Apply workspace access and maintenance permissions

Purpose

Customers control who reads, records and maintains interactions and work.

How It Works

Each API operation declares the authority needed for its action. The signed context identifies the workspace being accessed. Local storage relationships preserve that workspace boundary. Console controls reflect the user’s available actions. Service invocation has a separate trusted access boundary. External user and role references require checks beyond local foreign keys. Locks can be set through ordinary saves, but a full lock cannot be released through the supported actions. The product should replace that gap with the recorded authorized and audited lock operations. Declared bulk keys do not imply corresponding task bulk operations exist.

Relationships

All activity and task capabilities rely on these access boundaries.
Platform security owns role and permission evaluation.
Platform data jobs own supported bulk activity operations.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Workspace boundaries on local recordsActions aligned with declared permissionsPermission-aware console controls
Surfaces: consoleapi
Intent sources: services-crm:docs/milestones/CRM-M8-activities-and-tasks.md#D-08services-crm:docs/migrations/activities/README.md#D9

Controls

21 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-PI-001 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003

Permissions

Key	Checked at	Scope
`crm.activities.read`	api	tenant
`crm.activities.create`	api	tenant
`crm.activities.update`	api	tenant
`crm.activities.delete`	api	tenant
`crm.activities.bulk`	api	tenant
`crm.activities.query`	api	tenant
`crm.activities.history`	api	tenant
`crm.tasks.read`	api	tenant
`crm.tasks.create`	api	tenant
`crm.tasks.update`	api	tenant
`crm.tasks.delete`	api	tenant
`crm.tasks.bulk`	api	tenant
`crm.tasks.query`	api	tenant

Business Rules

10 rules, 9 to be proved before approval. A rule's product intent is derived from its origin: 1 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	Local records and foreign keys are workspace-scoped, while external user and role references need separate validation rather than local foreign keys. no proof recorded yet	invariant	database	observed services-crm:modules/tasks/db/tasks.table.ts; services-crm:modules/activities/db/activity-links.table.ts
`02`must prove Proposed	Another workspace’s activity or task appears absent, and attempted writes to it are refused without changes. no proof recorded yet	validation	api, service, database	test services-crm:modules/tasks/tests/integration/services/persistence/tasks.integration.spec.js#is left exactly as the other tenant had it, every refusal above having written nothing
`03`must prove Proposed	A signed workspace context cannot be used against another workspace’s address. no proof recorded yet	permission	api	test services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a context for tenant B on tenant A’s path: 403
`04`must prove Proposed	Activity read, query and history are reader-tier permissions, creation, editing and deletion are user-tier permissions, and bulk operations are administrator-tier permissions. no proof recorded yet	permission	api	test services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller who may only read activities: 403
`05`must prove Proposed	Task read and query are reader-tier permissions, task work and lifecycle actions are user-tier permissions, and deletion and bulk are administrator-tier permissions. no proof recorded yet	permission	api	test services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks claiming one
`06`must prove Proposed	Activity types, task types and queues are readable by readers and maintained by administrators. no proof recorded yet	permission	api	test services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to a caller who may only read types: 403
`07`must prove Proposed	A request with no signed execution context is rejected as unauthenticated. no proof recorded yet	permission	api	test services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#answers 401 without a context
`08`must prove Confirmed	Ordinary saves can set deletion or full locks on module records, but no supported action can clear a full lock afterward. origin: services-crm:docs/milestones/CRM-M8-activities-and-tasks.md#D-08 no proof recorded yet	policy	api, service	test react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0699.spec.ts#CRM-ACC-0699
`09` Proposed	Task, task-type and task-queue bulk permissions are declared without operations that consume them.	permission	api	observed services-crm:aws/crm.service.ts:TasksPermissions
`10`must prove Proposed	Console activity and task controls are hidden or disabled according to the user’s relevant permissions. no proof recorded yet	permission	console	test react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0715.spec.ts#CRM-ACC-0715

Scenarios

Id	Given	When	Then	Provenance
`01`	Callers have administrator, read-only, absent-role and non-CRM authority.	Attempt activity reading, creation, correction, deletion and configuration.	Each request follows its declared permission boundary.	test react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0715.spec.ts#CRM-ACC-0715
`02`	An administrator belongs to another customer workspace.	Target this workspace’s activity and task references.	Requests are rejected at the context boundary or treated as absent records.	test react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0718.spec.ts#CRM-ACC-0718

Planning

Apply workspace access and maintenance permissions ​

Purpose ​

How It Works ​

Relationships ​