---
id: SVC-PFM-SEC-security
title: Security Service Module
product_area: platform
module: security
repository: services-platform
source_module: modules/security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
owns:
- DOM-PFM-SEC-003
does_not_own:
- Eligibility owns rule definitions and evaluation; Security stores the resulting assignments.
- Committees owns appointments and supplies their source-managed derived assignments.
- CRM owns contacts and candidate matching data; Security owns member linking and possession challenges.
- Licensing owns license state read by permission and application evaluation.
- Console Shell owns navigation and boot gating from evaluated security context.
- Websites and Sites determine when their workspace needs portal onboarding.
operations:
- operation_id: health
  intent: Return API deployment health and build metadata.
  access: public
  permission: 'none: the shared health route'
  realises: []
  published_to_submissions: 'not published: deployment metadata only.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:healthRoute
- operation_id: getMyAccess
  route: GET /security/{tenantId}/me/access
  intent: Return the caller’s assignments and evaluated permission explanation for the request context.
  access: portal
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-007
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/access.routes.ts:getMyAccess
- operation_id: getMySecurityContext
  route: GET /security/me/context
  intent: Evaluate console context for the default or remembered workspace.
  access: console
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-007
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/access.routes.ts:getMySecurityContext
- operation_id: getMySecurityContextInTenant
  route: GET /security/{tenantId}/me/context
  intent: Evaluate context strictly for the addressed workspace.
  access: console
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-007
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/access.routes.ts:getMySecurityContextInTenant
- operation_id: getMyApplications
  route: GET /security/{tenantId}/me/applications
  intent: Return applications available to the caller in the selected workspace.
  access: console
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-007
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/access.routes.ts:getMyApplications
- operation_id: describePortalPool
  route: GET /security/public/portal_pools/{tenant}
  intent: Return the active workspace portal pool and client; retain implemented availability and missing-pool
    refusals.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/access.routes.ts:describePortalPool
- operation_id: onboardTenantPortal
  route: POST /security/{tenantId}/portal/onboard
  intent: Ensure an active portal pool or submit durable onboarding for the workspace.
  access: system
  permission: platform.tenants.onboard
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/access.routes.ts:onboardTenantPortal
- operation_id: listConsoleUsers
  route: GET /security/customers/{customerId}/console_users
  intent: Page console memberships using the supported role, status and invitation filters.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:listConsoleUsers
- operation_id: getConsoleUser
  route: GET /security/customers/{customerId}/console_users/{userId}
  intent: Return a console member’s profile, assignments and latest invitation.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:getConsoleUser
- operation_id: updateConsoleUserDetails
  route: PATCH /security/customers/{customerId}/console_users/{userId}
  intent: Apply versioned edits to membership names, time zone and locale.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:updateConsoleUserDetails
- operation_id: listCustomerInvitations
  route: GET /security/customers/{customerId}/invitations
  intent: Page invitation records and their delivery outcomes for the customer.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:listCustomerInvitations
- operation_id: listConsoleUserAssignments
  route: GET /security/customers/{customerId}/console_users/{userId}/assignments
  intent: Return the member’s grants with role, scope, validity and granting actor.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:listConsoleUserAssignments
- operation_id: grantConsoleUserRole
  route: POST /security/customers/{customerId}/console_users/{userId}/assignments
  intent: Create a scoped role assignment after delegation checks.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:grantConsoleUserRole
- operation_id: checkSecurityGrant
  route: POST /security/customers/{customerId}/grant_checks
  intent: Evaluate whether the caller may offer the proposed customer-scoped role without writing a grant.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:checkSecurityGrant
- operation_id: checkTenantSecurityGrant
  route: POST /security/{tenantId}/grant_checks
  intent: Evaluate whether the caller may offer the proposed workspace-scoped role without writing a grant.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:checkTenantSecurityGrant
- operation_id: setConsoleUserRoleScope
  route: PUT /security/customers/{customerId}/console_users/{userId}/roles/{roleRef}/scope
  intent: Synchronize the role’s customer-wide or selected-workspace assignments atomically.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:setConsoleUserRoleScope
- operation_id: listSecurityAuditEvents
  route: GET /security/customers/{customerId}/audit_events
  intent: Page customer security history in descending occurrence order.
  access: console
  permission: platform.security-access.explain
  realises:
  - CAP-PFM-SEC-011
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:listSecurityAuditEvents
- operation_id: explainConsoleUserPermissions
  route: GET /security/customers/{customerId}/console_users/{userId}/effective_permissions
  intent: Explain the member’s effective permissions and contributing assignments in a workspace.
  access: console
  permission: platform.security-access.explain
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:explainConsoleUserPermissions
- operation_id: withdrawConsoleUserRole
  route: DELETE /security/customers/{customerId}/console_users/{userId}/assignments/{assignmentId}
  intent: Revoke the assignment while retaining history and applying administrator lockout protection.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/console-users.routes.ts:withdrawConsoleUserRole
- operation_id: listSecurityPolicies
  route: GET /security/customers/{customerId}/policies
  intent: Return visible built-in and customer-owned policies.
  access: console
  permission: platform.security-policies.read
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:listSecurityPolicies
- operation_id: getSecurityPolicy
  route: GET /security/customers/{customerId}/policies/{ref}
  intent: Return policy content, usage and record version.
  access: console
  permission: platform.security-policies.read
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:getSecurityPolicy
- operation_id: createSecurityPolicy
  route: POST /security/customers/{customerId}/policies
  intent: Persist a customer-owned policy after rule validation.
  access: console
  permission: platform.security-policies.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:createSecurityPolicy
- operation_id: patchSecurityPolicy
  route: PATCH /security/customers/{customerId}/policies/{ref}
  intent: Edit custom policy metadata or rules with delegation and lockout checks.
  access: console
  permission: platform.security-policies.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:patchSecurityPolicy
- operation_id: duplicateSecurityPolicy
  route: POST /security/customers/{customerId}/policies/{ref}/duplicate
  intent: Create a customer-owned copy retaining source identity and source version.
  access: console
  permission: platform.security-policies.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:duplicateSecurityPolicy
- operation_id: validateSecurityPolicyRules
  route: POST /security/customers/{customerId}/policies/validate
  intent: Return indexed validation problems and warnings without saving the rules.
  access: console
  permission: platform.security-policies.read
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:validateSecurityPolicyRules
- operation_id: archiveSecurityPolicy
  route: DELETE /security/customers/{customerId}/policies/{ref}
  intent: Archive a custom policy only when no role still composes it.
  access: console
  permission: platform.security-policies.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:archiveSecurityPolicy
- operation_id: listSecurityRoles
  route: GET /security/customers/{customerId}/roles
  intent: Return visible built-in and custom roles with their effective-content summary.
  access: console
  permission: platform.security-roles.read
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:listSecurityRoles
- operation_id: getSecurityRole
  route: GET /security/customers/{customerId}/roles/{ref}
  intent: Return role composition, inline rules and holder information.
  access: console
  permission: platform.security-roles.read
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:getSecurityRole
- operation_id: createSecurityRole
  route: POST /security/customers/{customerId}/roles
  intent: Create a customer role from permitted policies and validated inline rules.
  access: console
  permission: platform.security-roles.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:createSecurityRole
- operation_id: patchSecurityRole
  route: PATCH /security/customers/{customerId}/roles/{ref}
  intent: Edit custom role composition under delegation and administrator lockout protection.
  access: console
  permission: platform.security-roles.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:patchSecurityRole
- operation_id: setSecurityRoleEligibility
  route: PUT /security/{tenantId}/roles/{id}/eligibility
  intent: Store the custom role’s workspace eligibility binding and refresh interval.
  access: console
  permission: platform.security-roles.manage
  realises:
  - CAP-PFM-SEC-014
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:setSecurityRoleEligibility
- operation_id: duplicateSecurityRole
  route: POST /security/customers/{customerId}/roles/{ref}/duplicate
  intent: Create a customer role copy with source identity and version retained.
  access: console
  permission: platform.security-roles.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:duplicateSecurityRole
- operation_id: archiveSecurityRole
  route: DELETE /security/customers/{customerId}/roles/{ref}
  intent: Archive a custom role that has no blocking assignments.
  access: console
  permission: platform.security-roles.manage
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:archiveSecurityRole
- operation_id: listSecurityRoleMembers
  route: GET /security/customers/{customerId}/roles/{ref}/members
  intent: Page reachable holders and the scope of each role assignment.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-010
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:listSecurityRoleMembers
- operation_id: getCustomerPermissionCatalog
  route: GET /security/customers/{customerId}/permission_catalog
  intent: Return the editor catalog with staff-only permission keys excluded.
  access: console
  permission: platform.security-policies.read
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:getCustomerPermissionCatalog
- operation_id: getPermissionCatalog
  route: GET /security/permission_catalog
  intent: Return the catalog through the retained route without a customer path.
  access: console
  permission: platform.security-policies.read
  realises:
  - CAP-PFM-SEC-012
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/definitions.routes.ts:getPermissionCatalog
- operation_id: requestHqTenantAccess
  route: POST /hq/access_requests
  intent: Record a staff request for bounded customer-workspace entry and notify customer administrators.
  access: system
  permission: hq.tenant-access.request
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-access-requests.routes.ts:requestHqTenantAccess
- operation_id: listHqTenantAccessRequests
  route: GET /hq/access_requests
  intent: Return the requesting staff member’s access requests and grants.
  access: system
  permission: hq.tenant-access.request
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-access-requests.routes.ts:listHqTenantAccessRequests
- operation_id: withdrawHqTenantAccessRequest
  route: POST /hq/access_requests/{grantId}/withdraw
  intent: Close the caller’s undecided access request as withdrawn.
  access: system
  permission: hq.tenant-access.request
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-access-requests.routes.ts:withdrawHqTenantAccessRequest
- operation_id: getHqEmergencyAccessReport
  route: GET /hq/reports/emergency_access
  intent: Return emergency-access activity for the requested month.
  access: system
  permission: hq.audit.read
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-access-requests.routes.ts:getHqEmergencyAccessReport
- operation_id: listHqServicePrincipals
  route: GET /hq/service-principals
  intent: Return registered machine callers with their kind and status.
  access: system
  permission: hq.service-principals.read
  realises:
  - CAP-PFM-SEC-018
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-service-principals.routes.ts:listHqServicePrincipals
- operation_id: suspendHqServicePrincipal
  route: POST /hq/service-principals/{id}/suspend
  intent: Mark a registered caller suspended and append its security event.
  access: system
  permission: hq.service-principals.manage
  realises:
  - CAP-PFM-SEC-018
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-service-principals.routes.ts:suspendHqServicePrincipal
- operation_id: resumeHqServicePrincipal
  route: POST /hq/service-principals/{id}/resume
  intent: Mark a suspended registered caller active and append its security event.
  access: system
  permission: hq.service-principals.manage
  realises:
  - CAP-PFM-SEC-018
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-service-principals.routes.ts:resumeHqServicePrincipal
- operation_id: openHqEmergencyAccess
  route: POST /hq/tenants/{id}/emergency_access
  intent: Record reasoned, ticketed emergency workspace entry for at most four hours.
  access: system
  permission: hq.emergency-access.use
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff-access.routes.ts:openHqEmergencyAccess
- operation_id: listHqOwnAccessGrants
  route: GET /hq/access_grants
  intent: Return the current staff member’s workspace entry grants.
  access: system
  permission: hq.emergency-access.use
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff-access.routes.ts:listHqOwnAccessGrants
- operation_id: endHqOwnAccessGrant
  route: POST /hq/access_grants/{grantId}/end
  intent: End the caller’s approved or emergency grant and its assignment.
  access: system
  permission: hq.emergency-access.use
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff-access.routes.ts:endHqOwnAccessGrant
- operation_id: listHqStaffMemberAccessGrants
  route: GET /hq/staff/{userId}/access_grants
  intent: Return the permitted target staff member’s workspace grants.
  access: system
  permission: hq.tenant-access.read
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff-access.routes.ts:listHqStaffMemberAccessGrants
- operation_id: endHqStaffMemberAccessGrant
  route: POST /hq/staff/{userId}/access_grants/{grantId}/end
  intent: End a permitted other staff member’s approved or emergency grant.
  access: system
  permission: hq.emergency-access.use
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff-access.routes.ts:endHqStaffMemberAccessGrant
- operation_id: listHqStaff
  route: GET /hq/staff
  intent: Page staff memberships with HQ role and last-authentication information.
  access: system
  permission: hq.staff.read
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:listHqStaff
- operation_id: getHqStaffMember
  route: GET /hq/staff/{userId}
  intent: Return the staff member’s profile, roles and workspace access information.
  access: system
  permission: hq.staff.read
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:getHqStaffMember
- operation_id: listHqRoles
  route: GET /hq/roles
  intent: Return the three declared built-in HQ role definitions.
  access: system
  permission: hq.staff.read
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:listHqRoles
- operation_id: inviteHqStaff
  route: POST /hq/staff/invitations
  intent: Invite a staff member into Rhythm’s customer with a platform-scoped HQ role.
  access: system
  permission: hq.staff.invite
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:inviteHqStaff
- operation_id: resendHqStaffInvitation
  route: POST /hq/staff/{userId}/invitations/resend
  intent: Supersede a still-invited staff member’s outstanding invitation and prepare its replacement.
  access: system
  permission: hq.staff.invite
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:resendHqStaffInvitation
- operation_id: suspendHqStaff
  route: POST /hq/staff/{userId}/suspend
  intent: Suspend staff membership and attempt provider disabling after commit.
  access: system
  permission: hq.staff.disable
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:suspendHqStaff
- operation_id: reinstateHqStaff
  route: POST /hq/staff/{userId}/reinstate
  intent: Reactivate suspended staff membership under delegation checks and attempt provider enabling.
  access: system
  permission: hq.staff.disable
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:reinstateHqStaff
- operation_id: revokeHqStaff
  route: POST /hq/staff/{userId}/revoke
  intent: Withdraw staff membership while preserving a remaining Rhythm Administrator.
  access: system
  permission: hq.staff.disable
  realises:
  - CAP-PFM-SEC-016
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-staff.routes.ts:revokeHqStaff
- operation_id: listHqTenantRoles
  route: GET /hq/tenants/{id}/roles
  intent: Return customer roles available for staff access requests or emergency entry.
  access: system
  permission: hq.tenants.read
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/hq-tenant-roles.routes.ts:listHqTenantRoles
- operation_id: inviteConsoleUser
  route: POST /security/customers/{customerId}/console_users/invitations
  intent: Commit a console-member offer with pending grants, then prepare identity and e-mail delivery.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:inviteConsoleUser
- operation_id: inviteTenantMember
  route: POST /security/{tenantId}/members/invitations
  intent: Commit a portal-member invitation for the workspace and prepare its identity and delivery.
  access: portal
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:inviteTenantMember
- operation_id: listTenantMembers
  route: GET /security/{tenantId}/members
  intent: Return the workspace’s visible portal memberships.
  access: portal
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:listTenantMembers
- operation_id: resendConsoleUserInvitation
  route: POST /security/customers/{customerId}/console_users/{userId}/invitations/resend
  intent: Replace the invited member’s outstanding offer with a new seven-day invitation.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:resendConsoleUserInvitation
- operation_id: revokeConsoleUser
  route: POST /security/customers/{customerId}/console_users/{userId}/revoke
  intent: Withdraw membership, invitations and assignments and queue provider disabling atomically.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:revokeConsoleUser
- operation_id: suspendConsoleUser
  route: POST /security/customers/{customerId}/console_users/{userId}/suspend
  intent: Pause membership, withdraw outstanding invitations and attempt provider disabling.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:suspendConsoleUser
- operation_id: reinstateConsoleUser
  route: POST /security/customers/{customerId}/console_users/{userId}/reinstate
  intent: Reactivate a suspended member after checking authority over retained grants.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:reinstateConsoleUser
- operation_id: activateConsoleUser
  route: POST /security/customers/{customerId}/console_users/{userId}/activate
  intent: Activate an invited member with a linked identity and no previously sent invitation.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:activateConsoleUser
- operation_id: resendInvitation
  route: POST /users/{id}/invitations/resend
  intent: Invoke shared resend through the legacy route without a customer path.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:resendInvitation
- operation_id: revokeUser
  route: POST /users/{id}/revoke
  intent: Invoke shared revocation through the legacy route without a customer path.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:revokeUser
- operation_id: suspendUser
  route: POST /users/{id}/suspend
  intent: Invoke shared suspension through the legacy route without a customer path.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:suspendUser
- operation_id: reinstateUser
  route: POST /users/{id}/reinstate
  intent: Invoke shared reinstatement through the legacy route without a customer path.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:reinstateUser
- operation_id: activateUser
  route: POST /users/{id}/activate
  intent: Invoke linked-member activation through the legacy route without a customer path.
  access: console
  permission: platform.security-access.manage
  realises:
  - CAP-PFM-SEC-008
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:activateUser
- operation_id: getInvitationSummary
  route: GET /security/public/invitations/{token}/summary
  intent: Return the token-bound minimal recipient and organization summary.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-005
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:getInvitationSummary
- operation_id: acceptInvitation
  route: POST /security/public/invitations/accept
  intent: Set the recipient’s provider password, then consume the invitation and activate its grants.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-005
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:acceptInvitation
- operation_id: beginGoogleAcceptance
  route: POST /security/public/invitations/google/begin
  intent: Create an invitation-proved short-lived provider-link session.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-005
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:beginGoogleAcceptance
- operation_id: completeGoogleAcceptance
  route: POST /security/public/invitations/google/complete
  intent: Consume the matching signed-in account’s link session and finish invitation activation.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-005
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/invitations.routes.ts:completeGoogleAcceptance
- operation_id: getPortalContactMatch
  route: GET /security/{tenantId}/portal/me/contact_match
  intent: Return the current link, an exact-match link, masked candidates or new-contact matching result.
  access: portal
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-020
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-contact-match.routes.ts:getPortalContactMatch
- operation_id: startPortalContactChallenge
  route: POST /security/{tenantId}/portal/me/contact_match/challenge
  intent: Persist a candidate challenge digest and send its verification code through the permitted channel.
  access: portal
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-020
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-contact-match.routes.ts:startPortalContactChallenge
- operation_id: verifyPortalContactChallenge
  route: POST /security/{tenantId}/portal/me/contact_match/verify
  intent: Check code and attempts and link the member to the candidate contact atomically.
  access: portal
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-020
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-contact-match.routes.ts:verifyPortalContactChallenge
- operation_id: declinePortalContactMatch
  route: POST /security/{tenantId}/portal/me/contact_match/decline
  intent: Create a new CRM contact, flag the declined candidate for review and attempt membership linking.
  access: portal
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-020
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-contact-match.routes.ts:declinePortalContactMatch
- operation_id: signUpPortalMember
  route: POST /security/{tenantId}/portal/sign_up
  intent: Register an unconfirmed provider account and request its confirmation code.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-identity.routes.ts:signUpPortalMember
- operation_id: signInPortalMember
  route: POST /security/{tenantId}/portal/sign_in
  intent: Authenticate a portal password, repair missing confirmed membership and attempt derived-access refresh.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-identity.routes.ts:signInPortalMember
- operation_id: startPortalPasswordReset
  route: POST /security/{tenantId}/portal/password_reset
  intent: Request recovery with neutral address-sensitive response wording.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-identity.routes.ts:startPortalPasswordReset
- operation_id: confirmPortalPasswordReset
  route: POST /security/{tenantId}/portal/password_reset/confirm
  intent: Apply the recovery code and provider password policy to set a portal password.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-identity.routes.ts:confirmPortalPasswordReset
- operation_id: verifyPortalEmail
  route: POST /security/{tenantId}/portal/verify_email
  intent: Confirm the code and invoke confirmed-member provisioning through the provider trigger.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-identity.routes.ts:verifyPortalEmail
- operation_id: resendPortalVerification
  route: POST /security/{tenantId}/portal/verify_email/resend
  intent: Request another portal confirmation code with neutral address-sensitive wording.
  access: public
  permission: 'none: public route; the token, code or pool lookup is the whole authorization'
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-identity.routes.ts:resendPortalVerification
- operation_id: signOutPortalMember
  route: POST /security/{tenantId}/portal/sign_out
  intent: Globally sign out the caller’s portal provider account while issued access tokens retain their expiry.
  access: portal
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-019
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/portal-identity.routes.ts:signOutPortalMember
- operation_id: listTenantStaffAccess
  route: GET /security/{tenantId}/staff_access
  intent: Return workspace staff grants across kinds and states.
  access: console
  permission: platform.staff-access.read
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/staff-access.routes.ts:listTenantStaffAccess
- operation_id: approveTenantStaffAccess
  route: POST /security/{tenantId}/staff_access/{grantId}/approve
  intent: Approve a pending request within its requested duration and materialize the matching assignment.
  access: console
  permission: platform.staff-access.manage
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/staff-access.routes.ts:approveTenantStaffAccess
- operation_id: declineTenantStaffAccess
  route: POST /security/{tenantId}/staff_access/{grantId}/decline
  intent: Close a pending staff request with a customer decision reason.
  access: console
  permission: platform.staff-access.manage
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/staff-access.routes.ts:declineTenantStaffAccess
- operation_id: revokeTenantStaffAccess
  route: POST /security/{tenantId}/staff_access/{grantId}/revoke
  intent: End an active workspace staff grant, including standing access, and its assignment.
  access: console
  permission: platform.staff-access.manage
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/staff-access.routes.ts:revokeTenantStaffAccess
- operation_id: giveTenantStaffAccess
  route: POST /security/{tenantId}/staff_access
  intent: Directly give a permitted active staff member a bounded workspace grant.
  access: console
  permission: platform.staff-access.manage
  realises:
  - CAP-PFM-SEC-017
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/staff-access.routes.ts:giveTenantStaffAccess
- operation_id: resolveTenantUserNames
  route: GET /security/{tenantId}/user_names
  intent: Resolve up to one hundred actor identifiers to available names and pictures.
  access: console
  permission: platform.security-self.read
  realises:
  - CAP-PFM-SEC-007
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/user-names.routes.ts:resolveTenantUserNames
- operation_id: createUser
  route: POST /users
  intent: Create a membership record through the retained direct-write route.
  access: console
  permission: platform.users.create
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:createUser
- operation_id: listUsers
  route: GET /users
  intent: Return reachable members through the retained route without a customer path.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:listUsers
- operation_id: getCurrentUser
  route: GET /users/me
  intent: Return the current active membership or refuse an inactive member.
  access: portal
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-006
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:getCurrentUser
- operation_id: getUser
  route: GET /users/{id}
  intent: Return the reachable membership by its identifier.
  access: portal
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:getUser
- operation_id: updateUser
  route: PUT /users/{id}
  intent: Replace editable member profile fields using the supplied record version.
  access: console
  permission: platform.users.update
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:updateUser
- operation_id: patchUser
  route: PATCH /users/{id}
  intent: Apply supplied member profile fields while preserving omitted values.
  access: console
  permission: platform.users.update
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:patchUser
- operation_id: deleteUser
  route: DELETE /users/{id}
  intent: Remove membership with former-user preservation and durable provider-deletion work.
  access: console
  permission: platform.users.delete and platform.security-access.manage
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:deleteUser
- operation_id: listUserIdentities
  route: GET /users/{id}/identities
  intent: Return the member’s linked authentication identities.
  access: console
  permission: platform.users.read
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:listUserIdentities
- operation_id: linkCognitoIdentity
  route: PUT /users/{id}/cognito_identity
  intent: Attach the verified provider account in the membership’s own pool.
  access: console
  permission: platform.users.manage-identities
  realises:
  - CAP-PFM-SEC-009
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:linkCognitoIdentity
- operation_id: changePassword
  route: POST /users/me/password
  intent: Change the caller’s credential after proving the current password.
  access: portal
  permission: platform.users.change-password
  realises:
  - CAP-PFM-SEC-006
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:changePassword
- operation_id: resetOwnPassword
  route: POST /users/me/password_reset
  intent: Request provider recovery for the caller’s own membership.
  access: portal
  permission: platform.users.change-password
  realises:
  - CAP-PFM-SEC-006
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:resetOwnPassword
- operation_id: resetUserPassword
  route: POST /users/{id}/password_reset
  intent: Request password recovery for a reachable administrative target.
  access: console
  permission: platform.users.manage-passwords
  realises:
  - CAP-PFM-SEC-006
  published_to_submissions: 'not published: security or workspace administration, identity handling, or an
    administrative read; no Submissions operation binding is declared.'
  provenance: observed
  source: services-platform:modules/security/aws/api/users.routes.ts:resetUserPassword
events: []
jobs:
- Authorizer flushing persists a job and attempts every configured stage; successful reset responses alone
  do not prove eviction.
- Nightly derived reconciliation deduplicates workspace/date submissions and refreshes existing derived subjects.
- Portal onboarding reserves, creates, polls and registers infrastructure within a two-hour execution limit.
- Provider account removal uses durable rows, a minute dispatcher and SQS consumer, with eight receives before
  dead-letter handling.
- Eligibility reconciliation queues subjects for dispatcher/consumer work and dead-letter recovery.
- Release publication validates, stages and activates route manifests while reconciling permission definitions.
integrations:
- system: Amazon Cognito (console pool and each workspace's portal pool)
  direction: outbound
  contract: Provider administration targets the member’s own pool. Invitation preparation and removal follow
    commit; acceptance deliberately enables and sets credentials before its activation transaction.
- system: Amazon Cognito triggers
  direction: inbound
  contract: Pre-sign-up checks portal registration and provider-link proof; post-confirmation provisions member,
    identity and Portal Member assignment, with password-sign-in repair when needed.
- system: API Gateway REQUEST authorizer
  direction: inbound
  contract: Protected human API requests receive an enumerated gateway decision and signed context. Gateway
    cache validity is sixty seconds and context validity extends thirty seconds beyond it.
- system: Every macroservice's deploy
  direction: inbound
  contract: Deployment calls manifest validation, staging and activation for its immutable release.
- system: CRM contact directory
  direction: outbound
  contract: CRM functions return likely candidates or create contacts and duplicate-review pairs in transactions
    separate from member-link writes.
- system: Eligibility evaluator
  direction: outbound
  contract: Rule-bound role evaluation runs in bounded batches outside the synchronization transaction.
- system: Committees and other deriving services
  direction: inbound
  contract: Deriving services synchronize source-owned assignments through the shared function in their own
    transaction.
- system: Shared e-mail sender
  direction: outbound
  contract: Invitation and staff-access notices use the shared sender after their offer or grant commits; delivery
    outcomes and failures remain separate from committed authority.
consistency:
- rule: Invitation database records commit together before identity preparation and message delivery.
  kind: transactional
  compensation: Resend supersedes the offer and retries preparation; token validity is not determined by e-mail
    completion order.
- rule: Revocation and deletion persist membership change and durable provider-removal work atomically.
  kind: eventual
  compensation: Queue errors retry within the receive budget, then require dead-letter recovery; no elapsed
    completion deadline is guaranteed.
- rule: Suspension and reinstatement commit membership state before their single provider synchronization attempt.
  kind: eventual
  compensation: Provider trouble is logged and returned separately; there is no automatic synchronization retry
    here.
- rule: Fresh evaluation reads committed authority; gateway decisions can lag sixty seconds and signed contexts
    thirty seconds beyond that bound.
  kind: eventual
  compensation: Flush requests accelerate turnover where effective, but success responses do not prove eviction.
- rule: Grant, matching scoped assignment and security event share a transaction.
  kind: transactional
  compensation: Ending a grant revokes its assignment atomically and requests flushing after commit.
- rule: Catalog definitions and history transact in Postgres before activation of the route registry in its
    separate store.
  kind: transactional
  compensation: Registry failure after catalog commit leaves a split release state; activation replay is the
    intended repair requiring proof.
- rule: Derived authority is source-owned; eligibility renewal has bounded validity, while other sources supply
    their own windows.
  kind: eventual
  compensation: Reconciliation renews or withdraws decided bindings; an indeterminate result preserves their
    current stored set.
- rule: Audited refusals are appended outside the rolled-back administrative transaction.
  kind: transactional
  compensation: The separate refusal-write transaction has its own failure boundary and cannot restore the
    refused change.
evidence:
- 'services-platform at ad3f6a65: modules/security/aws/api/*.routes.ts; aws/lambda/*.handler.ts; aws/logic/*;
  aws/resources/*; authorizer/*; services/*; aws/platform.service.ts (security, users, staff-access, HQ permission
  groups); docs/queued-work.md; docs/jobs.md; docs/row-level-security.md; docs/standards/submission-compatible-operations.md.'
- 'react-console at baf6dae: lib/security/api.ts, lib/auth/invitations.ts, lib/hq/platform-ops.ts (the console
  callers).'
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-PRV-004, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Security Service Module

## What This Service Is For

Security owns memberships and authentication identities, access definitions, assignments, staff grants, machine principals and their security history. It provides evaluated context to the console and protected human API requests, while machine calls use their separate cloud-role/principal path.

## Boundary

Eligibility owns rule definitions and evaluation; Security stores the resulting assignments. Committees owns appointments and supplies their source-managed derived assignments. CRM owns contacts and candidate matching data; Security owns member linking and possession challenges. Licensing owns license state read by permission and application evaluation. Console Shell owns navigation and boot gating from evaluated security context. Websites and Sites determine when their workspace needs portal onboarding.

## Operations in Words

The operations group personal context and access explanation; member invitation and lifecycle; role, policy and assignment administration; staff entry and principals; and portal registration, recovery and contact linking. Their operation rows identify exact access and planning capability references.

Operation rows preserve route-declared access, permission and planning capability references. None declares a Submissions binding. The module makes no model inference call; its inference list is empty.

## Events and Jobs

The declared job inventory covers durable execution and queued background work. Event declarations distinguish actual provisioning notifications from the absence of domain-change events.

## Consistency Guarantees

The consistency rows distinguish database authority, external provider effects, queued work, gateway caching and registry publication. Suspension and reinstatement have no durable provider retry; revocation and deletion do. Acceptance is the explicit provider-before-database exception, with its credential race recorded as a finding.

Catalog and route-registry activation cross separate stores. CRM contact creation and membership linking also cross transaction boundaries. These gaps and missing failure-recovery proofs remain open rather than being described as atomic guarantees.