--- id: CON-PFM-SEC-002 name: Workspace feature: FEAT-PFM-SEC-01 product_area: platform module: security revision: 1 status: draft product_intent: confirmed implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f definition: >- A workspace holds an association’s operational records, with staff-controlled business status and system-controlled readiness and retirement. owned_by: MOD-PFM-SEC synonyms: - association’s workspace - organization (in screens) not_to_be_confused_with: - Customer - Website or site - Sandbox data copy facets: - name: Identifier meaning: A readable permanent reference identifies the workspace and remains reserved after deletion. used_for: Addressing association work without reassigning an old identity. - name: Workspace type meaning: 'Customer, sandbox, demo, training and support classify the workspace’s purpose.' used_for: Distinguishing operational use from test and internal work. - name: Sandbox meaning: A sandbox names a production parent belonging to the same customer. used_for: Providing a separate place for preparation beside production. - name: Business status meaning: 'Staff set implementation, live or disabled as the business standing.' used_for: Controlling commercial readiness and suspension. - name: Lifecycle state meaning: 'System work moves provisioning, failure, active, loading and deletion states.' used_for: Restricting ordinary work until the workspace is operational. - name: Details meaning: 'Presentation and calendar settings include the name, acronym and time zone.' used_for: Identifying the association and interpreting dated work. - name: Commercial link meaning: A HubSpot reference identifies the account used to obtain licences. used_for: Determining available applications through licensing. - name: E-mail sender meaning: 'A configured domain or address provides a verified sender, with the shared sender as fallback.' used_for: Sending association mail under its selected identity. - name: Provisioning request meaning: An accountable request launches durable preparation across participating services. used_for: Creating a usable workspace with retryable progress. - name: Initial import meaning: 'Loading, reset and activation organize the initial migration period.' used_for: Preparing imported records before ordinary use. - name: Deletion request meaning: 'A retained request records waiting, notices and decisions before retirement.' used_for: Keeping deletion deliberate and cancellable before destruction. - name: Staff shortcuts meaning: Each staff member keeps personal pins and recently opened workspaces. used_for: Returning to the workspaces relevant to their own work. relationships: - to: CON-PFM-SEC-001 statement: 'Each workspace has one customer, shared by any production parent and its sandbox.' provenance: test source: >- services-platform:modules/tenants/tests/integration/db/tenants.table.integration.spec.js#refuses a sandbox whose parent belongs to another customer - to: CON-PFM-SEC-003 statement: A role assignment can apply within one workspace or throughout the owning customer. provenance: test source: >- services-platform:modules/security/tests/integration/services/membership/set-role-scope.integration.spec.js#turns the customer grant into one active grant per tenant asked for, revoking the customer grant - to: CON-PFM-SEC-003 statement: 'Staff access addresses a workspace, with standing access able to address the customer.' provenance: documented source: 'services-platform:docs/hq/rhythm-hq-plan.md#D2. Staff access to customer tenants' - to: CON-PFM-SEC-003 statement: Portal membership belongs to a workspace and its registered sign-in pool. provenance: test source: >- services-platform:modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js#creates the member, active and verified, in the pool’s tenant under the account’s own id lifecycle: - state: provisioning meaning: 'Participating services are preparing the workspace, so ordinary use is unavailable.' how_it_changes: Provisioning begins from a staff request. - state: provisioning failed meaning: Preparation failed and retains the partial work for inspection. how_it_changes: A failed job enters this state; staff can request retry or retirement. - state: active meaning: Ordinary use is available when business status permits it. how_it_changes: 'Successful provisioning, import activation or deletion cancellation restores this state.' - state: loading meaning: Initial migration work runs while ordinary use is unavailable. how_it_changes: Staff open loading and later activate the prepared workspace. - state: deletion pending meaning: A disabled workspace waits for deletion and remains cancellable. how_it_changes: Requesting deletion enters this state; cancellation returns it to active. - state: deleting meaning: 'Destruction is underway, cancellation is no longer possible and staff actions are read-only.' how_it_changes: Passing the destruction checks enters this state; successful purge removes the workspace. acted_on_by: - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 - CAP-PFM-SEC-004 - CAP-PFM-SEC-007 - CAP-PFM-SEC-019 visible_to: - ACT-PFM-001 - ACT-PFM-002 - ACT-PFM-004 - ACT-PFM-005 - ACT-PFM-006 evidence: - >- Pinned services-platform references for the structured rows: docs/hq/rhythm-hq-plan.md; modules/security/tests/integration/services/membership/set-role-scope.integration.spec.js; modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js; modules/tenants/tests/integration/db/tenants.table.integration.spec.js. supersedes: [] --- # Workspace ## What It Is A workspace is the place where an association's records and daily work belong. It separates that work from other associations, including associations served by the same management company. The customer identifies the paying organization; the workspace identifies the operational space that organization administers. Rhythm staff request a workspace through provisioning. They supply its readable identifier and configuration, and participating services prepare the records and resources needed to use it. The identifier remains its reference throughout its life and is reserved after deletion rather than assigned to a different workspace. Two independent dimensions describe its standing. Business status expresses whether it is in implementation, live or disabled. Lifecycle state describes construction, loading, ordinary operation and retirement. Staff decide business status through the appropriate Rhythm HQ action; lifecycle work controls the operational state. A workspace can therefore be active in its lifecycle while still in implementation as a business decision. ## What It Is Not A workspace is separate from its paying customer and from the public site operated through Websites. Its configuration does not itself establish which applications are licensed. A sandbox is an additional workspace linked to a production parent; creating it does not copy the parent's association records. ## How It Is Used Staff follow provisioning progress, prepare an initial import and activate the workspace when that preparation is ready. A failed provisioning remains available for inspection and retry rather than disappearing with its partial work. Loading provides a controlled period for migration work while ordinary use is unavailable. Rhythm HQ helps staff find workspaces by their identity and customer, return through personal shortcuts and inspect sender information. Customer administrators maintain the editable details within their authority. Retirement begins with disabling the workspace and making a recorded deletion request; staff can hold or cancel it before destruction starts. ## Its Facets **Identifier and type.** The readable reference identifies the workspace permanently. Customer, sandbox, demo, training and support types distinguish its purpose. **Sandbox relationship.** A sandbox names a production parent under the same customer. It provides a separate place for preparation without establishing a copying workflow. **Business status and lifecycle.** Commercial standing and operational readiness answer different questions. Loading, provisioning and deletion restrict ordinary use through the availability gate. **Details.** Name, acronym and time zone support recognizable presentation and the calendar used for dated work. **Commercial link and sender.** The commercial account supplies licensing information. A configured sender supports association-branded mail once verification is complete; provisioning does not wait for DNS publication. **Lifecycle requests.** Provisioning, initial import, reset, activation and deletion provide accountable steps for bringing the workspace into use and retiring it. **Staff shortcuts.** Pins and recent openings help each staff member return to their own working set. ## How It Relates A workspace belongs to one customer and can be the scope of ordinary or staff access. Portal members belong to its portal pool. Other applications retain their own association records within the workspace and participate in the lifecycle protocol when those records are created or removed. ## What It Could Become The product should settle access to disabled workspaces, enforce any required import-completion check before go-live, and provide appropriate deletion-request screens. Copying production data into sandboxes, customer-facing retirement notices and faster backup erasure remain distinct decisions. They should be decided before the corresponding design promises behavior that the current lifecycle does not provide.