---
id: ADR-PFM-TNL-013
title: Separate Staff Lifecycle Authorities
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Separate staff authority for construction, inspection, import, activation and deletion decisions, while
  keeping application lifecycle calls internal.
constrains:
- SVC-PFM-TNL-tenants
- SCR-PFM-TNL-001
- SCR-PFM-TNL-002
- SCR-PFM-TNL-003
origin: services-platform:docs/hq/rhythm-hq-plan.md#§D1, §H1 (approved 2026-10-11); services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2
  step 8; tenant-lifecycle-plan.md#§5.2
alternatives:
- option: One administrative permission for everything
  why_not: One key would collapse distinct import, activation and destruction authority.
- option: Customer-administrator lifecycle actions
  why_not: Customer administration does not authorize staff lifecycle operations.
consequences:
- The route authorizer rejects customer administrators before staff handlers run.
- Import authority alone cannot activate, and hold authority alone cannot cancel.
- Security retains the role-to-key distribution.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: aws/platform.service.ts (HQ_TENANTS_PERMISSIONS, HQ_DATA_RUNS_PERMISSIONS, TENANTS_PERMISSIONS);
  modules/tenants/aws/api/*.routes.ts.'
---

# Separate Staff Lifecycle Authorities

## Context

Starting an import, accepting its result and destroying a workspace are different decisions. Permission boundaries should reflect those consequences.

## Decision

Separate staff authority for construction, inspection, import, activation and deletion decisions, while keeping application lifecycle calls internal.

## Alternatives Considered

One administrative permission for everything: One key would collapse distinct import, activation and destruction authority. Customer-administrator lifecycle actions: Customer administration does not authorize staff lifecycle operations.

## Consequences

The route authorizer rejects customer administrators before staff handlers run. Import authority alone cannot activate, and hold authority alone cannot cancel. Security retains the role-to-key distribution.