---
id: ADR-PFM-SEC-002
title: User Account aggregates
product_area: platform
module: security
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Keep membership, access definitions, assignments and staff grants as separate aggregates within the
  planning User Account concept, with principals and history adjacent.
constrains:
- DOM-PFM-SEC-003
- SVC-PFM-SEC-security
- STATE-PFM-SEC-004
- STATE-PFM-SEC-005
- STATE-PFM-SEC-006
- STATE-PFM-SEC-007
- STATE-PFM-SEC-008
origin: OQ-PFM-SEC-004; FND-PFM-SEC-034 (concept grain)
alternatives:
- option: Create separate objects for the superseded role and grant concepts.
  why_not: The planning layer already groups those facets under User Account; separate objects would contradict
    that concept allocation.
- option: Give all security records one aggregate lifecycle.
  why_not: Independent definition, assignment, membership and grant transactions require distinct state models.
consequences:
- The grouped object retains separate state models and invariant sets for its aggregates.
- Any future concept split requires a planning decision and permanent new concept allocation before design
  changes.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# User Account aggregates

## Context

This record follows the existing planning concept grain rather than reopening the superseded concepts. The implementation has multiple aggregates, which the design represents without adding object kinds or reusing numbers.

The remaining grain question belongs to Product; it does not change this examination’s object count.

## Decision

Keep membership, access definitions, assignments and staff grants as separate aggregates within the planning User Account concept, with principals and history adjacent.

## Alternatives Considered

Create separate objects for the superseded role and grant concepts. The planning layer already groups those facets under User Account; separate objects would contradict that concept allocation.

Give all security records one aggregate lifecycle. Independent definition, assignment, membership and grant transactions require distinct state models.

## Consequences

The grouped object retains separate state models and invariant sets for its aggregates.

Any future concept split requires a planning decision and permanent new concept allocation before design changes.