Evaluate Officer Reach Through Member Units

Context

Officers administer people reached through their units and descendants, while staff may hold workspace-wide authority. Shared operations need record-specific reach checks.

Decision

Officer-capable permission evaluation uses dated membership units and ancestry, with object-level checks before revealing inaccessible records.

Alternatives Considered

Separate officer endpoints with their own logic: Separate officer implementations would duplicate membership behaviour and its validation.

Answer forbidden for an out-of-scope read: A distinct forbidden response can disclose an otherwise hidden membership.

Consequences

Scope predicates restrict candidate records before keyset paging. Each request evaluates current grants so expired authority stops applying. History remains staff-only, and an existing refusal-wording finding limits the intended concealment guarantee.