--- id: CON-PFM-SEC-006 name: Staff Access Grant feature: FEAT-PFM-SEC-05 product_area: platform module: security revision: 1 status: superseded product_intent: confirmed implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f definition: >- A staff access grant records consented, emergency or standing entry into customer work, materialized through an ordinary role assignment. owned_by: MOD-PFM-SEC synonyms: - workspace access grant - Rhythm access - support access not_to_be_confused_with: - Staff role - Impersonation - Console account at the customer facets: - name: Approved access meaning: Customer approval converts a staff request into time-limited access of one to thirty days. used_for: Supporting routine customer work with recorded consent. - name: Given access meaning: A customer administrator initiates access for a named staff member without a preceding request. used_for: Giving staff entry proactively for agreed work. - name: Emergency access meaning: A Rhythm Administrator opens up to four hours of incident access with a reason and ticket. used_for: Responding when an incident requires entry before approval. - name: Standing access meaning: Rhythm Administrators and founding super users receive ongoing customer-wide Administrator access. used_for: Entering customer work under recorded standing authority. - name: Request meaning: A pending access record awaits a decision and provides no usable assignment. used_for: Recording the request before consent is decided. - name: Emergency report meaning: The report groups emergency access opened during the selected month. used_for: Inspecting incident entry across that reporting period. - name: Staff roles meaning: The three staff roles hold their HQ authority at platform scope. used_for: 'Separating support, engineering and staff-administration powers.' relationships: - to: CON-PFM-SEC-005 statement: Usable staff access is expressed through an ordinary assignment of the selected role. provenance: test source: >- services-platform:modules/security/tests/integration/services/staff-access/approved-tenant-access.integration.spec.js#materializes a tenant-scoped assignment of the role, ending when the grant does - to: CON-PFM-SEC-002 statement: 'The access record identifies either a workspace or, for standing access, a customer.' provenance: documented source: 'services-platform:docs/hq/rhythm-hq-plan.md#D2. Staff access to customer tenants' - to: CON-PFM-SEC-001 statement: Each access record names the staff account acting in the customer’s workspace. provenance: test source: >- services-platform:modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js#gives every Rhythm Administrator its grant, the integration database’s own among them lifecycle: - state: requested meaning: The request is recorded without usable access. how_it_changes: 'A staff request starts the record; approval, decline or withdrawal resolves it.' - state: active meaning: Fresh evaluation permits the staff member’s assigned work within its window. how_it_changes: 'Approval, direct customer grant, emergency entry or standing reconciliation establishes access.' - state: declined or withdrawn meaning: The request ends without becoming usable access. how_it_changes: A customer decision or requester withdrawal closes the request. - state: expired meaning: The recorded access period has finished. how_it_changes: 'Its end time passes, with cached decisions retaining their separate expiry.' - state: revoked meaning: 'Customer, staff or system action ends the grant before its normal expiry.' how_it_changes: Revocation closes access; deployment preserves a deliberately revoked standing grant. acted_on_by: - CAP-PFM-SEC-017 - CAP-PFM-SEC-016 - CAP-PFM-SEC-007 visible_to: - ACT-PFM-001 - ACT-PFM-004 - ACT-PFM-005 evidence: - >- Pinned services-platform references for the structured rows: docs/hq/rhythm-hq-plan.md; modules/security/tests/integration/services/staff-access/approved-tenant-access.integration.spec.js; modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js. supersedes: [] --- # Staff Access Grant ## What It Is This retained record is superseded by the User Account concept, which now owns its facets. A staff access grant records the basis on which a Rhythm employee can work inside a customer's workspace. Rhythm HQ authority manages the platform; it does not automatically turn a staff member into one of a customer's console users. Staff access provides the connection between those two kinds of work while retaining the employee's own identity. Routine access begins with a request for a customer-appropriate role, a duration and a reason. The request does not provide usable authority while it waits. A customer administrator can approve access or give it directly. Emergency access supports an incident without prior approval under its own safeguards. Standing access supports the recorded authority of Rhythm Administrators and founding super users across customers. The grant carries its kind, status and relevant dates, together with the people and reasons behind its creation and decisions. An ordinary role assignment provides the resulting application authority. Keeping the access record separate from that assignment lets administrators explain both why staff entered and what they could do. ## What It Is Not The grant is distinct from a staff role and from membership at the customer. It does not impersonate a customer employee: activity remains attributed to the Rhythm person who performs it. A request that awaits a decision is also distinct from active access and cannot be treated as consent already given. ## How It Is Used Support staff request access from Rhythm HQ when customer work requires entry. Authorized customer administrators review the request in Rhythm Access and decide whether the role and duration are appropriate. They can also give access to a named staff member or revoke existing access. Rhythm Administrators use standing access where it exists and emergency access only where the relevant safeguards allow it. A banner explains the current entry into a workspace. Staff can finish temporary work by ending their own eligible grant, while administrator actions cover appropriate intervention in another person's access. Notifications and security history support review of those decisions. ## Its Facets **Approved and given access.** Approval resolves a staff request; given access starts with the customer's own decision. Duration and role describe the work authorized. **Emergency access.** An incident reason, ticket and short maximum duration distinguish emergency entry. Customer and staff-security notifications provide visibility even though approval is not required first. **Standing access.** Role-based or founding authority establishes customer-wide entry without a routine expiry. A deliberately revoked standing grant is not restored by deployment. **Request state.** Waiting, decided and ended records explain progress separately from whether the resulting assignment currently allows work. **Reporting.** Security history and the emergency report support investigation without treating the employee as a customer member. **Staff standing.** HQ roles determine who can request, open emergency access or intervene in another employee's grant. ## How It Relates The record names a staff account and a workspace or customer. Its ordinary assignment uses a role appropriate to customer work. The security context presents reachable workspaces, while signed and cached authorization decisions determine the practical propagation window when access changes. ## What It Could Become The product should communicate that expiry or revocation can take up to the accepted cache bound to affect previously authorized requests. Mandatory staff multi-factor sign-in remains deferred. The product should keep consented, emergency and standing entry distinguishable in access reviews, so customers understand the basis for staff work and the decisions available to them.