Restrict regional work to authorised users

Purpose

Regional operations are available according to the user’s authority in the selected workspace.

How It Works

The API checks a regional permission for each operation and requires console access. Regional read authority supports inspection and address preview. Creation and update are ordinary user-tier powers; deletion, bulk work and recalculation are administrator-tier powers. Workspace access is checked independently of the regional permission. The console removes or disables actions for read-only users and protects the editor route. Its broader settings aliases can nevertheless grant entry or controls to users lacking the exact regional service key. Those requests are then refused by the API. The product should align those gates before treating the console as an accurate guide to the user’s authority.

Relationships

Maintain the region catalogue supplies the regional catalogue used by the surrounding work.
Retire regions while preserving their references handles retirement and reference-sensitive removal of regional definitions.
Configure automatic placement and its address sources establishes participation and address-source choices for placement.
Apply the current policy across existing records applies policy changes to existing records.
Import a catalogue of regions loads regional definitions through shared data-job processing.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Readers can inspect regional configuration without usable edit controls.Published permission tiers distinguish ordinary edits from destructive or bulk work.The product should align console gates with the service authority they represent.
Surfaces: consoleapi

Controls

14 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-DAT-001 TC-DAT-003 TC-LOG-004 TC-LOG-005 TC-PI-001 TC-TEN-001 TC-TEN-002 TC-TEN-003

Permissions

Key	Checked at	Scope
`crm.regions.read`	api	tenant
`crm.regions.create`	api	tenant
`crm.regions.update`	api	tenant
`crm.regions.delete`	api	tenant
`crm.regions.bulk`	api	tenant
`crm.regions.recalculate`	api	tenant
`crm.regions.read`	console	tenant
`crm.regions.update`	console	tenant
`crm.regions.delete`	console	tenant
`crm.regions.recalculate`	console	tenant

Business Rules

8 rules, 7 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	Region reads, settings, rules, previews and run reads require read authority; region creation requires create, region and policy changes require update, deletion requires delete and recalculation requires recalculate. no proof recorded yet	permission	api	test services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to save the assignment settings
`02`must prove Proposed	Regional read is read-tier authority, creation and update are user-tier authority, and deletion, bulk work and recalculation are admin-tier authority. no proof recorded yet	permission	api	observed services-crm:aws/crm.service.ts:RegionsPermissions
`03`must prove Proposed	Regional routes grant console access only. no proof recorded yet	permission	api	test services-crm:tests/unit/regions-authorization.spec.ts#serves every regions route to console users only
`04`must prove Proposed	Anonymous requests and signed requests outside the caller’s workspace access are rejected. no proof recorded yet	permission	api	test services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call
`05`must prove Proposed	A read-only console user can inspect regions and policy, receives a read-only explanation and has no usable regional edit actions. no proof recorded yet	permission	console	test react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one
`06` Proposed	The console protects direct access to the policy editor with its settings-management gate.	permission	console	test react-console:components/regions/__tests__/assignment-rules-editor.test.tsx#who may open the editor › is not somebody who may only look, whatever the URL
`07`must prove Proposed	The console’s view and management aliases accept alternative keys that can expose regional controls whose API requests are refused; the recalculation alias maps directly to the recalculation key. no proof recorded yet	permission	console	observed react-console:lib/authz/backend-aliases.ts:crm.settings.view, crm.settings.manage, maintenance.operations.run
`08`must prove Proposed	Read-only API authority permits listing rules but does not permit creating them. no proof recorded yet	permission	api	test services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 403 to a create for that same read-only context

Scenarios

Id	Given	When	Then	Provenance
`01`	A reader visits regional configuration.	They inspect both tabs.	They can read the information and see the read-only explanation without usable edit actions.	test react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one

Edge Cases

Id	Given	When	Then	Provenance
`02`	A user holds contact-role read authority but lacks regional read authority.	They enter the Regions page.	The console gate permits entry but regional requests are refused.	inferred react-console:lib/authz/backend-aliases.ts

Planning

Restrict regional work to authorised users ​

Purpose ​

How It Works ​

Relationships ​