---
id: ADR-PFM-SEC-016
title: Confirmed portal self-registration
product_area: platform
module: security
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Allow self-registration in active portal pools, provision confirmed members with the Portal Member
  assignment through the confirmation trigger or password-sign-in repair, and keep console registration invitation-only.
constrains:
- WF-PFM-SEC-013
- WF-PFM-SEC-014
- STATE-PFM-SEC-010
- SVC-PFM-SEC-security
- DOM-PFM-SEC-003
origin: 'Andrew, 2026-10-16: "portal users are NOT invited — they can actually sign up", with the Portal Member
  role automatically; the pool is built when Websites is enabled'
alternatives:
- option: Require staff invitation for every portal member.
  why_not: The recorded product decision requires visitors to join a portal without staff action; administrator
    invitation remains a separate supported path.
- option: Create the active membership before mailbox confirmation.
  why_not: An unconfirmed address does not establish mailbox possession, so active self-registration waits
    for that evidence.
consequences:
- Address-sensitive identity responses use neutral wording where implemented; availability and missing-pool
  differences remain findings.
- Successful password sign-in repairs confirmed accounts whose provisioning trigger failed.
- Contact matching occurs after identity membership and supplies a separate CRM link.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: the records named in origin and the code cited by the constrained artifacts'
examined_at: '2026-10-23'
examiner: codex
---

# Confirmed portal self-registration

## Context

The cited product decision settled self-registration and the automatic Portal Member role. The design includes the implemented repair path rather than claiming the confirmation trigger is the only writer.

The separate administrator invitation capability remains real. Neither the approved self-registration decision nor its trigger guarantees uniform response statuses across every identity route.

## Decision

Allow self-registration in active portal pools, provision confirmed members with the Portal Member assignment through the confirmation trigger or password-sign-in repair, and keep console registration invitation-only.

## Alternatives Considered

Require staff invitation for every portal member. The recorded product decision requires visitors to join a portal without staff action; administrator invitation remains a separate supported path.

Create the active membership before mailbox confirmation. An unconfirmed address does not establish mailbox possession, so active self-registration waits for that evidence.

## Consequences

Address-sensitive identity responses use neutral wording where implemented; availability and missing-pool differences remain findings.

Successful password sign-in repairs confirmed accounts whose provisioning trigger failed.

Contact matching occurs after identity membership and supplies a separate CRM link.