Committees Authorization Model

Authorization Boundary

Protected committee operations require the application boundary and the operation’s declared permission. Console and portal callers enter through their corresponding authenticated contexts. Services check the key again before running the handler. Public health, public meeting and public opening operations carry no permission grant; the personal calendar feed instead requires its own live credential.

Committees publishes no staff-only business permission. Rhythm staff enter customer work through Platform’s recorded staff-access process and the resulting ordinary role assignment. Responsibility routing directs attention to staff without granting record access. Built portal routes and authority functions retain the release questions recorded by their owning modules.

Scopes

Workspace scope is the effective permission boundary for the current protected routes. Platform can supply customer-wide authority covering a workspace. Committee, appointment, seat, opening and nomination permission groups declare organizational-unit scope, but their routes do not supply the resource needed to evaluate a unit grant. A declared unit scope therefore does not establish working unit isolation.

The proposed authority engine derives grants over a committee’s unit and descendants. Committee parentage supplies navigation rather than inherited authority. Portal ownership and participation checks narrow a successful route permission to particular people and records; they are guards rather than separately assignable record permissions.

Roles

Administrator and Power User use the application administrator tier; Standard User uses the user tier; Read Only uses the read tier. These names describe the Committees portion of Platform roles, not separate committee offices. Portal Member supplies no committee permission by itself, so additional grants are necessary for committee portal work. Being a chair or liaison supplies only the meeting-role guards that explicitly recognize that relationship.

The matrix is an inferred composition of the declared permission tiers and the landed Platform policy model, checked against the earlier console inventory. Current shared policy definitions and deployed assignments are unavailable in the supplied repositories. In particular, the sensitive disclosure read and portal-related read keys require policy verification before this matrix is treated as a verified entitlement record. Customer-defined roles and explicit denies can change an individual’s effective access.

Permission Catalogue

The structured catalogue records exact keys, operation bindings, surfaces and references to additional guards. Application entry supplies no record-management power. Configuration management also covers proposed authority-rule changes and manual reconciliation. Layout administration is delegated to Platform and has no operation owned by this service.

Meeting, decision and recruitment operations declare console API access, but that declaration does not establish a built console screen. Their service contracts retain the deferred hosting boundary. Public access descriptions appear separately below because the conformance checker compares the literal service-contract permission field; those descriptions are neither permission keys nor role entitlements.

Permission	Purpose
committees.application.access	Enter the Committees application without gaining record management authority.
committees.configuration.read	Inspect committee types, positions, settings and proposed authority rules.
committees.configuration.manage	Maintain shared committee configuration and proposed authority mappings and request authority reconciliation.
committees.committees.read	Inspect bodies, calendars, places, relationships and governance information.
committees.committees.manage	Maintain bodies, terms and relationships and record committee closure.
committees.appointments.read	Inspect dated participation, its history, bulk-job progress and audit rosters.
committees.appointments.manage	Record and change participation and answer offers on behalf of participants.
committees.seats.manage	Maintain committee places and their effective standing.
committees.self.read	Inspect own participation and answer own offers through the portal.
committees.rosters.read	Read committee information, rosters and openings within portal visibility limits.
committees.authority.read	Inspect the explanation of appointment-derived Platform access.
committees.meetings.read	Inspect meetings, series, participants, agendas, papers and minutes.
committees.meetings.manage	Maintain meetings, series, attendance, preparation and follow-up proposals.
committees.portal.participate	Participate in permitted meetings, decisions, disclosure and recruitment work as the linked person.
committees.portal.calendar	Issue or replace the linked person’s calendar feed credential.
committees.decisions.read	Inspect decisions and their votes, recusals and outcomes within confidentiality limits.
committees.decisions.manage	Maintain motions, voting records, decision outcomes and their governance consequences.
committees.minutes.manage	Record minutes approval and begin corrections under the committee’s governing rules.
committees.openings.read	Inspect openings, expressed interests, alternates and vacancy forecasts.
committees.openings.manage	Maintain, publish and close openings and draft them from forecasts.
committees.nominations.read	Inspect nominations and their review and election standing.
committees.nominations.manage	Maintain nominations and their slate, decline and withdrawal outcomes.
committees.disclosures.read	Inspect sensitive conflict disclosures and authorized recusal suggestions.
committees.disclosures.manage	Request disclosure forms through Submissions.
committees.committee-layouts.read	Inspect shared committee form and page layouts through Platform.
committees.committee-layouts.create	Create shared committee form and page layouts through Platform.
committees.committee-layouts.update	Change shared committee form and page layouts through Platform.
committees.committee-layouts.delete	Remove shared committee form and page layouts through Platform.

Public Access Descriptor	Access Basis
none: the shared health route	Expose the shared health response without a permission grant.
none: the shared health route (the operation name follows the get<Module>Health pattern of the route library)	Expose the shared health response without a permission grant.
none: the feed token in the query is the credential	Accept a valid calendar feed token without a signed-in session.
none: public meetings only	Expose only information allowed by public visibility.
none: public listings only	Expose only information allowed by public visibility.

Role Entitlement Matrix

The columns show the inferred committee permission slice before scope, conditions, explicit denies and record guards apply. A dash supplies no grant. The portal column represents the built-in Portal Member role before any additional assignment.

Permission	Administrator	Power User	Standard User	Read Only	Portal Member
committees.application.access	Yes	Yes	Yes	Yes	—
committees.configuration.read	Yes	Yes	Yes	Yes	—
committees.configuration.manage	Yes	Yes	—	—	—
committees.committees.read	Yes	Yes	Yes	Yes	—
committees.committees.manage	Yes	Yes	Yes	—	—
committees.appointments.read	Yes	Yes	Yes	Yes	—
committees.appointments.manage	Yes	Yes	Yes	—	—
committees.seats.manage	Yes	Yes	Yes	—	—
committees.self.read	Yes	Yes	Yes	Yes	—
committees.rosters.read	Yes	Yes	Yes	Yes	—
committees.authority.read	Yes	Yes	Yes	Yes	—
committees.meetings.read	Yes	Yes	Yes	Yes	—
committees.meetings.manage	Yes	Yes	Yes	—	—
committees.portal.participate	Yes	Yes	Yes	Yes	—
committees.portal.calendar	Yes	Yes	Yes	Yes	—
committees.decisions.read	Yes	Yes	Yes	Yes	—
committees.decisions.manage	Yes	Yes	Yes	—	—
committees.minutes.manage	Yes	Yes	Yes	—	—
committees.openings.read	Yes	Yes	Yes	Yes	—
committees.openings.manage	Yes	Yes	Yes	—	—
committees.nominations.read	Yes	Yes	Yes	Yes	—
committees.nominations.manage	Yes	Yes	Yes	—	—
committees.disclosures.read	Yes	Yes	Yes	Yes	—
committees.disclosures.manage	Yes	Yes	Yes	—	—
committees.committee-layouts.read	Yes	Yes	Yes	Yes	—
committees.committee-layouts.create	Yes	Yes	—	—	—
committees.committee-layouts.update	Yes	Yes	—	—	—
committees.committee-layouts.delete	Yes	Yes	—	—	—

Protected Actions

Authority-rule saves that put a rule in force or widen access also ask Platform whether the editor may grant the mapped role. Inactive or portal-disabled rules do not take that same in-force check. Authority inspection and reconciliation do not make the caller an access administrator.

Offer responses require the caller’s own linked participation on portal paths. Portal voting, recusal, attendance and invitation responses require the relevant person or meeting relationship after permission evaluation. Confidential decision reads also evaluate management authority; disclosure-derived suggestions require disclosure read authority.

Approval, dissolution, recruitment transitions and decision consequences retain their capability guards. Direct minutes approval currently records the permission-bearing caller without verifying chair status; the owning module keeps the approving-authority question open. No evidence establishes a general second-approver requirement for this area.

Guards Distinguished From Permissions

Permissions are assignable powers evaluated against scoped Platform authority. Guards test the particular record and proposed action: ownership, visibility, participation, eligibility, current standing, version, valid dates or the editor’s ability to grant a mapped role. A guard cannot grant a missing permission. A successful permission check does not bypass a guard.

The calendar feed token is a credential for a specific person’s feed, not a role permission. Issuing a replacement revokes the earlier live token; the store retains its hash rather than the token itself. Public visibility likewise supplies a record eligibility test rather than a role grant.

What People See When Refused

Missing operation authority returns a forbidden response. Inaccessible confidential decisions and visibility-limited portal records appear missing, so callers do not learn their protected content. Invalid or revoked feed credentials also receive a missing-feed response. Validation failures explain the rejected action, while stale versions and records still in use return conflict or domain refusals.

The existing committee screens hide unavailable change controls and present read-only states or service errors. Meetings, decision and recruitment API refusals do not establish a corresponding built screen experience. Platform’s gateway decisions can remain cached for sixty seconds, with signed context valid for thirty seconds beyond that bound; grant withdrawal must not be described as an immediate cutoff.