--- id: AUTH-SUB title: Submissions Authorization Model product_area: submissions revision: 1 status: draft design_intent: proposed implementation_evidence: partially-observed source_sha: rhythm-v2-docs: ec0b44d8b41c3c03a84b911844227e0cb53aa40a services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_BUILT_IN_POLICIES' scopes: - name: customer meaning: 'Platform can assign a role across the customer’s workspaces, subject to each workspace boundary.' provenance: observed source: 'services-platform:modules/security/services/persistence/assignments.ts:scopeSliceToTarget' - name: workspace meaning: The active identity and allowed workspace constrain every local read and write. provenance: observed source: 'services-submissions:modules/intake/services/access/caller-identity.ts:contributionTokenCaller' - name: process meaning: >- Declared process-scoped permissions identify a review process as the narrower resource; deployed gateway enforcement remains a recorded gap. provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSION_DEFINITION_RESOURCE_TYPE' - name: record participation meaning: >- Application participants, assigned reviewers and contributors reach the record and actions their participation permits. provenance: observed source: 'services-submissions:modules/intake/services/access/submission-access.ts:requireReach' - name: platform meaning: >- Rhythm platform authority admits system routes; entering customer work requires the applicable Platform staff-access grant. provenance: documented source: >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-011-grant-and-end-staff-entry-to-a-customer-workspace.md roles: - id: ROLE-SUB-001 name: Engine administrator who: A customer staff administrator holds the comprehensive engine policy through an assigned Platform role. grants: - submissions.application.access - submissions.assignments.manage - submissions.assignments.read - submissions.conflicts.declare - submissions.conflicts.resolve - submissions.contribution-requests.query - submissions.contribution-responses.query - submissions.contributions.manage - submissions.contributions.read - submissions.contributions.read-confidential - submissions.decisions.override - submissions.decisions.record - submissions.definitions.create - submissions.definitions.delete - submissions.definitions.read - submissions.definitions.update - submissions.engine.resolve-actions - submissions.review-assignments.query - submissions.review-responses.query - submissions.reviewer-rules.create - submissions.reviewer-rules.delete - submissions.reviewer-rules.read - submissions.reviewer-rules.update - submissions.reviews.export - submissions.reviews.read-confidential - submissions.rubrics.create - submissions.rubrics.delete - submissions.rubrics.read - submissions.rubrics.update - submissions.stage-runs.query - submissions.stages.override - submissions.submission-decisions.query - submissions.submission-layouts.create - submissions.submission-layouts.delete - submissions.submission-layouts.read - submissions.submission-layouts.update - submissions.submissions.create - submissions.submissions.delete - submissions.submissions.manage - submissions.submissions.query - submissions.submissions.read - submissions.submissions.update - submissions.workflow-action-runs.query - submissions.workflow-timers.query policy: 'policy:submissions:engine-administrator' provenance: observed source: 'services-submissions:aws/submissions.service.ts:ADMINISTRATOR_KEYS' - id: ROLE-SUB-002 name: Coordinator who: >- A customer staff coordinator holds configuration preparation and routine operational authority through an assigned Platform role. grants: - submissions.application.access - submissions.assignments.manage - submissions.assignments.read - submissions.conflicts.declare - submissions.contribution-requests.query - submissions.contributions.manage - submissions.contributions.read - submissions.decisions.record - submissions.definitions.create - submissions.definitions.read - submissions.definitions.update - submissions.review-assignments.query - submissions.review-responses.query - submissions.reviewer-rules.create - submissions.reviewer-rules.read - submissions.reviewer-rules.update - submissions.reviews.export - submissions.rubrics.create - submissions.rubrics.read - submissions.rubrics.update - submissions.stage-runs.query - submissions.submission-decisions.query - submissions.submission-layouts.create - submissions.submission-layouts.read - submissions.submission-layouts.update - submissions.submissions.create - submissions.submissions.delete - submissions.submissions.manage - submissions.submissions.query - submissions.submissions.read - submissions.submissions.update - submissions.workflow-action-runs.query - submissions.workflow-timers.query policy: 'policy:submissions:coordinator' provenance: observed source: 'services-submissions:aws/submissions.service.ts:COORDINATOR_KEYS' - id: ROLE-SUB-003 name: Staff reviewer who: >- A customer staff reviewer holds the reviewer policy and acts on work assigned to their workspace user identity. grants: - submissions.application.access - submissions.assignments.read - submissions.contributions.read policy: 'policy:submissions:staff-reviewer' provenance: observed source: 'services-submissions:aws/submissions.service.ts:STAFF_REVIEWER_KEYS' - id: ROLE-SUB-004 name: Reader who: >- A customer staff reader holds inspection and ordinary dataset authority through an assigned Platform role. grants: - submissions.application.access - submissions.assignments.read - submissions.contribution-requests.query - submissions.contributions.read - submissions.definitions.read - submissions.review-assignments.query - submissions.review-responses.query - submissions.reviewer-rules.read - submissions.rubrics.read - submissions.stage-runs.query - submissions.submission-decisions.query - submissions.submission-layouts.read - submissions.submissions.query - submissions.submissions.read - submissions.workflow-action-runs.query - submissions.workflow-timers.query policy: 'policy:submissions:reader' provenance: observed source: 'services-submissions:aws/submissions.service.ts:READER_KEYS' - id: ROLE-SUB-005 name: Portal member who: >- A signed-in portal member receives the active Submissions portal keys from the shared Platform role and reaches records through participation. grants: - submissions.application.access - submissions.definitions.read - submissions.submissions.read - submissions.submissions.create platform_role: 'role:portal-member' grant_condition: Each key is included only while the active permission catalogue declares it assignable. provenance: observed source: 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:SUBMISSIONS_PORTAL_MEMBER_KEYS' permissions: - key: crm.contacts.read intent: Find applicants in CRM while entering an application. operations: [] surfaces: - CRM contact picker guarded_by: [] kind: permission provenance: observed source: 'react-console:lib/submissions/work/contact-search.ts:withCrmReadExplanation' operation_note: CRM owns the lookup operation; no engine operation grants CRM access. - key: submissions.application.access intent: Open Submissions and use assignment-based reviewer operations. operations: - requestInformationForReview - listMyReviewAssignments - getReviewAssignment - acceptReviewAssignment - declineReviewAssignment - recuseReviewAssignment - delegateReviewAssignment - saveReviewResponse - submitReviewResponse - amendReviewResponse - declareReviewConflict surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-010-01 - BR-CAP-SUB-SUB-020-03 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.assignments.manage intent: 'Assign, reassign, revoke or refresh reviewer selection on a stage.' operations: - reassignReviewAssignment - revokeReviewAssignment - assignStageRunReviewers - reResolveStageRun surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-009-05 - BR-CAP-SUB-SUB-009-10 - BR-CAP-SUB-SUB-009-11 - BR-CAP-SUB-SUB-009-12 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.assignments.read intent: - BR-CAP-SUB-SUB-010-01 - BR-CAP-SUB-SUB-020-06 operations: [] surfaces: - console guarded_by: - BR-CAP-SUB-SUB-010-01 - BR-CAP-SUB-SUB-020-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. - key: submissions.conflicts.declare intent: Declare a conflict on behalf of a reviewer. operations: - declareSubmissionConflict surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.conflicts.resolve intent: Clear or waive a declared conflict with a recorded explanation. operations: - clearReviewConflict - waiveReviewConflict surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-012-06 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.contribution-requests.query intent: Query contribution request metadata through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.contribution-responses.query intent: Query confidential contribution response metadata through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.contributions.manage intent: Create and administer contribution requests as staff. operations: - listContributionRequirements - createContributionRequest - getContributionRequest - resendContributionRequest - remindContributor - replaceContributor - cancelContributionRequest - revokeContributionRequest surfaces: - portal API - console API guarded_by: - BR-CAP-SUB-SUB-016-01 - BR-CAP-SUB-SUB-016-02 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.contributions.read intent: Inspect contribution requests and permitted response content. operations: - listContributionRequirements - createContributionRequest - listContributionRequests - getContributionRequest - resendContributionRequest - remindContributor - replaceContributor - cancelContributionRequest - getContributionResponse surfaces: - portal API - console API guarded_by: - BR-CAP-SUB-SUB-016-08 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.contributions.read-confidential intent: Read confidential contribution content outside an assigned-reviewer projection. operations: - getSubmission - getSubmissionRevision - downloadSubmissionAttachment - getContributionRequest - getContributionResponse surfaces: - portal API - console API guarded_by: - BR-CAP-SUB-SUB-016-08 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.decisions.override intent: Replace a recorded decision while retaining the earlier result. operations: - supersedeSubmissionDecision surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-014-08 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.decisions.record intent: Record a staff outcome or report acknowledgement of a decision. operations: - recordSubmissionDecision - acknowledgeSubmissionDecision surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-014-05 - BR-CAP-SUB-SUB-014-06 - BR-CAP-SUB-SUB-015-07 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.definitions.create intent: Create or copy processes and create shared reasons. operations: - createSubmissionDefinition - cloneSubmissionDefinition - createStatusReason - createDeclineReason surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.definitions.delete intent: Remove or archive processes and retire shared reasons. operations: - removeSubmissionDefinition - removeStatusReason - removeDeclineReason surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-001-05 - BR-CAP-SUB-SUB-005-04 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.definitions.read intent: 'Inspect processes, their versions and stages, and shared reason lists.' operations: - listSubjectKinds - listSubmissionDefinitions - listOpenSubmissionDefinitions - getSubmissionDefinition - listSubmissionDefinitionVersions - getSubmissionDefinitionVersion - listWorkflowStages - dryRunSubmissionDefinitionVersionActions - listStatusReasons - getStatusReason - listDeclineReasons - getDeclineReason surfaces: - console API - portal API - console guarded_by: - BR-CAP-SUB-SUB-001-10 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.definitions.update intent: 'Edit process drafts and reasons, replace stages and publish a prepared process version.' operations: - updateSubmissionDefinition - createSubmissionDefinitionVersion - updateSubmissionDefinitionVersion - publishSubmissionDefinitionVersion - replaceWorkflowStages - updateStatusReason - updateDeclineReason surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-001-03 - BR-CAP-SUB-SUB-001-10 - BR-CAP-SUB-SUB-002-01 - BR-CAP-SUB-SUB-002-14 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.engine.resolve-actions intent: Retry or skip failed follow-up work or retry a blocked timer with a recorded explanation. operations: - retrySubmissionActionRun - skipSubmissionActionRun - retrySubmissionTimer surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-018-07 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.review-assignments.query intent: Query reviewer assignments through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.review-responses.query intent: Query assessment metadata through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.reviewer-rules.create intent: Create or copy reviewer rules and teams. operations: - createReviewerRule - createReviewTeam - copyReviewTeam surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-004-02 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.reviewer-rules.delete intent: Remove or archive reviewer rules and teams. operations: - removeReviewerRule - archiveReviewTeam surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-004-04 - BR-CAP-SUB-SUB-004-05 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.reviewer-rules.read intent: Inspect reviewer rules and teams. operations: - listReviewerRules - getReviewerRule - listReviewTeams - getReviewTeam surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-004-02 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.reviewer-rules.update intent: Edit reviewer rules and teams. operations: - updateReviewerRule - updateReviewTeam - replaceReviewTeamMembers surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-004-02 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.reviews.export intent: 'Carry the declared review-export entitlement, whose engine export route is absent.' operations: [] surfaces: - planned Platform export guarded_by: [] kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. - key: submissions.reviews.read-confidential intent: Read reviewer notes excluded from ordinary staff response views. operations: - listSubmissionReviewResponses surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-017-02 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.rubrics.create intent: Create or copy scoring sheets. operations: - createReviewRubric - copyReviewRubric surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-003-01 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.rubrics.delete intent: Remove or archive scoring sheets. operations: - archiveReviewRubric surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-003-06 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.rubrics.read intent: Inspect scoring sheets. operations: - listReviewRubrics - getReviewRubric - listRubricVersions - getRubricVersion surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-003-01 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.rubrics.update intent: Edit scoring sheets. operations: - updateReviewRubric - createRubricVersion - updateRubricVersion - publishRubricVersion surfaces: - console API - console guarded_by: - BR-CAP-SUB-SUB-003-05 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.stage-runs.query intent: Query stage progress through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.stages.complete intent: Report an external requirement completed through the staff-only system operation. operations: - completeStageRunRequirement surfaces: - system API guarded_by: - BR-CAP-SUB-SUB-020-08 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' staff_only: true - key: submissions.stages.override intent: Close a stage early or waive a requirement with a recorded explanation. operations: - closeStageRun - waiveStageRunRequirement surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-011-09 - BR-CAP-SUB-SUB-011-10 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.submission-decisions.query intent: Query outcomes through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.submission-layouts.create intent: 'Create or copy intake and review layouts, as a declared entitlement without an engine route.' operations: [] surfaces: - planned Platform layout administration guarded_by: [] kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. - key: submissions.submission-layouts.delete intent: 'Remove or archive intake and review layouts, as a declared entitlement without an engine route.' operations: [] surfaces: - planned Platform layout administration guarded_by: [] kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. - key: submissions.submission-layouts.read intent: 'Inspect intake and review layouts, as a declared entitlement without an engine route.' operations: [] surfaces: - planned Platform layout administration guarded_by: [] kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. - key: submissions.submission-layouts.update intent: 'Edit intake and review layouts, as a declared entitlement without an engine route.' operations: [] surfaces: - planned Platform layout administration guarded_by: [] kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. - key: submissions.submissions.create intent: Start an application under a published process. operations: - startSubmission surfaces: - portal API - console guarded_by: - BR-CAP-SUB-SUB-006-03 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.submissions.delete intent: 'Carry the declared application-deletion entitlement, which has no engine route.' operations: [] surfaces: [] guarded_by: [] kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. - key: submissions.submissions.manage intent: 'Close, reopen or correct an application administratively.' operations: - closeSubmission - reopenSubmission - correctSubmissionPayload surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-008-08 - BR-CAP-SUB-SUB-008-09 - BR-CAP-SUB-SUB-008-11 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.submissions.query intent: Query applications through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.submissions.read intent: >- Enter application-reading routes and inspect records through the caller’s allowed staff or participant view. operations: - getSubmissionDefinitionProgress - startSubmission - listSubmissions - listOwnSubmissions - getSubmission - saveSubmissionPayload - addSubmissionAttachment - removeSubmissionAttachment - inviteSubmissionParticipant - submitSubmission - withdrawSubmission - closeSubmission - reopenSubmission - correctSubmissionPayload - getSubmissionRevision - downloadSubmissionAttachment - listOwnInformationRequests - respondToInformationRequest - listSubmissionActionRuns - listSubmissionTimers - listSubmissionConflicts - listContributionRequirements - createContributionRequest - listOwnContributionRequests - getContributionRequest - resendContributionRequest - remindContributor - replaceContributor - cancelContributionRequest - readContributionSignedIn - saveContributionDraftSignedIn - addContributionFileSignedIn - removeContributionFileSignedIn - submitContributionSignedIn - declineContributionSignedIn - withdrawContributionSignedIn - amendContributionSignedIn - readContributionReceiptSignedIn - listSubmissionDecisions - listSubmissionDecisionDeliveries - listReviewAssignments - listReviewerWorkload - listStageRuns - getStageRun - getReviewAssignmentForStaff - listSubmissionReviewResponses - listSubmissionEvents surfaces: - console API - portal API - console guarded_by: - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.submissions.update intent: Edit application content or perform permitted application writes as staff. operations: - saveSubmissionPayload - addSubmissionAttachment - removeSubmissionAttachment - inviteSubmissionParticipant - submitSubmission - withdrawSubmission - respondToInformationRequest - requestInformationForReview surfaces: - portal API - console API - console guarded_by: - BR-CAP-SUB-SUB-006-09 - BR-CAP-SUB-SUB-008-06 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-020-07 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' - key: submissions.workflow-action-runs.query intent: Query follow-up runs through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: submissions.workflow-timers.query intent: Query follow-up timers through Platform’s governed dataset service. operations: [] surfaces: - Platform query service guarded_by: - BR-CAP-SUB-SUB-019-03 - BR-CAP-SUB-SUB-019-06 kind: permission provenance: observed source: 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS' operation_note: >- The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. - key: none (public) kind: access-marker intent: Identify public health access without a permission requirement. operations: - getDefinitionsHealth - getIntakeHealth - getOutcomesHealth - getReviewHealth surfaces: - public API guarded_by: [] constituent_keys: [] provenance: documented source: >- rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-definitions.md:operations; rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations; rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-outcomes.md:operations; rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-review.md:operations - key: submissions.submissions.create; also evaluates submissions.submissions.read kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - startSubmission surfaces: - portal API guarded_by: - BR-CAP-SUB-SUB-006-03 - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 constituent_keys: - submissions.submissions.create - submissions.submissions.read provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: submissions.submissions.read; also evaluates submissions.contributions.read-confidential kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - getSubmission - getSubmissionRevision - downloadSubmissionAttachment surfaces: - portal API guarded_by: - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-016-08 constituent_keys: - submissions.submissions.read - submissions.contributions.read-confidential provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: submissions.submissions.read; also evaluates submissions.submissions.update kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - saveSubmissionPayload - addSubmissionAttachment - removeSubmissionAttachment - inviteSubmissionParticipant - submitSubmission - withdrawSubmission - respondToInformationRequest surfaces: - portal API guarded_by: - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-006-09 - BR-CAP-SUB-SUB-008-06 constituent_keys: - submissions.submissions.read - submissions.submissions.update provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: submissions.submissions.manage; also evaluates submissions.submissions.read kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - closeSubmission - reopenSubmission - correctSubmissionPayload surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-008-08 - BR-CAP-SUB-SUB-008-09 - BR-CAP-SUB-SUB-008-11 - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 constituent_keys: - submissions.submissions.manage - submissions.submissions.read provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: submissions.application.access; also evaluates submissions.submissions.update kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - requestInformationForReview surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-010-01 - BR-CAP-SUB-SUB-020-03 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-006-09 - BR-CAP-SUB-SUB-008-06 constituent_keys: - submissions.application.access - submissions.submissions.update provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: >- submissions.submissions.read; also evaluates submissions.contributions.manage, submissions.contributions.read kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - listContributionRequirements - createContributionRequest - resendContributionRequest - remindContributor - replaceContributor - cancelContributionRequest surfaces: - portal API guarded_by: - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-016-01 - BR-CAP-SUB-SUB-016-02 - BR-CAP-SUB-SUB-016-08 constituent_keys: - submissions.submissions.read - submissions.contributions.manage - submissions.contributions.read provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: >- submissions.submissions.read; also evaluates submissions.contributions.manage, submissions.contributions.read, submissions.contributions.read-confidential kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - getContributionRequest surfaces: - portal API guarded_by: - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-016-01 - BR-CAP-SUB-SUB-016-02 - BR-CAP-SUB-SUB-016-08 constituent_keys: - submissions.submissions.read - submissions.contributions.manage - submissions.contributions.read - submissions.contributions.read-confidential provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: submissions.contributions.read; also evaluates submissions.contributions.read-confidential kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - getContributionResponse surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-016-08 constituent_keys: - submissions.contributions.read - submissions.contributions.read-confidential provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: none (the request’s private link is the credential) kind: access-marker intent: Identify request-link access; the private credential and request guards replace a role permission. operations: - readContributionByToken - saveContributionDraftByToken - addContributionFileByToken - removeContributionFileByToken - submitContributionByToken - declineContributionByToken - withdrawContributionByToken - amendContributionByToken - readContributionReceiptByToken surfaces: - public API guarded_by: - BR-CAP-SUB-SUB-016-05 - BR-CAP-SUB-SUB-016-10 - BR-CAP-SUB-SUB-016-11 - BR-CAP-SUB-SUB-016-12 constituent_keys: [] provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-intake.md:operations' - key: submissions.submissions.read; also evaluates submissions.reviews.read-confidential kind: permission-expression intent: >- Reference the service contract’s route permission and additionally evaluated keys; this label is not a grantable permission. operations: - listSubmissionReviewResponses surfaces: - console API guarded_by: - BR-CAP-SUB-SUB-006-10 - BR-CAP-SUB-SUB-020-05 - BR-CAP-SUB-SUB-020-06 - BR-CAP-SUB-SUB-017-02 constituent_keys: - submissions.submissions.read - submissions.reviews.read-confidential provenance: documented source: 'rhythm-v2-docs:specs/submissions/submissions/design/contracts/SVC-SUB-SUB-review.md:operations' known_gaps: - FND-SUB-SUB-005 - FND-SUB-SUB-017 - FND-SUB-SUB-020 - FND-SUB-SUB-022 - FND-SUB-SUB-026 - FND-SUB-SUB-050 - FND-SUB-SUB-051 - FND-SUB-SUB-054 - FND-SUB-SUB-055 - FND-SUB-SUB-062 staff_access: >- Rhythm staff enter customer work through Platform’s recorded standing, approved or emergency access grants and the role materialized by that grant. A platform-scoped HQ role does not itself authorize ordinary customer Submissions work. External requirement completion is a staff-only system route; trusted owner invokes and schedules use machine authority separately. evidence: - 'rhythm-v2-docs:specs/PRODUCT-AREAS.md#MOD-SUB-SUB' - 'rhythm-v2-docs:specs/submissions/submissions/MODULE.md' - 'rhythm-v2-docs:specs/submissions/ACTORS.md' - 'rhythm-v2-docs:specs/submissions/RESPONSIBILITIES.md' - 'services-submissions:aws/submissions.service.ts:SUBMISSIONS_BUILT_IN_POLICIES' - 'services-submissions:aws/api/submissions.routes.ts:submissionsRegistryManifest' - 'services-submissions:modules/definitions/aws/api/' - 'services-submissions:modules/intake/aws/api/' - 'services-submissions:modules/review/aws/api/' - 'services-submissions:modules/outcomes/aws/api/' - 'services-submissions:modules/intake/services/access/caller-identity.ts:isStaffOver' - 'services-submissions:modules/intake/services/access/submission-access.ts:requireReach' - 'services-submissions:modules/intake/services/access/view-chooser.ts:chooseView' - 'services-submissions:modules/intake/services/contributions/tokens.ts:TOKEN_REFUSAL' - 'services-submissions:modules/intake/services/contributions/contributor.ts:contributorContext' - 'services-submissions:modules/reporting/tests/unit/datasets-staff-only.spec.ts' - 'services-platform:modules/security/services/catalog/reconcile-catalog.ts:SUBMISSIONS_PORTAL_MEMBER_KEYS' - 'services-platform:modules/security/services/persistence/policies.ts' - 'services-platform:modules/security/services/persistence/assignments.ts:resolveGrantSlice' - 'services-platform:modules/security/authorizer/authorize.ts:authorize' - 'services-platform:modules/security/authorizer/context/signed-context.ts' - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-011-grant-and-end-staff-entry-to-a-customer-workspace.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-007-authority-comes-only-from-assignments-signed-per-request-and.md - 'react-console:lib/submissions/work/contact-search.ts' - 'react-console:components/submissions/review/review-page.tsx' - 'react-console:components/submissions/assignments/open-application.tsx' --- # Submissions Authorization Model ## Authorization Boundary Protected Submissions operations use Platform identity and scoped authorization. Application access, workspace availability and the operation’s declared authority establish whether the request can proceed; record guards then determine the available view and action. Licensing constrains authorization when its enforcement mode is enabled. Public health reads require no role permission. Contributor link operations are also publicly reachable, but require a valid credential for one contribution request. Customer staff authority differs from Rhythm platform authority. Platform controls staff entry into customer work through recorded access grants. Reporting uses the shared query service and its dataset keys. Trusted owning applications and scheduled work use machine execution paths rather than the customer policy bundles. The engine’s staff-only external requirement operation remains separate from the trusted intake and status invokes. ## Scopes Platform assigns authority at customer, workspace or resource scope. Submissions declares the process as a narrower resource for its process-scoped keys; service checks use that process when evaluating staff reach. The record keeps the unresolved gateway resource-declaration gap visible, so service filtering alone does not establish deployed enforcement for every configuration route. Organizational-unit information on a process is not evidence of an organizational-unit permission boundary. Within a workspace, an applicant’s participation, a reviewer’s assignment or a contributor’s request provides narrower record reach. These relationships permit particular actions and views rather than granting general staff authority. Cached gateway decisions and signed context can retain earlier grants within the Platform validity window; withdrawal is not promised to take effect immediately. ## Roles The engine supplies administrator, coordinator, staff-reviewer and reader policies. The profiles below describe those policy bundles as area roles; Platform role assignments make them effective. A policy definition by itself grants no access. A custom role can combine several policies, and explicit denies and scope conditions still apply. The engine administrator carries all customer-assignable engine keys, including sensitive interventions and confidential reading. The coordinator combines ordinary reading with configuration preparation and daily operational writes. The staff reviewer carries application access, assignment reading and contribution metadata reading; their assigned work provides the record reach. The reader carries ordinary inspection and eight dataset keys. The confidential contribution-response dataset belongs only to the administrator among these four bundles. Platform’s Portal Member role adds four Submissions keys while the active catalogue declares them assignable. Its reading keys open participant routes, whose service guards restrict the person to their own work. Contributor link holders, owning applications and schedulers are actors with request or machine authority, rather than additional customer roles. Platform also generates read-only, user and administrator tier policies and composes shared customer roles from them. Those tier policies differ from the engine’s named bundles, especially the coordinator’s configuration writes and the reviewer’s limited reach. ## Permission Catalogue Each permission row identifies a declared entitlement and its engine operations. The structured catalogue also records surfaces and the existing rule references for additional guards. Dataset keys belong to shared Platform query execution. CRM applicant lookup requires separate CRM authority. Published layout, application-deletion and review-export entitlements do not establish implemented engine commands. | Permission | Purpose | Engine operations | |---|---|---| | `crm.contacts.read` | Find applicants in CRM while entering an application. | CRM owns the lookup operation; no engine operation grants CRM access. | | `submissions.application.access` | Open Submissions and use assignment-based reviewer operations. | `requestInformationForReview`, `listMyReviewAssignments`, `getReviewAssignment`, `acceptReviewAssignment`, `declineReviewAssignment`, `recuseReviewAssignment`, `delegateReviewAssignment`, `saveReviewResponse`, `submitReviewResponse`, `amendReviewResponse`, `declareReviewConflict` | | `submissions.assignments.manage` | Assign, reassign, revoke or refresh reviewer selection on a stage. | `reassignReviewAssignment`, `revokeReviewAssignment`, `assignStageRunReviewers`, `reResolveStageRun` | | `submissions.assignments.read` | BR-CAP-SUB-SUB-010-01,BR-CAP-SUB-SUB-020-06 | No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. | | `submissions.conflicts.declare` | Declare a conflict on behalf of a reviewer. | `declareSubmissionConflict` | | `submissions.conflicts.resolve` | Clear or waive a declared conflict with a recorded explanation. | `clearReviewConflict`, `waiveReviewConflict` | | `submissions.contribution-requests.query` | Query contribution request metadata through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.contribution-responses.query` | Query confidential contribution response metadata through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.contributions.manage` | Create and administer contribution requests as staff. | `listContributionRequirements`, `createContributionRequest`, `getContributionRequest`, `resendContributionRequest`, `remindContributor`, `replaceContributor`, `cancelContributionRequest`, `revokeContributionRequest` | | `submissions.contributions.read` | Inspect contribution requests and permitted response content. | `listContributionRequirements`, `createContributionRequest`, `listContributionRequests`, `getContributionRequest`, `resendContributionRequest`, `remindContributor`, `replaceContributor`, `cancelContributionRequest`, `getContributionResponse` | | `submissions.contributions.read-confidential` | Read confidential contribution content outside an assigned-reviewer projection. | `getSubmission`, `getSubmissionRevision`, `downloadSubmissionAttachment`, `getContributionRequest`, `getContributionResponse` | | `submissions.decisions.override` | Replace a recorded decision while retaining the earlier result. | `supersedeSubmissionDecision` | | `submissions.decisions.record` | Record a staff outcome or report acknowledgement of a decision. | `recordSubmissionDecision`, `acknowledgeSubmissionDecision` | | `submissions.definitions.create` | Create or copy processes and create shared reasons. | `createSubmissionDefinition`, `cloneSubmissionDefinition`, `createStatusReason`, `createDeclineReason` | | `submissions.definitions.delete` | Remove or archive processes and retire shared reasons. | `removeSubmissionDefinition`, `removeStatusReason`, `removeDeclineReason` | | `submissions.definitions.read` | Inspect processes, their versions and stages, and shared reason lists. | `listSubjectKinds`, `listSubmissionDefinitions`, `listOpenSubmissionDefinitions`, `getSubmissionDefinition`, `listSubmissionDefinitionVersions`, `getSubmissionDefinitionVersion`, `listWorkflowStages`, `dryRunSubmissionDefinitionVersionActions`, `listStatusReasons`, `getStatusReason`, `listDeclineReasons`, `getDeclineReason` | | `submissions.definitions.update` | Edit process drafts and reasons, replace stages and publish a prepared process version. | `updateSubmissionDefinition`, `createSubmissionDefinitionVersion`, `updateSubmissionDefinitionVersion`, `publishSubmissionDefinitionVersion`, `replaceWorkflowStages`, `updateStatusReason`, `updateDeclineReason` | | `submissions.engine.resolve-actions` | Retry or skip failed follow-up work or retry a blocked timer with a recorded explanation. | `retrySubmissionActionRun`, `skipSubmissionActionRun`, `retrySubmissionTimer` | | `submissions.review-assignments.query` | Query reviewer assignments through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.review-responses.query` | Query assessment metadata through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.reviewer-rules.create` | Create or copy reviewer rules and teams. | `createReviewerRule`, `createReviewTeam`, `copyReviewTeam` | | `submissions.reviewer-rules.delete` | Remove or archive reviewer rules and teams. | `removeReviewerRule`, `archiveReviewTeam` | | `submissions.reviewer-rules.read` | Inspect reviewer rules and teams. | `listReviewerRules`, `getReviewerRule`, `listReviewTeams`, `getReviewTeam` | | `submissions.reviewer-rules.update` | Edit reviewer rules and teams. | `updateReviewerRule`, `updateReviewTeam`, `replaceReviewTeamMembers` | | `submissions.reviews.export` | Carry the declared review-export entitlement, whose engine export route is absent. | No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. | | `submissions.reviews.read-confidential` | Read reviewer notes excluded from ordinary staff response views. | `listSubmissionReviewResponses` | | `submissions.rubrics.create` | Create or copy scoring sheets. | `createReviewRubric`, `copyReviewRubric` | | `submissions.rubrics.delete` | Remove or archive scoring sheets. | `archiveReviewRubric` | | `submissions.rubrics.read` | Inspect scoring sheets. | `listReviewRubrics`, `getReviewRubric`, `listRubricVersions`, `getRubricVersion` | | `submissions.rubrics.update` | Edit scoring sheets. | `updateReviewRubric`, `createRubricVersion`, `updateRubricVersion`, `publishRubricVersion` | | `submissions.stage-runs.query` | Query stage progress through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.stages.complete` | Report an external requirement completed through the staff-only system operation. | `completeStageRunRequirement` | | `submissions.stages.override` | Close a stage early or waive a requirement with a recorded explanation. | `closeStageRun`, `waiveStageRunRequirement` | | `submissions.submission-decisions.query` | Query outcomes through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.submission-layouts.create` | Create or copy intake and review layouts, as a declared entitlement without an engine route. | No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. | | `submissions.submission-layouts.delete` | Remove or archive intake and review layouts, as a declared entitlement without an engine route. | No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. | | `submissions.submission-layouts.read` | Inspect intake and review layouts, as a declared entitlement without an engine route. | No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. | | `submissions.submission-layouts.update` | Edit intake and review layouts, as a declared entitlement without an engine route. | No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. | | `submissions.submissions.create` | Start an application under a published process. | `startSubmission` | | `submissions.submissions.delete` | Carry the declared application-deletion entitlement, which has no engine route. | No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command. | | `submissions.submissions.manage` | Close, reopen or correct an application administratively. | `closeSubmission`, `reopenSubmission`, `correctSubmissionPayload` | | `submissions.submissions.query` | Query applications through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.submissions.read` | Enter application-reading routes and inspect records through the caller’s allowed staff or participant view. | `getSubmissionDefinitionProgress`, `startSubmission`, `listSubmissions`, `listOwnSubmissions`, `getSubmission`, `saveSubmissionPayload`, `addSubmissionAttachment`, `removeSubmissionAttachment`, `inviteSubmissionParticipant`, `submitSubmission`, `withdrawSubmission`, `closeSubmission`, `reopenSubmission`, `correctSubmissionPayload`, `getSubmissionRevision`, `downloadSubmissionAttachment`, `listOwnInformationRequests`, `respondToInformationRequest`, `listSubmissionActionRuns`, `listSubmissionTimers`, `listSubmissionConflicts`, `listContributionRequirements`, `createContributionRequest`, `listOwnContributionRequests`, `getContributionRequest`, `resendContributionRequest`, `remindContributor`, `replaceContributor`, `cancelContributionRequest`, `readContributionSignedIn`, `saveContributionDraftSignedIn`, `addContributionFileSignedIn`, `removeContributionFileSignedIn`, `submitContributionSignedIn`, `declineContributionSignedIn`, `withdrawContributionSignedIn`, `amendContributionSignedIn`, `readContributionReceiptSignedIn`, `listSubmissionDecisions`, `listSubmissionDecisionDeliveries`, `listReviewAssignments`, `listReviewerWorkload`, `listStageRuns`, `getStageRun`, `getReviewAssignmentForStaff`, `listSubmissionReviewResponses`, `listSubmissionEvents` | | `submissions.submissions.update` | Edit application content or perform permitted application writes as staff. | `saveSubmissionPayload`, `addSubmissionAttachment`, `removeSubmissionAttachment`, `inviteSubmissionParticipant`, `submitSubmission`, `withdrawSubmission`, `respondToInformationRequest`, `requestInformationForReview` | | `submissions.workflow-action-runs.query` | Query follow-up runs through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | | `submissions.workflow-timers.query` | Query follow-up timers through Platform’s governed dataset service. | The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it. | The structured catalogue preserves the service contracts’ compound permission labels and public-access markers as references. These entries are explicitly marked as expressions or access markers, have no role grants, and introduce no additional permission. An additionally evaluated key supports the handler’s access choice; it is not automatically a second permission that every participant must hold. ## Role Entitlement Matrix The matrix shows each profile’s declared Submissions keys. A conditional Portal Member entry depends on the active permission catalogue. Actual access also depends on assignments, scope, explicit denies, application availability and record guards. CRM lookup remains an independently assigned entitlement. No customer profile includes the staff-only external requirement key. | Permission | Engine administrator | Coordinator | Staff reviewer | Reader | Portal member | |---|---|---|---|---|---| | `crm.contacts.read` | — | — | — | — | — | | `submissions.application.access` | Yes | Yes | Yes | Yes | Conditional | | `submissions.assignments.manage` | Yes | Yes | — | — | — | | `submissions.assignments.read` | Yes | Yes | Yes | Yes | — | | `submissions.conflicts.declare` | Yes | Yes | — | — | — | | `submissions.conflicts.resolve` | Yes | — | — | — | — | | `submissions.contribution-requests.query` | Yes | Yes | — | Yes | — | | `submissions.contribution-responses.query` | Yes | — | — | — | — | | `submissions.contributions.manage` | Yes | Yes | — | — | — | | `submissions.contributions.read` | Yes | Yes | Yes | Yes | — | | `submissions.contributions.read-confidential` | Yes | — | — | — | — | | `submissions.decisions.override` | Yes | — | — | — | — | | `submissions.decisions.record` | Yes | Yes | — | — | — | | `submissions.definitions.create` | Yes | Yes | — | — | — | | `submissions.definitions.delete` | Yes | — | — | — | — | | `submissions.definitions.read` | Yes | Yes | — | Yes | Conditional | | `submissions.definitions.update` | Yes | Yes | — | — | — | | `submissions.engine.resolve-actions` | Yes | — | — | — | — | | `submissions.review-assignments.query` | Yes | Yes | — | Yes | — | | `submissions.review-responses.query` | Yes | Yes | — | Yes | — | | `submissions.reviewer-rules.create` | Yes | Yes | — | — | — | | `submissions.reviewer-rules.delete` | Yes | — | — | — | — | | `submissions.reviewer-rules.read` | Yes | Yes | — | Yes | — | | `submissions.reviewer-rules.update` | Yes | Yes | — | — | — | | `submissions.reviews.export` | Yes | Yes | — | — | — | | `submissions.reviews.read-confidential` | Yes | — | — | — | — | | `submissions.rubrics.create` | Yes | Yes | — | — | — | | `submissions.rubrics.delete` | Yes | — | — | — | — | | `submissions.rubrics.read` | Yes | Yes | — | Yes | — | | `submissions.rubrics.update` | Yes | Yes | — | — | — | | `submissions.stage-runs.query` | Yes | Yes | — | Yes | — | | `submissions.stages.complete` | — | — | — | — | — | | `submissions.stages.override` | Yes | — | — | — | — | | `submissions.submission-decisions.query` | Yes | Yes | — | Yes | — | | `submissions.submission-layouts.create` | Yes | Yes | — | — | — | | `submissions.submission-layouts.delete` | Yes | — | — | — | — | | `submissions.submission-layouts.read` | Yes | Yes | — | Yes | — | | `submissions.submission-layouts.update` | Yes | Yes | — | — | — | | `submissions.submissions.create` | Yes | Yes | — | — | Conditional | | `submissions.submissions.delete` | Yes | Yes | — | — | — | | `submissions.submissions.manage` | Yes | Yes | — | — | — | | `submissions.submissions.query` | Yes | Yes | — | Yes | — | | `submissions.submissions.read` | Yes | Yes | — | Yes | Conditional | | `submissions.submissions.update` | Yes | Yes | — | — | — | | `submissions.workflow-action-runs.query` | Yes | Yes | — | Yes | — | | `submissions.workflow-timers.query` | Yes | Yes | — | Yes | — | ## Protected Actions Early stage closure, requirement waiver, conflict clearance or waiver, corrected decisions and recovery of failed follow-up require their exceptional permissions and an explanation retained by the engine. Confidential response reading uses separate keys; contribution confidentiality also depends on the permitted view, and confidential staff contribution reads are recorded. Ordinary staff decision recording is constrained by the process’s declared outcomes and the state of review work. Reviewer writes require the caller’s own eligible assignment and a permitted assignment or run state. Applicant writes require the relevant participation rights and an editable application. Contributor commands require a live request and a permitted response transition; a private link grants reach to that request alone. External requirement completion requires staff platform authority at the system boundary. Owner acknowledgement records the caller’s reported handling outcome, while the trusted owner acknowledgement integration remains an existing gap. ## Guards Distinguished From Permissions A permission names an authority that Platform can assign. A guard checks the record or the circumstances under which that authority can act. Workspace and process reach, participation, assignment identity, conflicts, blind projection, frozen publication, lifecycle status and optimistic versions are guards. They do not become additional permission keys. Holding general staff read authority selects a broader staff view; a reviewer policy alone does not do so. The assigned-reviewer screen checks assignment-reading authority, while its review operations declare application access and verify participation. The redirect screens can attempt a staff lookup or fall back to assigned work; they do not establish an additional hard page gate. An unavailable or refused dependency does not grant broader record reach. ## What People See When Refused Protected requests reject missing security context or insufficient authority. A caller with no reach to an application receives an absent-record response, just as for an unknown record; a caller who can see it but lacks the requested action receives a permission refusal. The contributor link API response gives the same explanation for an invalid, expired or otherwise unusable link and asks the recipient to request a replacement. It does not disclose which condition caused refusal. The console uses its permission checks to limit offered actions, while the server remains responsible for enforcement. When CRM refuses applicant search, the picker explains that the person needs CRM read access and should ask their administrator for the CRM read-only role. Publication, invalid fields and concurrent changes have their own errors; those messages describe failed guards rather than a missing role.