---
id: ADR-PFM-SEC-015
title: Source-owned contact-derived access
product_area: platform
module: security
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Retain contact-keyed source synchronization for appointment and eligibility assignments, exclude
  manual edits, and apply them to the linked portal member; eligibility renewals have bounded windows while
  other sources provide their validity.
constrains:
- DOM-PFM-SEC-003
- STATE-PFM-SEC-006
- WF-PFM-SEC-010
- WF-PFM-SEC-014
- WF-PFM-SEC-015
- SVC-PFM-SEC-security
origin: Membership architecture 06 §3.2, §3.3 (decisions D-31, D-32); eligibility proposal 08 §4 (D-22, D-26);
  the milestone remains proposed (FND-PFM-SEC-008, OQ-PFM-SEC-003)
alternatives:
- option: Store all derived grants against the sign-in membership.
  why_not: Appointments can exist before a login, making contact identity useful; Product has not settled the
    contact/account choice.
- option: Withdraw access on every evaluator failure.
  why_not: An outage or indeterminate result should not be interpreted as a proved ineligible decision; the
    implementation preserves the existing set.
consequences:
- Missed eligibility renewal removes access at its stored window end; other sources’ windows must be assessed
  independently.
- Only the linked portal member receives contact-derived assignments through this evaluation path.
- Contact-versus-account subject semantics remain a planning question.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Source-owned contact-derived access

## Context

The cited derivation and eligibility records remain proposed where indicated. The design records their observed source ownership without confirming an unresolved subject choice.

The shared synchronization function does not require every source to supply the eligibility refresh lifetime. The corrected fail-safe claim applies specifically to eligibility-bound renewal.

## Decision

Retain contact-keyed source synchronization for appointment and eligibility assignments, exclude manual edits, and apply them to the linked portal member; eligibility renewals have bounded windows while other sources provide their validity.

## Alternatives Considered

Store all derived grants against the sign-in membership. Appointments can exist before a login, making contact identity useful; Product has not settled the contact/account choice.

Withdraw access on every evaluator failure. An outage or indeterminate result should not be interpreted as a proved ineligible decision; the implementation preserves the existing set.

## Consequences

Missed eligibility renewal removes access at its stored window end; other sources’ windows must be assessed independently.

Only the linked portal member receives contact-derived assignments through this evaluation path.

Contact-versus-account subject semantics remain a planning question.