--- id: CAP-PFM-TNL-005 title: Apply workspace availability consistently feature: FEAT-PFM-TNL-02 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa intent_sources: - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.5' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9' - 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1' purpose: >- Lifecycle availability closes unfinished or disabled workspaces to ordinary customer requests while retaining authorized support access. outcomes: - Ordinary use requires active lifecycle and an enabled business mode. - >- Authorized system access remains available to staff, becoming read-only during destruction. - Platform background enumeration excludes non-operational workspaces. concepts: - CON-PFM-TNL-001 actors: - ACT-PFM-042 - ACT-PFM-039 - ACT-PFM-012 surfaces: - console - portal - api - job preconditions: [] postconditions: [] permissions: [] rules: - id: BR-CAP-PFM-TNL-005-01 statement: >- Ordinary workspace access requires active lifecycle and a non-disabled business status; other states receive the same unavailable response. kind: policy enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 The access gate (approved 2026-10-09) - id: BR-CAP-PFM-TNL-005-02 statement: >- The staff exception applies to authorized system routes, allowing support to inspect workspaces closed to customer callers. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is past the gate in a tenant its own customer could not reach, because staff reach every tenant origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 (approved); services-platform:docs/hq/rhythm-hq-plan.md#§D1 rule S1 - id: BR-CAP-PFM-TNL-005-03 statement: >- The workspace availability gate limits staff requests to reads during destruction and refuses mutations on the routes it gates. kind: policy enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#may not write to a tenant being deleted, which the same caller being served above is the premise for origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Writes (approved 2026-10-09) - id: BR-CAP-PFM-TNL-005-04 statement: >- Loading allows data-job requests in customer context and continues to admit authorized staff system routes. kind: policy enforced_at: - api - service must_prove: true provenance: observed source: >- services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf origin: >- services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (approved 2026-10-12, D5) - id: BR-CAP-PFM-TNL-005-05 statement: A missing workspace is unavailable even to an authorized staff caller. kind: policy enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/unit/services/access/tenant-availability.spec.js#is unavailable to staff too when there is no such tenant origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 (approved 2026-10-09) - id: BR-CAP-PFM-TNL-005-06 statement: >- Each process caches lifecycle facts for no more than thirty seconds; lifecycle workflows clear the changing process’s entry, while ordinary business-status updates can retain it until expiry. kind: policy enforced_at: - service must_prove: true provenance: observed source: >- services-platform:modules/tenants/services/persistence/tenants.ts:updateTenant origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 The cut-off is within the cache window (approved) - id: BR-CAP-PFM-TNL-005-07 statement: >- Platform’s background enumeration selects active workspaces whose business status is not disabled. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/persistence/tenants.queries.integration.spec.js#answers no disabled tenant, active though its lifecycle is origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.5, §5.6 Background loops (approved) - id: BR-CAP-PFM-TNL-005-08 statement: >- Derived-data messages remain processable for disabled or unfinished workspaces and are discarded for deleting or absent workspaces. kind: policy enforced_at: - service must_prove: false provenance: documented source: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 Background loops origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 (narrowed in review 2026-10-10) - id: BR-CAP-PFM-TNL-005-09 statement: >- Staff-entry grants apply to operational workspaces and to loading implementation workspaces, excluding other lifecycle states. kind: policy enforced_at: - service must_prove: false provenance: test source: >- services-platform:modules/tenants/tests/unit/services/lifecycle/lifecycle-transitions.spec.js#admits an implementation tenant that is loading, so a Data Run can act in the tenant it loads origin: none scenarios: - id: SC-CAP-PFM-TNL-005-01 given: Staff have disabled a departed customer’s workspace. when: A customer caller opens an ordinary workspace route. then: >- The route reports unavailable while authorized system support access remains possible. provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off - id: SC-CAP-PFM-TNL-005-02 given: An implementation workspace is loading. when: >- A customer-context import operator submits a bulk job and reads the ordinary contact list. then: The data-job request is admitted and the ordinary list is refused. provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/e2e/tenant-availability.e2e.spec.js#is refused the contact list 403 TenantUnavailable, because nothing but the import may touch the tenant edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-006 related: - CAP-PFM-TNL-011 - CAP-PFM-TNL-013 - CAP-PFM-TNL-016 journeys: - JNY-PFM-TNL-001 - JNY-PFM-TNL-003 - JNY-PFM-TNL-004 open_questions: - OQ-PFM-TNL-002 evidence: - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.5 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 The access gate (approved 2026-10-09) - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is past the gate in a tenant its own customer could not reach, because staff reach every tenant - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 (approved); services-platform:docs/hq/rhythm-hq-plan.md#§D1 rule S1 - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#may not write to a tenant being deleted, which the same caller being served above is the premise for - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Writes (approved 2026-10-09) - >- Inspected source: services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (approved 2026-10-12, D5) - >- Inspected source: services-platform:modules/tenants/tests/unit/services/access/tenant-availability.spec.js#is unavailable to staff too when there is no such tenant - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 (approved 2026-10-09) - >- Inspected source: services-platform:modules/tenants/tests/unit/services/access/tenant-availability.spec.js#reads again once the window has closed - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 The cut-off is within the cache window (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/persistence/tenants.queries.integration.spec.js#answers no disabled tenant, active though its lifecycle is - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.5, §5.6 Background loops (approved) - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 Background loops - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 (narrowed in review 2026-10-10) - >- Inspected source: services-platform:modules/tenants/tests/unit/services/lifecycle/lifecycle-transitions.spec.js#admits an implementation tenant that is loading, so a Data Run can act in the tenant it loads - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/e2e/tenant-availability.e2e.spec.js#is refused the contact list 403 TenantUnavailable, because nothing but the import may touch the tenant controls: [TC-AVL-001, TC-AVL-004, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-006, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Apply workspace availability consistently ## Purpose Lifecycle availability closes unfinished or disabled workspaces to ordinary customer requests while retaining authorized support access. ## How It Works Applications answer availability from the workspace’s lifecycle and business status. An ordinary caller reaches an active workspace unless it is disabled. Unfinished, failed and outgoing workspaces otherwise return a common unavailable response. Loading has a route exception for data-job work. Authorized staff on system routes retain access before that loading check applies. During destruction, staff can read through the gate but cannot write. Missing workspaces are unavailable to everyone. Each process caches the underlying facts for a short window, and the process making a lifecycle change invalidates its local entry. Background enumeration and derived-data processing have their own documented eligibility rules. ## Relationships - Preserve valid workspace lifecycle states: Lifecycle policy supplies the state and business-mode facts used by availability. - Control the initial import and subsequent opening: Its loading period and activation decision control initial import availability. - Schedule deliberate workspace deletion: The capabilities share the workspace’s recorded lifecycle decision. - Revalidate the irreversible deletion decision: The capabilities share the workspace’s recorded lifecycle decision.