Keep Setup Permissions at Workspace Scope

Context

Memberships supports unit-scoped officer work, but association setup uses workspace administration authority. The permission catalogue gives these activities distinct scopes.

Decision

This record describes the published setup keys. It does not bar a person who is an officer from acting when that person separately holds the required workspace authority.

Alternatives Considered

Allow officers to edit their unit's details and links. A scoped write capability would need field restrictions and an authorization contract that the current routes do not provide. Use one permission for all setup changes. That would remove the current separation between structural, program and offering administrators.

Consequences

Three read-and-manage pairs separate the setup concerns. Officer self-service requires a new capability and scoped contract. Existing console permission vocabulary needs verified mapping before administration screens rely on it.