---
id: ADR-PFM-SEC-001
title: Workspace decisions and participant execution
product_area: platform
module: security
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Retain staff-facing setup, load/reset, activation and retirement decisions with the workspace record;
  delegate resource execution to the participant owning each resource.
constrains:
- SVC-PFM-SEC-tenants
- DOM-PFM-SEC-002
- WF-PFM-SEC-001
- WF-PFM-SEC-002
- WF-PFM-SEC-003
- WF-PFM-SEC-004
- RESP-PFM
origin: OQ-PFM-SEC-001 (recommended option A, not yet decided); FND-PFM-SEC-024
alternatives:
- option: Transfer setup and retirement decisions to the lifecycle module.
  why_not: That would separate workspace validation and staff authority from the record they govern.
- option: Transfer loading and reset decisions to the Data Job Engine.
  why_not: The engine executes import work, while the workspace owner controls readiness and permission to
    clear it.
consequences:
- Workspaces plans participant execution without assuming ownership of their records.
- The lifecycle protocol is consumed from its owning module and covers description, preparation, verification,
  removal, inventory and reset.
- Shared source scope does not authorize duplicate rule ownership.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Workspace decisions and participant execution

## Context

The cited planning question has no final answer. This record retains the recommended boundary as a proposal, while observed participant execution supports the division of resource work.

Andrew must settle the module split before implementation responsibilities are assigned.

## Decision

Retain staff-facing setup, load/reset, activation and retirement decisions with the workspace record; delegate resource execution to the participant owning each resource.

## Alternatives Considered

Transfer setup and retirement decisions to the lifecycle module. That would separate workspace validation and staff authority from the record they govern.

Transfer loading and reset decisions to the Data Job Engine. The engine executes import work, while the workspace owner controls readiness and permission to clear it.

## Consequences

Workspaces plans participant execution without assuming ownership of their records.

The lifecycle protocol is consumed from its owning module and covers description, preparation, verification, removal, inventory and reset.

Shared source scope does not authorize duplicate rule ownership.