---
id: CAP-PFM-SEC-013
title: Publish shared access definitions from releases
feature: FEAT-PFM-SEC-04
product_area: platform
module: security
revision: 1
status: draft
product_intent: confirmed
implementation_evidence: observed
supersedes: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
intent_sources:
  - >-
    services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11
    Final acceptance)
  - >-
    services-platform:docs/security/security-administration.md#14 (decision D3, per-service built-in
    policies, Andrew 2026-10-11)
  - 'services-platform:docs/security/built-in-policies.md#5 (D-14, Andrew 2026-10-19)'
  - 'services-platform:docs/security/built-in-policies.md#5 (D-03, Andrew 2026-10-18)'
  - >-
    services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-12
    Final acceptance: one permission pattern matcher)
  - 'services-platform:docs/security/security-administration.md#3.3 Lifecycle of a built-in'
purpose: >-
  Rhythm releases supply the permission catalog and shared built-in definitions that customer role
  management and authorization use.
outcomes:
  - Each service reconciles its own application declarations.
  - Built-in identity and references survive release changes.
  - Validation rejects malformed or altered release declarations before reconciliation.
concepts:
  - CON-PFM-SEC-003
actors:
  - ACT-PFM-006
  - ACT-PFM-004
surfaces:
  - job
  - api
preconditions: []
postconditions: []
permissions: []
rules:
  - id: BR-CAP-PFM-SEC-013-01
    proved_by: [ATS-PFM-SEC-013-01, TST-PFM-SEC-095]
    statement: >-
      Release reconciliation updates only the declaring service’s applications in a transaction and
      leaves an unchanged redeployment without further mutations.
    kind: invariant
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#leaves
      another service's keys and built-ins alone: CRM going live does not undo Platform
    origin: >-
      services-platform:docs/security/security-administration.md#14 (decision D3, per-service built-in
      policies, Andrew 2026-10-11)
  - id: BR-CAP-PFM-SEC-013-02
    proved_by: [ATS-PFM-SEC-013-02, TST-PFM-SEC-202]
    statement: >-
      Application tier generation builds Read Only, User and Administrator policies from the eligible
      exact keys at that tier and lower tiers.
    kind: calculation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives the
      user policy the read and user keys
    origin: 'services-platform:docs/security/security-administration.md#3.2 The authoritative catalog'
  - id: BR-CAP-PFM-SEC-013-03
    proved_by: [ATS-PFM-SEC-013-03, TST-PFM-SEC-201, TST-PFM-SEC-202, TST-PFM-SEC-203]
    statement: >-
      Generated tiers exclude staff-only, self-read, security-administration, staff-access and
      data-export powers while retaining eligible security-definition read keys.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#keeps a
      security power out of the Platform administrator policy, so a Power User cannot grant themselves
      more
    origin: 'services-platform:docs/security/built-in-policies.md#5 (D-14, Andrew 2026-10-19)'
  - id: BR-CAP-PFM-SEC-013-04
    proved_by: [ATS-PFM-SEC-013-04, TST-PFM-SEC-095, TST-PFM-SEC-096, TST-PFM-SEC-200]
    statement: >-
      Declared built-ins require an owned application, exact allowing permissions declared by that
      release, non-reserved names and deny patterns matching known keys.
    kind: validation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/catalog/release-manifest-built-ins.integration.spec.js#refuses
      it, naming the policy and the app this service defines no permission for
    origin: >-
      services-platform:docs/security/security-administration.md#14 (decision D3, per-service built-in
      policies, Andrew 2026-10-11)
  - id: BR-CAP-PFM-SEC-013-05
    proved_by: [ATS-PFM-SEC-013-05, TST-PFM-SEC-095, TST-PFM-SEC-096]
    statement: >-
      A new declared built-in starts as a shared version-one definition without a role reference; edits
      to the shared definition affect its holders across customers rather than create customer copies.
    kind: invariant
    enforced_at:
      - service
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#grants
      a newly shipped built-in to nobody: no role references it
    origin: 'services-platform:docs/security/security-administration.md#3.3 Lifecycle of a built-in'
  - id: BR-CAP-PFM-SEC-013-06
    proved_by: [ATS-PFM-SEC-013-06, ATS-PFM-SEC-013-12, ATS-PFM-SEC-013-13, ATS-PFM-SEC-013-14, TST-PFM-SEC-095]
    statement: >-
      Built-in renaming preserves identity and references; release withdrawal archives the definition and
      removes its authority with recorded impact, and republication restores that identity.
    kind: lifecycle
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#makes
      a retired built-in grant nothing while its holder keeps every other grant
    origin: 'services-platform:docs/security/security-administration.md#3.3 Lifecycle of a built-in'
  - id: BR-CAP-PFM-SEC-013-07
    proved_by: [ATS-PFM-SEC-013-07, ATS-PFM-SEC-016-10, TST-PFM-SEC-097, TST-PFM-SEC-201, TST-PFM-SEC-202]
    statement: >-
      The catalog ships customer roles Administrator, Power User, Standard User, Read Only and Portal
      Member and staff roles Support Representative, Software Engineer and Rhythm Administrator; the
      customer Administrator alone receives the security-administrator and data-exporter policies.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#publishes
      the eight roles the catalog ships, in the order it ships them
    origin: 'services-platform:docs/security/built-in-policies.md#5 (D-14, Andrew 2026-10-19)'
  - id: BR-CAP-PFM-SEC-013-08
    proved_by: []
    statement: >-
      Portal Member includes its sign-in keys and the four named Submissions portal keys only when those
      keys are present in the reconciled release catalog.
    kind: calculation
    enforced_at:
      - service
    must_prove: false
    provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#gains
      the four portal keys when the Submissions release is reconciled, and none of the release's other
      keys
    origin: >-
      services-platform:docs/security/built-in-policies.md#6 (D-2 of the Submissions acceptance plan,
      Andrew 2026-10-19)
  - id: BR-CAP-PFM-SEC-013-09
    proved_by: [ATS-PFM-SEC-013-08, TST-PFM-SEC-202]
    statement: >-
      Built-in role patterns do not confer customer-owned custom-record authority; staff roles supply
      platform-scoped HQ authority, and emergency-access permission belongs only to Rhythm Administrator.
    kind: invariant
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives no
      built-in role a pattern that reaches a customer’s own records, the staff roles included
    origin: 'services-platform:docs/hq/rhythm-hq-plan.md#H2'
  - id: BR-CAP-PFM-SEC-013-10
    proved_by: [ATS-PFM-SEC-013-09, TST-PFM-SEC-074]
    statement: >-
      Database safeguards reject built-in definition, rule and attachment mutations outside a
      reconciliation context.
    kind: invariant
    enforced_at:
      - database
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/integration/db/security-definition-integrity.integration.spec.js#refuses
      an insert, an update and a delete of a built-in role outside a reconciliation
    origin: >-
      services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11
      Final acceptance)
  - id: BR-CAP-PFM-SEC-013-11
    proved_by: [ATS-PFM-SEC-013-10, ATS-PFM-SEC-013-15, TST-PFM-SEC-095, TST-PFM-SEC-197, TST-PFM-SEC-200]
    statement: >-
      Release validation rejects malformed or duplicate keys and content differing from an
      already-published release, returning all identified problems before writes.
    kind: validation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#answers every
      problem of the release at once, rather than the first one it met
    origin: >-
      services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11
      Final acceptance)
  - id: BR-CAP-PFM-SEC-013-12
    proved_by: [ATS-PFM-SEC-013-11, TST-PFM-SEC-214]
    statement: >-
      Catalog, grant filtering and authorization use the shared permission matcher so supported short
      star patterns match remaining permission segments consistently.
    kind: calculation
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/persistence/permission-matcher.spec.ts#gives
      the same answer from all four functions for every pattern and key of the corpus
    origin: >-
      services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-12
      Final acceptance: one permission pattern matcher)
  - id: BR-CAP-PFM-SEC-013-13
    proved_by: []
    statement: >-
      Tier regeneration classifies removing keys alone as narrowing and adding keys as widening in its
      audit record.
    kind: calculation
    enforced_at:
      - service
    must_prove: false
    provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#records a
      rewrite that only drops a key as narrowing, so the audit does not read as a widening
    origin: none
scenarios:
  - id: SC-CAP-PFM-SEC-013-01
    given: Accounting introduces an eligible administrator-tier permission.
    when: The service release is reconciled.
    then: >-
      Its shared administrator tier includes the new key, affecting holders of that policy without
      rewriting customer-owned definitions.
    provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#adds
      a declared key, puts it in the built-ins its tier belongs to, and records the release
edge_cases: []
constraints: []
depends_on: []
related:
  - CAP-PFM-SEC-012
  - CAP-PFM-SEC-015
journeys: []
open_questions: []
evidence:
  - >-
    Pinned services-platform references for the structured rows: docs/hq/rhythm-hq-plan.md;
    docs/security/built-in-policies.md; docs/security/security-administration.md;
    modules/security/tests/integration/db/security-definition-integrity.integration.spec.js;
    modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js;
    modules/security/tests/integration/services/catalog/release-manifest-built-ins.integration.spec.js;
    modules/security/tests/unit/services/catalog/catalog-plan.spec.ts;
    modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts;
    modules/security/tests/unit/services/persistence/permission-matcher.spec.ts.
controls: [TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
exercised_by: [FAS-PFM-SEC-04-02, FAS-PFM-SEC-04-03]
suites: [TST-PFM-SEC-074, TST-PFM-SEC-095, TST-PFM-SEC-096, TST-PFM-SEC-097, TST-PFM-SEC-197, TST-PFM-SEC-200, TST-PFM-SEC-201, TST-PFM-SEC-202, TST-PFM-SEC-203, TST-PFM-SEC-214]
---
# Publish shared access definitions from releases

## Purpose

Shared access definitions give staff a consistent starting point and authorization a current catalog. Release reconciliation connects those definitions to the service that owns their permissions.

## How It Works

A service submits its release declarations to the catalog. Validation identifies bad keys and built-in declarations before reconciliation proceeds. Tier generation supplies the common read, user and administrator policy groupings. Specialized powers use declared policies rather than enter every generated tier. Existing role holders can acquire a newly declared tier key through their shared policy, so release review must consider that impact. A new standalone declared policy has no holder until a role includes it. Renaming or restoring a built-in preserves the reference staff already use. Withdrawal removes that definition’s authority and records the affected holders. Customer administrators continue to inspect or copy built-ins while reconciliation remains the authorized write path for the shared originals.

## Relationships

- Customer definition management composes and copies these shared policies.
- Request authorization evaluates the reconciled permissions and route declarations.