---
id: ADR-PFM-SEC-010
title: Release-controlled shared definitions
product_area: platform
module: security
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Reconcile declared permissions, tier policies and built-in definitions transactionally in the catalog,
  increasing a built-in version only when its materialized content changes.
constrains:
- DOM-PFM-SEC-003
- STATE-PFM-SEC-008
- WF-PFM-SEC-012
- SVC-PFM-SEC-security
origin: services-platform:docs/proposals/security-authorization.md (authorization revision 2 §7, §8.3)
alternatives:
- option: Rewrite every built-in on every deployment.
  why_not: Unchanged deployments would move versions without a permission change and weaken explanations of
    what a version means.
- option: Allow customers to edit shared built-ins.
  why_not: A shared definition affects multiple customers; local customization must use a customer-owned copy.
consequences:
- Unchanged built-in content preserves its version; catalog publication can still perform other writes.
- Removed built-ins are archived with impact history and can return under the same identity.
- Customer customization creates a copy rather than modifying shared content.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Release-controlled shared definitions

## Context

The cited release reconciliation decision is retained. Its database transaction does not include activation of the route registry in another store.

The corrected workflow records the publication gap and intended replay recovery; content idempotence is narrower than a write-free deployment.

## Decision

Reconcile declared permissions, tier policies and built-in definitions transactionally in the catalog, increasing a built-in version only when its materialized content changes.

## Alternatives Considered

Rewrite every built-in on every deployment. Unchanged deployments would move versions without a permission change and weaken explanations of what a version means.

Allow customers to edit shared built-ins. A shared definition affects multiple customers; local customization must use a customer-owned copy.

## Consequences

Unchanged built-in content preserves its version; catalog publication can still perform other writes.

Removed built-ins are archived with impact history and can return under the same identity.

Customer customization creates a copy rather than modifying shared content.