Rhythm 2.0 Specifications

Appearance

CAP-MBR-STR-019Authorize structure and configuration work

Markdown

CAP-MBR-STR-019

Authorize structure and configuration work

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

Planning

Feature
FEAT-MBR-STR-06
Exercised by
FAS-MBR-STR-06-01, FAS-MBR-STR-06-02, FAS-MBR-STR-06-03, FAS-MBR-STR-06-04, FAS-MBR-STR-06-05
Key concepts
CON-MBR-STR-006
Actors
ACT-MBR-001, ACT-MBR-002
Related
CAP-MBR-STR-005, CAP-MBR-STR-018
Proved by
ATS-MBR-STR-019

Implementation

Executable suites
TST-MBR-STR-006, TST-MBR-STR-028, TST-MBR-STR-029, TST-MBR-STR-084, TST-MBR-STR-085, TST-MBR-STR-100, TST-MBR-STR-101, TST-MBR-STR-103

KindCapabilityProduct areaMembershipModuleOrganizational Structure, Membership Configuration and TermsRevision1

Read atservices-membership 5994c270react-console baf6dae3

Authorize structure and configuration work ​

Purpose ​

Rhythm separates staff reading from administration and confines each action to the licensed workspace.

How It Works ​

A request reaches the operation under the authority of its caller. Structure, program and configuration concerns each distinguish reading from management. Those permissions apply across a workspace rather than to one chapter. An officer’s local membership authority therefore does not grant administration of the structure. Application access and workspace admission are separate checks. A licence or workspace availability failure can block an otherwise permitted request. Database isolation provides a further workspace boundary. Public health checks describe the service without exposing workspace records. The console uses a different Membership permission vocabulary today. The product should reconcile that vocabulary with the service before adding administration screens.

Relationships ​

  • All structure and configuration capabilities rely on these authority boundaries.
  • Platform owns permission evaluation, licensing and workspace admission.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Staff operations require the published authority for their concern.Workspace and application checks protect access to membership configuration.
Surfaces
apiconsole

Controls

25 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-CHG-001 TC-CHG-002 TC-CHG-003 TC-CHG-004 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-004 TC-MON-001 TC-MON-003 TC-MON-004 TC-PI-001 TC-SEC-001 TC-SEC-004 TC-TEN-001 TC-TEN-002 TC-TEN-003

Permissions

KeyChecked atScope
membership.structure.readapitenant
membership.structure.manageapitenant
membership.programs.readapitenant
membership.programs.manageapitenant
membership.configuration.readapitenant
membership.configuration.manageapitenant
membership.application.accessapitenant

Business Rules

7 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Structure reads require structure-read permission, and structure mutations require structure-manage permission.
proved by ATS-MBR-STR-001-13, ATS-MBR-STR-002-16, ATS-MBR-STR-003-10, ATS-MBR-STR-004-10, ATS-MBR-STR-005-10, ATS-MBR-STR-006-12, ATS-MBR-STR-007-10, ATS-MBR-STR-008-09, ATS-MBR-STR-019-01, ATS-MBR-STR-019-07, TST-MBR-STR-084, TST-MBR-STR-100, TST-MBR-STR-103
permissionapitest
services-membership:tests/unit/route-authorization.spec.ts#route authorization: every Membership operation names its permission › requires membership.structure.read of every structure read and membership.structure.manage of every change
02must prove
Proposed
Programs and program unit requirements use program authority, while types, packages, reasons and policy sets use configuration authority.
proved by ATS-MBR-STR-009-10, ATS-MBR-STR-010-06, ATS-MBR-STR-011-08, ATS-MBR-STR-012-15, ATS-MBR-STR-013-09, ATS-MBR-STR-014-04, ATS-MBR-STR-015-13, ATS-MBR-STR-017-06, ATS-MBR-STR-018-15, ATS-MBR-STR-019-02, ATS-MBR-STR-019-08, TST-MBR-STR-028
permissionapiobserved
services-membership:modules/configuration/aws/api/configuration.routes.ts:configurationModuleRoutes
03must prove
Proposed
Manage permissions are administrator-tier workspace permissions, so an officer’s unit-scoped grant does not authorize these operations.
proved by ATS-MBR-STR-019-03, TST-MBR-STR-028, TST-MBR-STR-084
permissionapiobserved
services-membership:aws/membership.service.ts:STRUCTURE_PERMISSIONS
04must prove
Proposed
Workspace data operations require Membership application access, a Membership licence and an available workspace.
proved by ATS-MBR-STR-016-12, ATS-MBR-STR-019-04, TST-MBR-STR-101
permissionapitest
services-membership:tests/e2e/terms-api.e2e.spec.ts#the terms API, end to end in process › refuses a caller who holds no key in the tenant
05must prove
Proposed
Database row isolation confines structure and configuration records to the caller’s workspace.
proved by ATS-MBR-STR-019-05, TST-MBR-STR-006, TST-MBR-STR-029, TST-MBR-STR-085
permissiondatabasetest
services-membership:modules/structure/tests/integration/services/persistence/organizational-units.integration.spec.ts#organizational units in the database › row-level security › shows another tenant none of the units
06
Proposed
Route permission references resolve to published catalogue keys and each published key has a route consumer.
invariantapitest
services-membership:tests/unit/route-authorization.spec.ts#route authorization: every Membership operation names its permission › is allowed or evaluates only keys the published catalog defines
07must prove
Proposed
The console’s Membership permission vocabulary differs from the service catalogue, preventing direct equivalence without a verified mapping.
proved by ATS-MBR-STR-019-06
permissionconsoleobserved
react-console:lib/authz/permissions.ts:82

Scenarios

IdGivenWhenThenProvenance
01A staff caller holds structure-reading authority only.The caller requests a unit list and then a relocation.Reading succeeds and the mutation returns an access refusal.test
services-membership:tests/e2e/structure-api.e2e.spec.ts#the structure API, end to end in process › refuses a reader a change, 403

Edge Cases

IdGivenWhenThenProvenance
02An officer has membership authority limited to Atlanta.The officer attempts to replace Atlanta’s name.The request lacks the workspace administration permission and fails.test
services-membership:tests/acceptance/structure/MBR-ACC-0025.acceptance.ts#MBR-ACC-0025 one structure change, seven people

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software