---
id: CAP-PFM-SEC-002
title: Maintain workspace information and operating status
feature: FEAT-PFM-SEC-01
product_area: platform
module: security
revision: 1
status: draft
product_intent: confirmed
implementation_evidence: observed
supersedes: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
intent_sources:
  - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axes'
  - 'services-platform:docs/hq/rhythm-hq-plan.md#D10'
  - 'services-platform:docs/hq/rhythm-hq-plan.md#D1'
  - >-
    services-platform:docs/tenants/tenant-lifecycle-plan.md#5.6 Tenant access and background work while
    pending
  - 'services-platform:docs/hq/rhythm-hq-plan.md#K8'
purpose: >-
  Customer administrators maintain workspace information, while Rhythm staff manage business status and
  commercial-account changes.
outcomes:
  - Administrators keep workspace names and calendars current within their customer.
  - Rhythm staff inspect and manage workspaces through HQ.
  - 'Availability checks distinguish ordinary work, HQ operations and initial-import routes.'
concepts:
  - CON-PFM-SEC-002
  - CON-PFM-SEC-001
actors:
  - ACT-PFM-001
  - ACT-PFM-004
  - ACT-PFM-005
  - ACT-PFM-006
surfaces:
  - console
  - api
preconditions: []
postconditions: []
permissions:
  - key: platform.tenants.read
    where_checked: api
    scope: record
  - key: platform.tenants.update
    where_checked: api
    scope: record
  - key: platform.tenants.bulk
    where_checked: api
    scope: tenant
  - key: platform.tenants.manage-status
    where_checked: api
    scope: global
  - key: platform.tenants.manage-commercial-link
    where_checked: api
    scope: global
  - key: hq.tenants.read
    where_checked: api
    scope: global
  - key: hq.tenants.update
    where_checked: api
    scope: global
rules:
  - id: BR-CAP-PFM-SEC-002-01
    proved_by: [ATS-PFM-SEC-001-12, ATS-PFM-SEC-002-01, ATS-PFM-SEC-002-21, TST-PFM-SEC-230]
    statement: >-
      Customer administrators access their own customer’s reachable workspaces; lists respect the
      caller’s reach, and reading another customer’s workspace returns not found.
    kind: permission
    enforced_at:
      - api
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another
      customer, which is what the reach reduction means
    origin: 'services-platform:docs/hq/rhythm-hq-plan.md#D1'
  - id: BR-CAP-PFM-SEC-002-02
    proved_by: [ATS-PFM-SEC-002-02, ATS-PFM-SEC-002-15, ATS-PFM-SEC-002-16, ATS-PFM-SEC-002-17, ATS-PFM-SEC-002-18, ATS-PFM-SEC-002-19, ATS-PFM-SEC-002-20, TST-PFM-SEC-225, TST-PFM-SEC-230]
    statement: >-
      Only Rhythm staff change business status through HQ; a console request to set live, implementation
      or disabled is refused with guidance to the HQ action.
    kind: permission
    enforced_at:
      - api
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a customer administrator
      the same change on the console route, naming where it is made
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axes'
  - id: BR-CAP-PFM-SEC-002-03
    proved_by: [ATS-PFM-SEC-002-03, ATS-PFM-SEC-002-23, ATS-PFM-SEC-004-25, TST-PFM-SEC-230, TST-PFM-SEC-253]
    statement: >-
      Ordinary writes leave the system-managed lifecycle unchanged, and database constraints require a
      workspace awaiting deletion to remain disabled.
    kind: invariant
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#ignores
      a lifecycle state a write input carries, rather than letting a client set the system axis
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axes'
  - id: BR-CAP-PFM-SEC-002-04
    proved_by: [ATS-PFM-SEC-002-04, TST-PFM-SEC-230]
    statement: >-
      Time zones accept UTC or an exactly spelled, recognized location; abbreviations, fixed offsets and
      Etc locations fail validation, and omission selects Eastern time.
    kind: validation
    enforced_at:
      - api
      - service
      - database
    must_prove: true
    provenance: observed
    source: 'services-platform:modules/tenants/services/persistence/tenants.ts:withValidTimeZone'
    origin: none
  - id: BR-CAP-PFM-SEC-002-05
    proved_by: [ATS-PFM-SEC-002-05, TST-PFM-SEC-253]
    statement: Saving a workspace adds its acronym to the display name without repeating an existing suffix.
    kind: calculation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#does
      not double an existing suffix on a later update
    origin: none
  - id: BR-CAP-PFM-SEC-002-06
    proved_by: [ATS-PFM-SEC-002-06, TST-PFM-SEC-232]
    statement: >-
      A sandbox requires a customer-type parent from the same customer; other types have no parent, and a
      parent with sandboxes cannot become a sandbox or change customers.
    kind: invariant
    enforced_at:
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/db/tenants.table.integration.spec.js#refuses a
      sandbox whose parent belongs to another customer
    origin: 'services-platform:docs/hq/rhythm-hq-plan.md#D10'
  - id: BR-CAP-PFM-SEC-002-07
    proved_by: [ATS-PFM-SEC-002-07, TST-PFM-SEC-227]
    statement: >-
      Commercial-account changes require the separate versioned staff action; ordinary saves cannot
      change or clear that link, and selecting an account requests a licence refresh.
    kind: permission
    enforced_at:
      - api
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-hubspot-link.e2e.spec.js#refuses a patch that
      moves the link as 400, even for Rhythm staff in their own editor
    origin: none
  - id: BR-CAP-PFM-SEC-002-08
    proved_by: [ATS-PFM-SEC-002-08]
    statement: >-
      Workspace replacement requires the version read and rejects update-locked records; clearing omitted
      editable fields remains unproved.
    kind: validation
    enforced_at:
      - api
      - service
    must_prove: true
    provenance: unknown
    source: FND-PFM-SEC-035
    origin: 'services-platform:docs/standards/record-write-contracts.md#D-05'
  - id: BR-CAP-PFM-SEC-002-09
    proved_by: [ATS-PFM-SEC-002-09, ATS-PFM-SEC-002-22, ATS-PFM-SEC-002-24, ATS-PFM-SEC-003-21, ATS-PFM-SEC-015-12, ATS-PFM-SEC-019-13, TST-PFM-SEC-223, TST-PFM-SEC-266]
    statement: >-
      Ordinary workspace requests are refused during provisioning, provisioning failure, initial loading,
      pending deletion, deletion and disabled status; HQ staff operations remain available with reads
      only during deletion, and initial-import routes have a loading exception.
    kind: policy
    enforced_at:
      - api
      - service
    must_prove: true
    provenance: observed
    source: 'services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf'
    origin: >-
      services-platform:docs/tenants/tenant-lifecycle-plan.md#5.6 Tenant access and background work while
      pending
  - id: BR-CAP-PFM-SEC-002-10
    proved_by: []
    statement: >-
      Availability facts are cached for thirty seconds in each process; a process that explicitly
      invalidates those facts reads them again on its next check.
    kind: policy
    enforced_at:
      - service
    must_prove: false
    provenance: observed
    source: 'services-platform:modules/tenants/services/access/tenant-availability.ts:TENANT_AVAILABILITY_TTL_MS'
    origin: none
  - id: BR-CAP-PFM-SEC-002-11
    proved_by: [ATS-PFM-SEC-002-10, TST-PFM-SEC-230]
    statement: Direct workspace deletion leaves records intact and directs the caller to request deletion.
    kind: lifecycle
    enforced_at:
      - api
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#points the caller at the deletion
      request route
    origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#5.2 Who may do what'
  - id: BR-CAP-PFM-SEC-002-12
    proved_by: [ATS-PFM-SEC-002-11, TST-PFM-SEC-222, TST-PFM-SEC-264]
    statement: >-
      The HQ workspace list is staff-only, includes customer names, supports identifier, name and
      customer-name searches and status/type filters, and returns 25 records by default with a maximum of
      100.
    kind: policy
    enforced_at:
      - api
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/hq-tenants.e2e.spec.js#refuses an administrator of a
      customer as 403, even for their own tenant
    origin: 'services-platform:docs/hq/rhythm-hq-plan.md#D7'
  - id: BR-CAP-PFM-SEC-002-13
    proved_by: [ATS-PFM-SEC-002-12, TST-PFM-SEC-221, TST-PFM-SEC-243]
    statement: >-
      Each staff member has a private list of up to twenty pinned workspaces and ten recently opened
      workspaces; pinning does not count as opening.
    kind: policy
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/persistence/staff-tenant-shortcuts.integration.spec.js#refuses
      the pin that would be one too many, naming the maximum
    origin: none
  - id: BR-CAP-PFM-SEC-002-14
    proved_by: [ATS-PFM-SEC-002-13, TST-PFM-SEC-226]
    statement: >-
      HQ returns a workspace’s sender identity, publication records and verification state, or indicates
      that the shared Rhythm sender applies.
    kind: policy
    enforced_at:
      - service
    must_prove: false
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-email-sender.e2e.spec.js#answers the DNS records
      the customer must publish, so a support person can read them out
    origin: 'services-platform:docs/hq/rhythm-hq-plan.md#K3'
  - id: BR-CAP-PFM-SEC-002-15
    proved_by: []
    statement: >-
      The default workspace is the reachable one sharing the customer’s identifier, otherwise the first
      reachable identifier in order, or no workspace if reach is empty.
    kind: calculation
    enforced_at:
      - service
    must_prove: false
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/integration/services/default/get-default-tenant.integration.spec.js#answers
      the tenant the caller’s reach names rather than the first one listed
    origin: none
scenarios:
  - id: SC-CAP-PFM-SEC-002-01
    given: A customer administrator wants to stop using a workspace.
    when: They request disabled status through the console.
    then: 'The request fails, explains that Rhythm staff handle the change, and preserves the status.'
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not disable
      it, because cutting an association off is a staff act
  - id: SC-CAP-PFM-SEC-002-02
    given: A workspace has been disabled by Rhythm staff.
    when: A customer user attempts to open one of its contacts.
    then: The refusal describes the workspace as unavailable without disclosing its internal condition.
    provenance: test
    source: >-
      services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is told only that
      the tenant is not available
edge_cases: []
constraints: []
depends_on: []
related:
  - CAP-PFM-SEC-001
  - CAP-PFM-SEC-003
  - CAP-PFM-SEC-004
  - CAP-PFM-SEC-015
journeys:
  - JNY-PFM-SEC-001
open_questions:
  - OQ-PFM-SEC-002
evidence:
  - >-
    Pinned services-platform references for the structured rows: docs/hq/rhythm-hq-plan.md;
    docs/standards/record-write-contracts.md; docs/tenants/tenant-lifecycle-plan.md;
    modules/tenants/services/access/tenant-availability.ts;
    modules/tenants/services/persistence/tenants.ts; modules/tenants/tests/e2e/hq-tenants.e2e.spec.js;
    modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js;
    modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js;
    modules/tenants/tests/e2e/tenant-email-sender.e2e.spec.js;
    modules/tenants/tests/e2e/tenant-hubspot-link.e2e.spec.js;
    modules/tenants/tests/e2e/tenants.e2e.spec.js;
    modules/tenants/tests/integration/db/tenants.table.integration.spec.js;
    modules/tenants/tests/integration/services/default/get-default-tenant.integration.spec.js;
    modules/tenants/tests/integration/services/persistence/staff-tenant-shortcuts.integration.spec.js;
    modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js.
controls: [TC-AVL-001, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-003, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003]
exercised_by: [FAS-PFM-SEC-01-01, FAS-PFM-SEC-01-02, FAS-PFM-SEC-01-03, FAS-PFM-SEC-01-04]
suites: [TST-PFM-SEC-221, TST-PFM-SEC-222, TST-PFM-SEC-223, TST-PFM-SEC-225, TST-PFM-SEC-226, TST-PFM-SEC-227, TST-PFM-SEC-230, TST-PFM-SEC-232, TST-PFM-SEC-243, TST-PFM-SEC-253, TST-PFM-SEC-264, TST-PFM-SEC-266]
---
# Maintain workspace information and operating status

## Purpose

Staff need a recognizable workspace and the right business calendar when administering an association. This capability separates customer-maintained information from the operational decisions Rhythm makes in HQ.

## How It Works

A customer administrator locates the workspace within the customer’s permitted reach and opens its details. The editor presents the information that person is allowed to maintain. Saving can fail when the version has changed or an update lock applies, so the administrator reviews the refusal before trying again. Rhythm staff use the HQ list to find workspaces across customers and inspect their operational context. Sender information helps support explain which publication records the customer needs. Personal pins and recent entries help staff return to ongoing work. A commercial-account move uses a separate action because it affects licensing. Provisioning, import and deletion work provide the lifecycle context for these screens. Availability checks use cached facts, so an ordinary save should not be described as a global immediate cut-off.

## Relationships

- Customer records supply the commercial and ownership context.
- Provisioning and deletion control lifecycle progress.
- Request authorization and availability determine whether work can proceed.
- Licensing owns the applications enabled by the commercial account.