---
id: ADR-PFM-SEC-007
title: Scoped authority with bounded cached context
product_area: platform
module: security
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Evaluate ordinary business authority from scoped assignments and baseline self-service permissions,
  pass signed context to services, and retain the sixty-second gateway decision cache with thirty seconds of
  signed-context validity beyond it.
constrains:
- DOM-PFM-SEC-003
- SVC-PFM-SEC-security
- WF-PFM-SEC-009
- WF-PFM-SEC-008
- WF-PFM-SEC-007
- WF-PFM-SEC-011
- RESP-PFM
origin: services-platform:docs/proposals/security-authorization.md (authorization revision 2 §8.1, §10.2);
  docs/proposals/security-identity-and-access.md (identity v3 §7.1, §10); the accepted staff-access bound (FND-PFM-SEC-012)
alternatives:
- option: Remove the gateway cache and reevaluate every request.
  why_not: That adds database evaluation to every protected request; the cited architecture accepted a bounded
    cache instead.
- option: Guarantee immediate revocation through flushing.
  why_not: A successful reset response can leave a cached decision in use, so it cannot establish immediate
    cutoff.
consequences:
- Screens and contracts describe cache/context validity without promising immediate withdrawal.
- Fresh membership and security-context reads apply current active-status and assignment checks.
- Staff platform assignments govern HQ system routes; ordinary customer work uses the appropriate scoped staff
  grant.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Scoped authority with bounded cached context

## Context

The cited authorization and identity records establish scoped evaluation and the cache model. The design adds the observed baseline permissions and full signed-context lifetime to the account of that model.

A gateway cached decision and a fresh service read are different evidence of authority.

## Decision

Evaluate ordinary business authority from scoped assignments and baseline self-service permissions, pass signed context to services, and retain the sixty-second gateway decision cache with thirty seconds of signed-context validity beyond it.

## Alternatives Considered

Remove the gateway cache and reevaluate every request. That adds database evaluation to every protected request; the cited architecture accepted a bounded cache instead.

Guarantee immediate revocation through flushing. A successful reset response can leave a cached decision in use, so it cannot establish immediate cutoff.

## Consequences

Screens and contracts describe cache/context validity without promising immediate withdrawal.

Fresh membership and security-context reads apply current active-status and assignment checks.

Staff platform assignments govern HQ system routes; ordinary customer work uses the appropriate scoped staff grant.