PFM-SEC-05` | proposed | observed |
| `CAP-PFM-SEC-019` | Register and authenticate portal members | `FEAT-PFM-SEC-06` | proposed | partially-observed |
| `CAP-PFM-SEC-020` | Match portal memberships to CRM contacts | `FEAT-PFM-SEC-06` | proposed | observed |

## Journeys

| Id | Title | Feature | Product intent | Browser policy |
|---|---|---|---|---|
| `JNY-PFM-SEC-001` | Prepare and hand over a customer workspace | `FEAT-PFM-SEC-01` | confirmed | required |
| `JNY-PFM-SEC-002` | Join the console through an invitation | `FEAT-PFM-SEC-02` | confirmed | required |
| `JNY-PFM-SEC-003` | Invite a colleague and maintain their console access | `FEAT-PFM-SEC-03` | confirmed | required |
| `JNY-PFM-SEC-004` | Compose and assign a customer role | `FEAT-PFM-SEC-04` | confirmed | required |
| `JNY-PFM-SEC-005` | Approve and end customer workspace access for support | `FEAT-PFM-SEC-05` | confirmed | required |

## Test Artifact Tree

The design layer holds one detailed test specification per capability. The planning layer holds one cumulative acceptance suite per feature, and the implementation layer registers the existing executable files with their verification boundaries. The frontmatter lists every artifact in these three branches.