Rhythm 2.0 Specifications

Appearance

AUTH-CRMCRM Authorization Model

Markdown

AUTH-CRM

CRM Authorization Model

Markdown
  • DocumentDraft
  • ImplementationObserved

Product areaCRMRevision1

Read atservices-crm a8d1364freact-console baf6dae3services-platform ad3f6a65rhythm-v2-docs 74bec488

CRM Authorization Model ​

Authorization Boundary ​

Customer requests use Platform identity and authorization, followed by CRM’s operation and record guards. Application entry also depends on an active workspace licence and application access. Public health routes disclose service health rather than customer records. Contact-role reads declare portal access; that declaration still requires the named permission and does not grant it to every portal member.

Trusted task service calls use the invoking service’s cloud identity and function grant. The task service route is unavailable over ordinary HTTP. Its declared task keys describe the work being delegated; trusted invocation does not borrow a person’s grants. Portal contact matching and login transfer remain coordinated with Platform Security.

CRM declares no staff-only permission group. Rhythm staff enter customer work through Platform’s explicit customer-access mechanisms. An HQ staff role alone does not authorize customer console work. Platform retains responsibility for staff grants, their validity, separation and audit.

Scopes ​

CRM’s ordinary permissions apply at workspace scope. A customer-wide assignment can supply authority across that customer’s workspaces through Platform evaluation. Each CRM operation still acts in the authorized workspace named by its execution context.

Record reach is an additional check on live history and record-scoped merge inspection. Organizational affiliations, contact roles, regions and task queues describe customer information or work routing; they do not create an organizational-unit permission scope. The CRM declaration supplies no such scope. Supported narrower grants and their evaluation remain Platform’s responsibility.

Cached authorization has a bounded freshness window. Platform documents a sixty-second gateway decision lifetime and signed-context expiry with an additional thirty-second allowance. A requested flush does not establish immediate eviction. Role changes therefore require the Platform propagation contract rather than an assumption of instant CRM refusal.

Roles ​

The five role rows project Platform’s shipped customer roles onto CRM’s permission catalogue. CRM defines no separate built-in roles or policies. Administrator and Power User receive the application administrator tier; their different customer security and export authority lives in Platform. Standard User receives the user and reader tiers, and Read Only receives the reader tier. Portal Member receives no CRM grant from its built-in policy.

Customers can compose their own roles and policies through Platform. Assignments determine scope and validity, and applicable denies take precedence over allows. The matrix describes the shipped role baseline before those assignments, conditions and denies are evaluated. Actor descriptions identify responsibilities rather than additional grant definitions.

Permission Catalogue ​

The structured catalogue lists each actual key with its declared tier, consuming operations, surfaces and rule references for further restrictions. A declared key with no local operation remains visible as a declaration; it supplies no evidence of an implemented action. Query execution and presentation-definition administration cross into Platform under CRM-owned keys.

The service contracts also contain combined permission declarations and a public-health marker. Those entries are retained as non-grantable declaration references for literal contract coverage. Their component keys carry the entitlement; the reference itself is neither published nor assignable. Evaluated keys can narrow a response or authorize a conditional action without being required for initial route entry.

Role Entitlement Matrix ​

Every row below is an actual permission key. Yes means the shipped CRM tier permits the key before scope, conditions and denies. The two administrator-tier columns do not imply equal authority outside CRM.

PermissionAdministratorPower UserStandard UserRead OnlyPortal Member
crm.activities.bulkYesYes———
crm.activities.createYesYesYes——
crm.activities.deleteYesYesYes——
crm.activities.historyYesYesYesYes—
crm.activities.queryYesYesYesYes—
crm.activities.readYesYesYesYes—
crm.activities.updateYesYesYes——
crm.activity-types.bulkYesYes———
crm.activity-types.createYesYes———
crm.activity-types.deleteYesYes———
crm.activity-types.readYesYesYesYes—
crm.activity-types.updateYesYes———
crm.address-types.bulkYesYes———
crm.address-types.createYesYes———
crm.address-types.deleteYesYes———
crm.address-types.readYesYesYesYes—
crm.address-types.updateYesYes———
crm.affiliation-types.bulkYesYes———
crm.affiliation-types.createYesYesYes——
crm.affiliation-types.deleteYesYes———
crm.affiliation-types.readYesYesYesYes—
crm.affiliation-types.set-defaultYesYes———
crm.affiliation-types.updateYesYesYes——
crm.application.accessYesYesYesYes—
crm.contact-layouts.bulkYesYes———
crm.contact-layouts.createYesYes———
crm.contact-layouts.deleteYesYes———
crm.contact-layouts.readYesYesYesYes—
crm.contact-layouts.updateYesYes———
crm.contact-roles.bulkYesYes———
crm.contact-roles.createYesYesYes——
crm.contact-roles.deleteYesYes———
crm.contact-roles.lockYesYes———
crm.contact-roles.readYesYesYesYes—
crm.contact-roles.unlockYesYes———
crm.contact-roles.updateYesYesYes——
crm.contact-types.bulkYesYes———
crm.contact-types.createYesYesYes——
crm.contact-types.deleteYesYes———
crm.contact-types.readYesYesYesYes—
crm.contact-types.updateYesYesYes——
crm.contacts.archiveYesYes———
crm.contacts.bulkYesYes———
crm.contacts.createYesYesYes——
crm.contacts.create-despite-duplicate-blockYesYes———
crm.contacts.deleteYesYes———
crm.contacts.historyYesYesYesYes—
crm.contacts.lockYesYes———
crm.contacts.mergeYesYes———
crm.contacts.queryYesYesYesYes—
crm.contacts.readYesYesYesYes—
crm.contacts.unlockYesYes———
crm.contacts.updateYesYesYes——
crm.duplicates.configureYesYes———
crm.duplicates.readYesYesYes——
crm.duplicates.reviewYesYesYes——
crm.merges.readYesYesYes——
crm.organization-layouts.bulkYesYes———
crm.organization-layouts.createYesYes———
crm.organization-layouts.deleteYesYes———
crm.organization-layouts.readYesYesYesYes—
crm.organization-layouts.updateYesYes———
crm.organization-types.bulkYesYes———
crm.organization-types.createYesYesYes——
crm.organization-types.deleteYesYes———
crm.organization-types.readYesYesYesYes—
crm.organization-types.updateYesYesYes——
crm.organizations.archiveYesYes———
crm.organizations.bulkYesYes———
crm.organizations.createYesYesYes——
crm.organizations.create-despite-duplicate-blockYesYes———
crm.organizations.deleteYesYes———
crm.organizations.historyYesYesYesYes—
crm.organizations.lockYesYes———
crm.organizations.mergeYesYes———
crm.organizations.queryYesYesYesYes—
crm.organizations.readYesYesYesYes—
crm.organizations.unlockYesYes———
crm.organizations.updateYesYesYes——
crm.phone-number-types.bulkYesYes———
crm.phone-number-types.createYesYes———
crm.phone-number-types.deleteYesYes———
crm.phone-number-types.readYesYesYesYes—
crm.phone-number-types.updateYesYes———
crm.regions.bulkYesYes———
crm.regions.createYesYesYes——
crm.regions.deleteYesYes———
crm.regions.readYesYesYesYes—
crm.regions.recalculateYesYes———
crm.regions.updateYesYesYes——
crm.task-queues.bulkYesYes———
crm.task-queues.createYesYes———
crm.task-queues.deleteYesYes———
crm.task-queues.readYesYesYesYes—
crm.task-queues.updateYesYes———
crm.task-types.bulkYesYes———
crm.task-types.createYesYes———
crm.task-types.deleteYesYes———
crm.task-types.readYesYesYesYes—
crm.task-types.updateYesYes———
crm.tasks.bulkYesYes———
crm.tasks.createYesYesYes——
crm.tasks.deleteYesYes———
crm.tasks.queryYesYesYesYes—
crm.tasks.readYesYesYesYes—
crm.tasks.updateYesYesYes——

Protected Actions ​

Record combination requires the read and merge pair for the plan’s record type. Admitting a request through any route-level key does not satisfy that pair. Participant selection, plan freshness, locks and merge validation remain capability-owned guards. No second approver is established by the examined declarations; a confirmation control is not a separate approval role.

Creation past a duplicate block requires the sensitive override key for the record kind and a reason recorded with the creation. Record lock and unlock actions carry separate administrator keys and require a version and reason. Protected system records remain protected even when the caller holds those keys. The ordinary-lock exceptions for other CRM records remain findings.

Role-offered work requires task update authority and confirmation that the claimant holds the offered role when the task is outside a queue. Queued work follows queue claim guards even when a role is also named. Closing state, existing holders and locks can refuse authorized task work. Regional imports require both regional bulk and update authority, while workspace-wide recalculation requires its dedicated administrator key.

History and merge outcomes have distinct access boundaries. Live record history includes record reach; deleted history uses its history permission. Retained merge outcomes use the user-tier merge-read key, while a record-scoped view can expose a narrower result under that record’s read authority. CRM settings reads filter sections by authority, and settings writes require authority for every requested section.

Guards Distinguished From Permissions ​

Permissions establish whether a caller may attempt the work. Guards establish whether the target and proposed change are valid now. The catalogue references capability rules for locks, versions, state, workspace references and role-holder checks instead of defining those rules again. A permission never repairs a stale draft or makes a protected record removable.

A console visibility alias can admit a page more broadly than its API permits an action. The exact server key and handler guards decide the request. Task ownership and queue responsibility do not confer task permissions, and organizational contact roles do not confer security roles.

What People See When Refused ​

Missing authentication or an invalid protected identity produces an authentication refusal. Missing grants produce a forbidden response; application-access and licence failures carry client-readable refusal codes. Platform’s refusal metadata identifies the cause and required keys without identifying another person.

An inaccessible record is handled within the workspace boundary without exposing another workspace’s information. Once record access is established, a merged identity can return a gone response pointing to its survivor. Stale versions, locks and inapplicable lifecycle actions produce conflict or validation feedback. CRM settings can omit unreadable sections rather than return their contents.

The console hides or disables permission-dependent actions where its guards do so, and otherwise presents service feedback. Existing screen findings record alias mismatches and generic task-claim conflict feedback. No uniform screen message or complete CRM access-refusal audit coverage is established by these declarations.

Staff access
Platform grants customer access explicitly through standing, temporary or emergency access; staff HQ authority alone does not grant CRM console access.

Scopes

ScopeMeaningProvenance
customerPlatform customer-wide assignments can reach that customer’s workspaces.documented
BR-CAP-PFM-SEC-010-03
workspaceCRM record operations act within the workspace authorized for the request.observed
services-crm:aws/crm.service.ts:RECORD_TIERS
recordSelected history and merge inspection paths check reach to the identified record in addition to the operation permission.observed
services-crm:modules/merges/aws/api/merges.routes.ts:requireRecordRead

Roles

IdRoleWhoGrants
ROLE-CRM-001AdministratorA customer security administrator responsible for the workspace.crm.activities.bulkcrm.activities.createcrm.activities.deletecrm.activities.historycrm.activities.querycrm.activities.readcrm.activities.updatecrm.activity-types.bulkcrm.activity-types.createcrm.activity-types.deletecrm.activity-types.readcrm.activity-types.updatecrm.address-types.bulkcrm.address-types.createcrm.address-types.deletecrm.address-types.readcrm.address-types.updatecrm.affiliation-types.bulkcrm.affiliation-types.createcrm.affiliation-types.deletecrm.affiliation-types.readcrm.affiliation-types.set-defaultcrm.affiliation-types.updatecrm.application.accesscrm.contact-layouts.bulkcrm.contact-layouts.createcrm.contact-layouts.deletecrm.contact-layouts.readcrm.contact-layouts.updatecrm.contact-roles.bulkcrm.contact-roles.createcrm.contact-roles.deletecrm.contact-roles.lockcrm.contact-roles.readcrm.contact-roles.unlockcrm.contact-roles.updatecrm.contact-types.bulkcrm.contact-types.createcrm.contact-types.deletecrm.contact-types.readcrm.contact-types.updatecrm.contacts.archivecrm.contacts.bulkcrm.contacts.createcrm.contacts.create-despite-duplicate-blockcrm.contacts.deletecrm.contacts.historycrm.contacts.lockcrm.contacts.mergecrm.contacts.querycrm.contacts.readcrm.contacts.unlockcrm.contacts.updatecrm.duplicates.configurecrm.duplicates.readcrm.duplicates.reviewcrm.merges.readcrm.organization-layouts.bulkcrm.organization-layouts.createcrm.organization-layouts.deletecrm.organization-layouts.readcrm.organization-layouts.updatecrm.organization-types.bulkcrm.organization-types.createcrm.organization-types.deletecrm.organization-types.readcrm.organization-types.updatecrm.organizations.archivecrm.organizations.bulkcrm.organizations.createcrm.organizations.create-despite-duplicate-blockcrm.organizations.deletecrm.organizations.historycrm.organizations.lockcrm.organizations.mergecrm.organizations.querycrm.organizations.readcrm.organizations.unlockcrm.organizations.updatecrm.phone-number-types.bulkcrm.phone-number-types.createcrm.phone-number-types.deletecrm.phone-number-types.readcrm.phone-number-types.updatecrm.regions.bulkcrm.regions.createcrm.regions.deletecrm.regions.readcrm.regions.recalculatecrm.regions.updatecrm.task-queues.bulkcrm.task-queues.createcrm.task-queues.deletecrm.task-queues.readcrm.task-queues.updatecrm.task-types.bulkcrm.task-types.createcrm.task-types.deletecrm.task-types.readcrm.task-types.updatecrm.tasks.bulkcrm.tasks.createcrm.tasks.deletecrm.tasks.querycrm.tasks.readcrm.tasks.update
ROLE-CRM-002Power UserA colleague who administers application information without customer security administration.crm.activities.bulkcrm.activities.createcrm.activities.deletecrm.activities.historycrm.activities.querycrm.activities.readcrm.activities.updatecrm.activity-types.bulkcrm.activity-types.createcrm.activity-types.deletecrm.activity-types.readcrm.activity-types.updatecrm.address-types.bulkcrm.address-types.createcrm.address-types.deletecrm.address-types.readcrm.address-types.updatecrm.affiliation-types.bulkcrm.affiliation-types.createcrm.affiliation-types.deletecrm.affiliation-types.readcrm.affiliation-types.set-defaultcrm.affiliation-types.updatecrm.application.accesscrm.contact-layouts.bulkcrm.contact-layouts.createcrm.contact-layouts.deletecrm.contact-layouts.readcrm.contact-layouts.updatecrm.contact-roles.bulkcrm.contact-roles.createcrm.contact-roles.deletecrm.contact-roles.lockcrm.contact-roles.readcrm.contact-roles.unlockcrm.contact-roles.updatecrm.contact-types.bulkcrm.contact-types.createcrm.contact-types.deletecrm.contact-types.readcrm.contact-types.updatecrm.contacts.archivecrm.contacts.bulkcrm.contacts.createcrm.contacts.create-despite-duplicate-blockcrm.contacts.deletecrm.contacts.historycrm.contacts.lockcrm.contacts.mergecrm.contacts.querycrm.contacts.readcrm.contacts.unlockcrm.contacts.updatecrm.duplicates.configurecrm.duplicates.readcrm.duplicates.reviewcrm.merges.readcrm.organization-layouts.bulkcrm.organization-layouts.createcrm.organization-layouts.deletecrm.organization-layouts.readcrm.organization-layouts.updatecrm.organization-types.bulkcrm.organization-types.createcrm.organization-types.deletecrm.organization-types.readcrm.organization-types.updatecrm.organizations.archivecrm.organizations.bulkcrm.organizations.createcrm.organizations.create-despite-duplicate-blockcrm.organizations.deletecrm.organizations.historycrm.organizations.lockcrm.organizations.mergecrm.organizations.querycrm.organizations.readcrm.organizations.unlockcrm.organizations.updatecrm.phone-number-types.bulkcrm.phone-number-types.createcrm.phone-number-types.deletecrm.phone-number-types.readcrm.phone-number-types.updatecrm.regions.bulkcrm.regions.createcrm.regions.deletecrm.regions.readcrm.regions.recalculatecrm.regions.updatecrm.task-queues.bulkcrm.task-queues.createcrm.task-queues.deletecrm.task-queues.readcrm.task-queues.updatecrm.task-types.bulkcrm.task-types.createcrm.task-types.deletecrm.task-types.readcrm.task-types.updatecrm.tasks.bulkcrm.tasks.createcrm.tasks.deletecrm.tasks.querycrm.tasks.readcrm.tasks.update
ROLE-CRM-003Standard UserA colleague who performs ordinary application work.crm.activities.createcrm.activities.deletecrm.activities.historycrm.activities.querycrm.activities.readcrm.activities.updatecrm.activity-types.readcrm.address-types.readcrm.affiliation-types.createcrm.affiliation-types.readcrm.affiliation-types.updatecrm.application.accesscrm.contact-layouts.readcrm.contact-roles.createcrm.contact-roles.readcrm.contact-roles.updatecrm.contact-types.createcrm.contact-types.readcrm.contact-types.updatecrm.contacts.createcrm.contacts.historycrm.contacts.querycrm.contacts.readcrm.contacts.updatecrm.duplicates.readcrm.duplicates.reviewcrm.merges.readcrm.organization-layouts.readcrm.organization-types.createcrm.organization-types.readcrm.organization-types.updatecrm.organizations.createcrm.organizations.historycrm.organizations.querycrm.organizations.readcrm.organizations.updatecrm.phone-number-types.readcrm.regions.createcrm.regions.readcrm.regions.updatecrm.task-queues.readcrm.task-types.readcrm.tasks.createcrm.tasks.querycrm.tasks.readcrm.tasks.update
ROLE-CRM-004Read OnlyA colleague who inspects application information.crm.activities.historycrm.activities.querycrm.activities.readcrm.activity-types.readcrm.address-types.readcrm.affiliation-types.readcrm.application.accesscrm.contact-layouts.readcrm.contact-roles.readcrm.contact-types.readcrm.contacts.historycrm.contacts.querycrm.contacts.readcrm.organization-layouts.readcrm.organization-types.readcrm.organizations.historycrm.organizations.querycrm.organizations.readcrm.phone-number-types.readcrm.regions.readcrm.task-queues.readcrm.task-types.readcrm.tasks.querycrm.tasks.read
ROLE-CRM-005Portal MemberA portal account using the Platform registration boundary.

Permission Catalogue

KeyIntentOperationsSurfacesGuarded by
crm.activities.bulkSubmit bulk work for interaction records.api, console
crm.activities.createCreate interaction records.createActivityapi, console, jobBR-CAP-CRM-ACT-001-03 BR-CAP-CRM-ACT-002-01
crm.activities.deleteRemove interaction records.deleteActivityapi, console, jobBR-CAP-CRM-ACT-003-06
crm.activities.historyInspect past values of interaction records.listActivityHistorygetActivityRevisionlistActivityHistoryActorsapi, consoleBR-CAP-CRM-ACT-006-01
crm.activities.queryExplore and query interaction records.api, console
crm.activities.readRead interaction records.getActivitylistActivityHistorygetActivityRevisionlistActivityHistoryActorsgetContactTimelinegetOrganizationTimelinegetContactTimelineSummarygetOrganizationTimelineSummaryapi, console, job
crm.activities.updateMaintain interaction records.updateActivitypatchActivitygetContactTimelinegetOrganizationTimelineapi, console, jobBR-CAP-CRM-ACT-003-01 BR-CAP-CRM-ACT-003-06
crm.activity-types.bulkSubmit bulk work for activity classifications.api, console, job
crm.activity-types.createCreate activity classifications.createActivityTypeapi, console, job
crm.activity-types.deleteRemove activity classifications.deleteActivityTypeapi, console, job
crm.activity-types.readRead activity classifications.listActivityTypesgetActivityTypeapi, console, job
crm.activity-types.updateMaintain activity classifications.reorderActivityTypesupdateActivityTypeapi, console, jobBR-CAP-CRM-ACT-008-11
crm.address-types.bulkSubmit bulk work for address classifications.api
crm.address-types.createCreate address classifications.createAddressTypeapi, console
crm.address-types.deleteRemove address classifications.deleteAddressTypeapi, consoleBR-CAP-CRM-ENT-018-07
crm.address-types.readRead address classifications.listAddressTypesgetAddressTypeapi, console
crm.address-types.updateMaintain address classifications.reorderAddressTypesupdateAddressTypepatchAddressTypeapi, consoleBR-CAP-CRM-ENT-018-07
crm.affiliation-types.bulkSubmit bulk work for affiliation classifications.api
crm.affiliation-types.createCreate affiliation classifications.createAffiliationTypeapi, console, portal
crm.affiliation-types.deleteRemove affiliation classifications.deleteAffiliationTypeapi, console, portalBR-CAP-CRM-ENT-018-07
crm.affiliation-types.readRead affiliation classifications.listAffiliationTypesgetAffiliationTypegetCrmSettingsapi, console, portal
crm.affiliation-types.set-defaultChoose the default kind of affiliation classifications.patchCrmSettingsapi, console, portalBR-CAP-CRM-ENT-017-06
crm.affiliation-types.updateMaintain affiliation classifications.updateAffiliationTypepatchAffiliationTypeapi, console, portalBR-CAP-CRM-ENT-018-07
crm.application.accessOpen CRM.api, consoleBR-CAP-PFM-SEC-015-09
crm.contact-layouts.bulkSubmit bulk work for contact presentation definitions.api
crm.contact-layouts.createCreate contact presentation definitions.api
crm.contact-layouts.deleteRemove contact presentation definitions.api
crm.contact-layouts.readRead contact presentation definitions.getCrmSettingsapi, console, portal
crm.contact-layouts.updateMaintain contact presentation definitions.patchCrmSettingsapi, console, portalBR-CAP-CRM-ENT-019-02 BR-CAP-CRM-ENT-019-03
crm.contact-roles.bulkSubmit bulk work for organizational contact roles.api
crm.contact-roles.createCreate organizational contact roles.createContactRoleapi, console, portal
crm.contact-roles.deleteRemove organizational contact roles.deleteContactRoleapi, console, portalBR-CAP-CRM-ENT-018-07
crm.contact-roles.lockApply record locks to organizational contact roles.lockContactRoleapi, consoleBR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-08
crm.contact-roles.readRead organizational contact roles.listContactRolesgetContactRolelistContactRoleLockChangesapi, console, job, portal
crm.contact-roles.unlockRelease record locks on organizational contact roles.unlockContactRoleapi, consoleBR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-08
crm.contact-roles.updateMaintain organizational contact roles.reorderContactRolesupdateContactRolepatchContactRoleapi, console, portalBR-CAP-CRM-ENT-018-07
crm.contact-types.bulkSubmit bulk work for contact classifications.api
crm.contact-types.createCreate contact classifications.createContactTypeapi, console
crm.contact-types.deleteRemove contact classifications.deleteContactTypeapi, consoleBR-CAP-CRM-ENT-018-07
crm.contact-types.readRead contact classifications.listContactTypesgetContactTypeapi, console
crm.contact-types.updateMaintain contact classifications.reorderContactTypesupdateContactTypepatchContactTypeapi, consoleBR-CAP-CRM-ENT-018-07
crm.contacts.archiveArchive and restore people.archiveContactunarchiveContactapi, consoleBR-CAP-CRM-ENT-013-02
crm.contacts.bulkSubmit bulk work for people.reconcileAffiliationDatesapi, console, job
crm.contacts.createCreate people.createContactapi, consoleBR-CAP-CRM-ENT-001-11 BR-CAP-CRM-ENT-001-12
crm.contacts.create-despite-duplicate-blockCreate despite blocking duplicate evidence for people.createContactapi, consoleBR-CAP-CRM-DQ-004-06 BR-CAP-CRM-DQ-004-07
crm.contacts.deleteRemove people.deleteContactapi, job, consoleBR-CAP-CRM-ENT-014-04 BR-CAP-CRM-ENT-015-08
crm.contacts.historyInspect past values of people.listContactHistorylistContactHistoryActorsgetContactRevisionlistMergedContactHistorylistMergedContactHistoryActorsgetMergedContactRevisionapi, consoleBR-CAP-CRM-ENT-016-02
crm.contacts.lockApply record locks to people.lockContactapi, consoleBR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-06 BR-CAP-CRM-ENT-015-08
crm.contacts.mergePrepare and execute combinations of people.createMergePlanlistMergePlansgetMergeLimitsgetMergePlanupdateMergePlanvalidateMergePlanexecuteMergePlanapi, job, consoleBR-CAP-CRM-DQ-012-01 BR-CAP-CRM-DQ-012-02 BR-CAP-CRM-DQ-016-01 BR-CAP-CRM-DQ-016-02 BR-CAP-CRM-DQ-016-06 BR-CAP-CRM-DQ-016-08
crm.contacts.queryExplore and query people.api, consoleBR-CAP-CRM-ENT-003-11
crm.contacts.readRead people.getContactTimelinegetContactTimelineSummarycreateMergePlanlistMergePlansgetMergeLimitsgetMergePlanupdateMergePlanvalidateMergePlanexecuteMergePlanlistMergesIntoRecordgetMergeIntoRecordlistContactsrecursivelyListContactsForOrganizationIdgetContactgetContactMailingAddresslistContactHistorylistContactHistoryActorsgetContactRevisionlistMergedContactHistorylistMergedContactHistoryActorsgetMergedContactRevisionlistContactLockChangeslistOrganizationAffiliationsgetEffectiveDefinitionsrenderEmailPreviewapi, console, job, portal
crm.contacts.unlockRelease record locks on people.updateContactpatchContactunlockContactapi, consoleBR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-06 BR-CAP-CRM-ENT-015-08
crm.contacts.updateMaintain people.updateContactpatchContactverifyContactAddressrelinkContactAddressremoveContactAddressverifyContactPhoneNumberrelinkContactPhoneNumberremoveContactPhoneNumberapi, console, jobBR-CAP-CRM-ENT-004-01 BR-CAP-CRM-ENT-004-06 BR-CAP-CRM-ENT-015-05 BR-CAP-CRM-REG-009-05
crm.duplicates.configureMaintain matching policy for duplicate evidence.startDuplicateRescanlistDuplicateRescansgetDuplicateRescanlistDuplicateRulesupdateDuplicateRuleapi, console, jobBR-CAP-CRM-DQ-003-06
crm.duplicates.readRead duplicate evidence.listDuplicateGroupsgetDuplicateGroupgetDuplicateSummarylistDuplicateCandidatesgetDuplicateCandidatelistRecordDuplicateCandidatescheckForDuplicatesapi, console, job
crm.duplicates.reviewDecide whether identities match in duplicate evidence.dismissDuplicateGrouprestoreDuplicateGroupDismissaladdManualDuplicateCandidatedismissDuplicateCandidaterestoreDuplicateCandidateapi, consoleBR-CAP-CRM-DQ-009-03
crm.merges.readRead retained merge outcomes.listRecordMergesgetRecordMergegetRecordMergeDetailslistMergesIntoRecordgetMergeIntoRecordgetMergedRecordAliasapi, console, job
crm.organization-layouts.bulkSubmit bulk work for organization presentation definitions.api
crm.organization-layouts.createCreate organization presentation definitions.api
crm.organization-layouts.deleteRemove organization presentation definitions.api
crm.organization-layouts.readRead organization presentation definitions.getCrmSettingsapi, console, portal
crm.organization-layouts.updateMaintain organization presentation definitions.patchCrmSettingsapi, console, portalBR-CAP-CRM-ENT-019-02 BR-CAP-CRM-ENT-019-03
crm.organization-types.bulkSubmit bulk work for organization classifications.api
crm.organization-types.createCreate organization classifications.createOrganizationTypeapi, console
crm.organization-types.deleteRemove organization classifications.deleteOrganizationTypeapi, consoleBR-CAP-CRM-ENT-018-07
crm.organization-types.readRead organization classifications.listOrganizationTypesgetOrganizationTypeapi, console
crm.organization-types.updateMaintain organization classifications.reorderOrganizationTypesupdateOrganizationTypepatchOrganizationTyperenderEmailPreviewapi, console, jobBR-CAP-CRM-ENT-018-07
crm.organizations.archiveArchive and restore organizations.archiveOrganizationunarchiveOrganizationapi, consoleBR-CAP-CRM-ENT-013-02
crm.organizations.bulkSubmit bulk work for organizations.api, console, job
crm.organizations.createCreate organizations.createOrganizationapi, consoleBR-CAP-CRM-ENT-002-11
crm.organizations.create-despite-duplicate-blockCreate despite blocking duplicate evidence for organizations.createOrganizationapi, consoleBR-CAP-CRM-DQ-004-06 BR-CAP-CRM-DQ-004-07
crm.organizations.deleteRemove organizations.deleteOrganizationapi, console, jobBR-CAP-CRM-ENT-014-04 BR-CAP-CRM-ENT-015-08
crm.organizations.historyInspect past values of organizations.listOrganizationHistorylistOrganizationHistoryActorsgetOrganizationRevisionapi, consoleBR-CAP-CRM-ENT-016-02
crm.organizations.lockApply record locks to organizations.lockOrganizationapi, consoleBR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-06 BR-CAP-CRM-ENT-015-08
crm.organizations.mergePrepare and execute combinations of organizations.createMergePlanlistMergePlansgetMergeLimitsgetMergePlanupdateMergePlanvalidateMergePlanexecuteMergePlanapi, job, consoleBR-CAP-CRM-DQ-012-01 BR-CAP-CRM-DQ-012-02 BR-CAP-CRM-DQ-016-01 BR-CAP-CRM-DQ-016-02 BR-CAP-CRM-DQ-016-06 BR-CAP-CRM-DQ-016-08 BR-CAP-CRM-DQ-017-05 BR-CAP-CRM-DQ-017-09 BR-CAP-CRM-DQ-017-10
crm.organizations.queryExplore and query organizations.api, consoleBR-CAP-CRM-ENT-003-11
crm.organizations.readRead organizations.getOrganizationTimelinegetOrganizationTimelineSummarycreateMergePlanlistMergePlansgetMergeLimitsgetMergePlanupdateMergePlanvalidateMergePlanexecuteMergePlanlistMergesIntoRecordgetMergeIntoRecordlistOrganizationsgetOrganizationlistOrganizationHistorylistOrganizationHistoryActorsgetOrganizationRevisionlistOrganizationLockChangesgetEffectiveDefinitionsrenderEmailPreviewapi, console, job, portal
crm.organizations.unlockRelease record locks on organizations.updateOrganizationpatchOrganizationunlockOrganizationapi, consoleBR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-06 BR-CAP-CRM-ENT-015-08
crm.organizations.updateMaintain organizations.updateOrganizationpatchOrganizationreprocessCompliancepreviewContactRoleComplianceEmailapi, console, jobBR-CAP-CRM-ENT-004-01 BR-CAP-CRM-ENT-004-06 BR-CAP-CRM-ENT-015-05 BR-CAP-CRM-REG-009-05
crm.phone-number-types.bulkSubmit bulk work for phone classifications.api
crm.phone-number-types.createCreate phone classifications.createPhoneNumberTypeapi, console
crm.phone-number-types.deleteRemove phone classifications.deletePhoneNumberTypeapi, consoleBR-CAP-CRM-ENT-018-07
crm.phone-number-types.readRead phone classifications.listPhoneNumberTypesgetPhoneNumberTypeapi, console
crm.phone-number-types.updateMaintain phone classifications.reorderPhoneNumberTypesupdatePhoneNumberTypepatchPhoneNumberTypeapi, consoleBR-CAP-CRM-ENT-018-07
crm.regions.bulkSubmit bulk work for regional definitions and geographic policy.submitRegionsDataJoblistRegionsDataJobsgetRegionsDataJobreadRegionsBySourceKeylistRegionsDataJobResultslistRegionsDataJobRejectionsapplyRegionsDataJobpauseRegionsDataJobresumeRegionsDataJobcancelRegionsDataJobretryRegionsDataJobrevalidateRegionsDataJobConflictsapi, console, job
crm.regions.createCreate regional definitions and geographic policy.createRegionapi, console
crm.regions.deleteRemove regional definitions and geographic policy.deleteRegionapi, consoleBR-CAP-CRM-REG-002-04
crm.regions.readRead regional definitions and geographic policy.listRegionsgetRegiongetRegionAssignmentSettingslistRegionAssignmentRulespreviewRegionAssignmentgetRegionAssignmentRulelistRegionRecalculationsgetRegionRecalculationapi, console, job
crm.regions.recalculateRecalculate placements for regional definitions and geographic policy.recalculateRegionAssignmentsapi, console, jobBR-CAP-CRM-REG-011-06
crm.regions.updateMaintain regional definitions and geographic policy.updateRegionpatchRegionupdateRegionAssignmentSettingscreateRegionAssignmentRulereorderRegionAssignmentRulesupdateRegionAssignmentRulepatchRegionAssignmentRuledeleteRegionAssignmentRulesubmitRegionsDataJoblistRegionsDataJobsgetRegionsDataJobreadRegionsBySourceKeylistRegionsDataJobResultslistRegionsDataJobRejectionsapplyRegionsDataJobpauseRegionsDataJobresumeRegionsDataJobcancelRegionsDataJobretryRegionsDataJobrevalidateRegionsDataJobConflictsapi, console, jobBR-CAP-CRM-REG-001-05 BR-CAP-CRM-REG-002-04 BR-CAP-CRM-REG-003-08 BR-CAP-CRM-REG-005-02
crm.task-queues.bulkSubmit bulk work for shared task queues.api, console
crm.task-queues.createCreate shared task queues.createTaskQueueapi, console
crm.task-queues.deleteRemove shared task queues.deleteTaskQueueapi, consoleBR-CAP-CRM-ACT-016-07
crm.task-queues.readRead shared task queues.listTaskQueuesgetTaskQueueapi, console
crm.task-queues.updateMaintain shared task queues.reorderTaskQueuesupdateTaskQueuepatchTaskQueueapi, consoleBR-CAP-CRM-ACT-016-07
crm.task-types.bulkSubmit bulk work for task classifications.api, console
crm.task-types.createCreate task classifications.createTaskTypeapi, console
crm.task-types.deleteRemove task classifications.deleteTaskTypeapi, consoleBR-CAP-CRM-ACT-016-07
crm.task-types.readRead task classifications.listTaskTypesgetTaskTypeapi, console
crm.task-types.updateMaintain task classifications.reorderTaskTypesupdateTaskTypepatchTaskTypeapi, consoleBR-CAP-CRM-ACT-016-07
crm.tasks.bulkSubmit bulk work for task work.api, console
crm.tasks.createCreate task work.createActivitycreateTaskrunTaskServiceOperationapi, console, job, service
crm.tasks.deleteRemove task work.deleteTaskapi, consoleBR-CAP-CRM-ACT-010-11
crm.tasks.queryExplore and query task work.api, console
crm.tasks.readRead task work.getContactTimelinegetOrganizationTimelinegetContactTimelineSummarygetOrganizationTimelineSummarygetTasklistOfferedTasksapi, console
crm.tasks.updateMaintain task work.getContactTimelinegetOrganizationTimelineupdateTaskpatchTaskassignTaskclaimTaskreleaseTaskcompleteTaskreopenTaskcancelTaskrunTaskServiceOperationapi, console, job, serviceBR-CAP-CRM-ACT-010-10 BR-CAP-CRM-ACT-010-11 BR-CAP-CRM-ACT-011-08 BR-CAP-CRM-ACT-012-04 BR-CAP-CRM-ACT-012-05 BR-CAP-CRM-ACT-012-09 BR-CAP-CRM-ACT-013-02 BR-CAP-CRM-ACT-013-06
any of crm.contact-layouts.read, crm.organization-layouts.read, crm.affiliation-types.read; each section or kind is checked by the handlerResolve this contract declaration through its component permissions and handler guards.getCrmSettingsconsole
any of crm.contact-layouts.update, crm.organization-layouts.update, crm.affiliation-types.set-default; each section or kind is checked by the handlerResolve this contract declaration through its component permissions and handler guards.patchCrmSettingsconsoleBR-CAP-CRM-ENT-019-02 BR-CAP-CRM-ENT-019-03 BR-CAP-CRM-ENT-017-06
any of crm.contacts.merge, crm.contacts.read, crm.organizations.merge, crm.organizations.read admits; the handler requires a complete read and merge pair for at least one record typeResolve this contract declaration through its component permissions and handler guards.getMergeLimitsconsoleBR-CAP-CRM-DQ-012-01 BR-CAP-CRM-DQ-012-02 BR-CAP-CRM-DQ-016-01 BR-CAP-CRM-DQ-016-02 BR-CAP-CRM-DQ-016-06 BR-CAP-CRM-DQ-016-08 BR-CAP-CRM-DQ-017-05 BR-CAP-CRM-DQ-017-09 BR-CAP-CRM-DQ-017-10
any of crm.contacts.merge, crm.contacts.read, crm.organizations.merge, crm.organizations.read admits; the handler requires the merge and read keys of the plan record typeResolve this contract declaration through its component permissions and handler guards.createMergePlanlistMergePlansgetMergePlanupdateMergePlanvalidateMergePlanexecuteMergePlanconsoleBR-CAP-CRM-DQ-012-01 BR-CAP-CRM-DQ-012-02 BR-CAP-CRM-DQ-016-01 BR-CAP-CRM-DQ-016-02 BR-CAP-CRM-DQ-016-06 BR-CAP-CRM-DQ-016-08 BR-CAP-CRM-DQ-017-05 BR-CAP-CRM-DQ-017-09 BR-CAP-CRM-DQ-017-10
any of crm.contacts.read, crm.organizations.read; each section or kind is checked by the handlerResolve this contract declaration through its component permissions and handler guards.getEffectiveDefinitionsconsole
crm.activities.create (also crm.tasks.create when a follow-up is asked for)Resolve this contract declaration through its component permissions and handler guards.createActivityconsoleBR-CAP-CRM-ACT-001-03 BR-CAP-CRM-ACT-002-01
crm.activities.history (evaluates crm.activities.read for a live activity)Resolve this contract declaration through its component permissions and handler guards.listActivityHistorygetActivityRevisionlistActivityHistoryActorsconsoleBR-CAP-CRM-ACT-006-01
crm.activities.read and crm.contacts.read (evaluates crm.tasks.read)Resolve this contract declaration through its component permissions and handler guards.getContactTimelineSummaryconsole
crm.activities.read and crm.contacts.read (evaluates crm.tasks.read, crm.tasks.update, crm.activities.update)Resolve this contract declaration through its component permissions and handler guards.getContactTimelineconsoleBR-CAP-CRM-ACT-010-10 BR-CAP-CRM-ACT-010-11 BR-CAP-CRM-ACT-011-08 BR-CAP-CRM-ACT-012-04 BR-CAP-CRM-ACT-012-05 BR-CAP-CRM-ACT-012-09 BR-CAP-CRM-ACT-013-02 BR-CAP-CRM-ACT-013-06 BR-CAP-CRM-ACT-003-01 BR-CAP-CRM-ACT-003-06
crm.activities.read and crm.organizations.read (evaluates crm.tasks.read)Resolve this contract declaration through its component permissions and handler guards.getOrganizationTimelineSummaryconsole
crm.activities.read and crm.organizations.read (evaluates crm.tasks.read, crm.tasks.update, crm.activities.update)Resolve this contract declaration through its component permissions and handler guards.getOrganizationTimelineconsoleBR-CAP-CRM-ACT-010-10 BR-CAP-CRM-ACT-010-11 BR-CAP-CRM-ACT-011-08 BR-CAP-CRM-ACT-012-04 BR-CAP-CRM-ACT-012-05 BR-CAP-CRM-ACT-012-09 BR-CAP-CRM-ACT-013-02 BR-CAP-CRM-ACT-013-06 BR-CAP-CRM-ACT-003-01 BR-CAP-CRM-ACT-003-06
crm.contacts.create (also evaluates crm.contacts.create-despite-duplicate-block)Resolve this contract declaration through its component permissions and handler guards.createContactconsoleBR-CAP-CRM-ENT-001-11 BR-CAP-CRM-ENT-001-12 BR-CAP-CRM-DQ-004-06 BR-CAP-CRM-DQ-004-07
crm.contacts.history (also evaluates crm.contacts.read)Resolve this contract declaration through its component permissions and handler guards.listContactHistorylistContactHistoryActorsgetContactRevisionlistMergedContactHistorylistMergedContactHistoryActorsgetMergedContactRevisionconsoleBR-CAP-CRM-ENT-016-02
crm.contacts.read or crm.organizations.read for the path record type, reaching the record; crm.merges.read widens nothing hereResolve this contract declaration through its component permissions and handler guards.listMergesIntoRecordconsole
crm.contacts.read or crm.organizations.read for the path record type; crm.merges.read widens the detailsResolve this contract declaration through its component permissions and handler guards.getMergeIntoRecordconsole
crm.contacts.update (also evaluates crm.contacts.unlock)Resolve this contract declaration through its component permissions and handler guards.updateContactpatchContactconsoleBR-CAP-CRM-ENT-004-01 BR-CAP-CRM-ENT-004-06 BR-CAP-CRM-ENT-015-05 BR-CAP-CRM-REG-009-05 BR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-06 BR-CAP-CRM-ENT-015-08
crm.organization-types.update (also evaluates crm.organizations.read, crm.contacts.read)Resolve this contract declaration through its component permissions and handler guards.renderEmailPreviewconsoleBR-CAP-CRM-ENT-018-07
crm.organizations.create (also evaluates crm.organizations.create-despite-duplicate-block)Resolve this contract declaration through its component permissions and handler guards.createOrganizationconsoleBR-CAP-CRM-ENT-002-11 BR-CAP-CRM-DQ-004-06 BR-CAP-CRM-DQ-004-07
crm.organizations.history (also evaluates crm.organizations.read)Resolve this contract declaration through its component permissions and handler guards.listOrganizationHistorylistOrganizationHistoryActorsgetOrganizationRevisionconsoleBR-CAP-CRM-ENT-016-02
crm.organizations.update (also evaluates crm.organizations.unlock)Resolve this contract declaration through its component permissions and handler guards.updateOrganizationpatchOrganizationconsoleBR-CAP-CRM-ENT-004-01 BR-CAP-CRM-ENT-004-06 BR-CAP-CRM-ENT-015-05 BR-CAP-CRM-REG-009-05 BR-CAP-CRM-ENT-015-02 BR-CAP-CRM-ENT-015-06 BR-CAP-CRM-ENT-015-08
crm.regions.bulk and crm.regions.update (both required)Resolve this contract declaration through its component permissions and handler guards.submitRegionsDataJoblistRegionsDataJobsgetRegionsDataJobreadRegionsBySourceKeylistRegionsDataJobResultslistRegionsDataJobRejectionsapplyRegionsDataJobpauseRegionsDataJobresumeRegionsDataJobcancelRegionsDataJobretryRegionsDataJobrevalidateRegionsDataJobConflictsconsoleBR-CAP-CRM-REG-001-05 BR-CAP-CRM-REG-002-04 BR-CAP-CRM-REG-003-08 BR-CAP-CRM-REG-005-02
crm.tasks.create and crm.tasks.update (service access by invoke grant; evaluated as all for a trusted service)Resolve this contract declaration through its component permissions and handler guards.runTaskServiceOperationserviceBR-CAP-CRM-ACT-010-10 BR-CAP-CRM-ACT-010-11 BR-CAP-CRM-ACT-011-08 BR-CAP-CRM-ACT-012-04 BR-CAP-CRM-ACT-012-05 BR-CAP-CRM-ACT-012-09 BR-CAP-CRM-ACT-013-02 BR-CAP-CRM-ACT-013-06
none: public health routeExpose service health without customer record access.getActivitiesHealthgetTasksHealthgetDuplicatesHealthgetMergesHealthgetConfigurationTypesHealthgetEntitiesHealthgetRegionsHealthpublic

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software