Workspace Grants Authorize Close and Reopen Actions

Context

The earlier close design asks for business-unit scope, while the permission catalogue exposes workspace-wide keys.

Decision

Describe the existing grant boundary and keep narrower business-unit authority as a Platform-led change rather than inventing a local permission system.

Alternatives Considered

Maintain a unit allowlist inside the close service. A separate local list would duplicate Platform’s authorization responsibility and require its own audit contract.

Consequences

Holding the close grant applies to every business unit in the workspace. Earlier unit-scoped wording and the catalogue’s pre-route comment do not describe current behavior.