Platform Authorization Model

Authorization Boundary

Public identity flows and deployment-health reads use their own declared entry boundaries. Protected customer work requires an admitted identity and scoped authority. Portal identity stays within its workspace; console identity stays within its customer unless a recorded staff-entry grant permits customer work.

Rhythm HQ requires staff authority and the operation’s permission. A customer Administrator role supplies no HQ entry, and a platform staff role supplies no ordinary customer-record access. Internal jobs, deployment registrations and application functions use their declared machine boundaries. A public or internal operation’s access description is not a customer permission.

Scopes

Platform scope serves Rhythm staff system work. Customer scope reaches the customer’s workspaces, workspace scope reaches one workspace, and record scope narrows authority by resource type and identity. The stored assignment types do not establish a separate organizational-unit level; an application can interpret its supported unit as a resource scope.

A role describes possible authority. Its assignment supplies the scope, validity and conditions. A gateway admission can therefore succeed while a service refuses a particular record or condition. The service remains responsible for that narrower check.

Roles

The released customer roles are Administrator, Power User, Standard User, Read Only and Portal Member. The first four compose generated application policies. Administrator additionally carries the declared security-administration and workspace-export policies. Those separate powers do not follow from the Power User role’s application-administration policies.

Support Representative and Software Engineer share the declared HQ reader policy. Support additionally holds deletion reading and holding; Engineering additionally holds deletion reading and tailored-dataset authoring. Rhythm Administrator carries HQ authority and the explicitly listed staff-only Platform powers. Customer workspace entry remains a separate grant.

Customers can compose their own roles and policies within delegation safeguards. These are customer records rather than additional universal roles. The caller’s own evaluated-access read comes from active membership, so the matrix does not present it as an administered role entitlement. The Portal Member row shows Platform account powers; peer applications add their portal grants only while their catalogues publish them.

Permission Catalogue

The structured catalogue gives each requirement its intent, operation references, surfaces and further guard rules. Concrete permissions are grantable keys. Console entitlements are derived presentation checks, permission patterns match released keys, and compound expressions combine requirements rather than create new powers. Non-permission boundaries identify public, machine or internal entry without adding a grant.

Existing contracts sometimes store a complete requirement description in the permission field. The catalogue retains that spelling for traceability and separately identifies its concrete keys. Source applications retain ownership of dataset and record permissions; Platform consumes those keys when it processes their information. Shared questions, reports and layouts confer no additional access to the underlying records.

Role Entitlement Matrix

This matrix expands the released roles over the concrete keys consumed in this area. A checkmark means the baseline role includes the key; a dash means it does not. Scope, explicit denies, assignment conditions, availability and protected-action guards still decide an actual request. Console aliases, compound expressions, machine policies and membership-derived self access are excluded because they are not independent role grants.

Permission	Administrator	Power User	Standard User	Read Only	Portal Member	Support Representative	Software Engineer	Rhythm Administrator
committees.committees.read	✓	✓	✓	✓	—	—	—	—
crm.activities.bulk	✓	✓	—	—	—	—	—	—
crm.activities.delete	✓	✓	✓	—	—	—	—	—
crm.activities.update	✓	✓	✓	—	—	—	—	—
crm.activity-types.bulk	✓	✓	—	—	—	—	—	—
crm.activity-types.update	✓	✓	—	—	—	—	—	—
crm.address-types.bulk	✓	✓	—	—	—	—	—	—
crm.address-types.delete	✓	✓	—	—	—	—	—	—
crm.address-types.update	✓	✓	—	—	—	—	—	—
crm.application.access	✓	✓	✓	✓	—	—	—	—
crm.contact-layouts.create	✓	✓	—	—	—	—	—	—
crm.contact-layouts.delete	✓	✓	—	—	—	—	—	—
crm.contact-layouts.read	✓	✓	✓	✓	—	—	—	—
crm.contact-layouts.update	✓	✓	—	—	—	—	—	—
crm.contact-roles.bulk	✓	✓	—	—	—	—	—	—
crm.contact-roles.delete	✓	✓	—	—	—	—	—	—
crm.contact-roles.update	✓	✓	✓	—	—	—	—	—
crm.contact-types.bulk	✓	✓	—	—	—	—	—	—
crm.contact-types.delete	✓	✓	—	—	—	—	—	—
crm.contact-types.update	✓	✓	✓	—	—	—	—	—
crm.contacts.bulk	✓	✓	—	—	—	—	—	—
crm.contacts.delete	✓	✓	—	—	—	—	—	—
crm.contacts.query	✓	✓	✓	✓	—	—	—	—
crm.contacts.read	✓	✓	✓	✓	—	—	—	—
crm.contacts.update	✓	✓	✓	—	—	—	—	—
crm.organization-types.bulk	✓	✓	—	—	—	—	—	—
crm.organization-types.delete	✓	✓	—	—	—	—	—	—
crm.organization-types.update	✓	✓	✓	—	—	—	—	—
crm.organizations.bulk	✓	✓	—	—	—	—	—	—
crm.organizations.delete	✓	✓	—	—	—	—	—	—
crm.organizations.read	✓	✓	✓	✓	—	—	—	—
crm.organizations.update	✓	✓	✓	—	—	—	—	—
crm.phone-number-types.bulk	✓	✓	—	—	—	—	—	—
crm.phone-number-types.delete	✓	✓	—	—	—	—	—	—
crm.phone-number-types.update	✓	✓	—	—	—	—	—	—
crm.regions.bulk	✓	✓	—	—	—	—	—	—
crm.regions.update	✓	✓	✓	—	—	—	—	—
hq.audit.read	—	—	—	—	—	✓	✓	✓
hq.capacity.manage	—	—	—	—	—	—	—	✓
hq.custom-query-tables.assign	—	—	—	—	—	—	✓	✓
hq.custom-query-tables.author	—	—	—	—	—	—	✓	✓
hq.custom-query-tables.publish	—	—	—	—	—	—	✓	✓
hq.custom-query-tables.read	—	—	—	—	—	✓	✓	✓
hq.customers.create	—	—	—	—	—	—	—	✓
hq.customers.delete	—	—	—	—	—	—	—	✓
hq.customers.read	—	—	—	—	—	✓	✓	✓
hq.customers.update	—	—	—	—	—	—	—	✓
hq.data-exports.operate	—	—	—	—	—	—	—	✓
hq.data-exports.read	—	—	—	—	—	✓	✓	✓
hq.data-runs.manage	—	—	—	—	—	—	—	✓
hq.emergency-access.use	—	—	—	—	—	—	—	✓
hq.integrations.operate	—	—	—	—	—	—	—	✓
hq.integrations.publish	—	—	—	—	—	—	—	✓
hq.jobs.read	—	—	—	—	—	✓	✓	✓
hq.jobs.retry	—	—	—	—	—	—	—	✓
hq.licensing.manage	—	—	—	—	—	—	—	✓
hq.licensing.read	—	—	—	—	—	✓	✓	✓
hq.llm-usage.manage	—	—	—	—	—	—	—	✓
hq.llm-usage.read	—	—	—	—	—	✓	✓	✓
hq.llm-usage.read-evidence	—	—	—	—	—	—	—	✓
hq.notifications.operate	—	—	—	—	—	—	—	✓
hq.notifications.read	—	—	—	—	—	—	—	✓
hq.queries.read	—	—	—	—	—	✓	✓	✓
hq.roles.manage	—	—	—	—	—	—	—	✓
hq.roles.read	—	—	—	—	—	✓	✓	✓
hq.service-principals.manage	—	—	—	—	—	—	—	✓
hq.service-principals.read	—	—	—	—	—	✓	✓	✓
hq.snapshots.manage	—	—	—	—	—	—	—	✓
hq.snapshots.read	—	—	—	—	—	✓	✓	✓
hq.staff.disable	—	—	—	—	—	—	—	✓
hq.staff.invite	—	—	—	—	—	—	—	✓
hq.staff.read	—	—	—	—	—	✓	✓	✓
hq.staff.update	—	—	—	—	—	—	—	✓
hq.tenant-access.read	—	—	—	—	—	✓	✓	✓
hq.tenant-access.request	—	—	—	—	—	✓	✓	✓
hq.tenants.activate	—	—	—	—	—	—	—	✓
hq.tenants.provision	—	—	—	—	—	—	—	✓
hq.tenants.read	—	—	—	—	—	✓	✓	✓
hq.tenants.update	—	—	—	—	—	—	—	✓
platform.application.access	✓	✓	✓	✓	—	—	—	—
platform.association-types.create	✓	✓	—	—	—	—	—	—
platform.association-types.delete	✓	✓	—	—	—	—	—	—
platform.association-types.read	✓	✓	✓	✓	—	—	—	—
platform.association-types.update	✓	✓	—	—	—	—	—	—
platform.associations.create	✓	✓	✓	—	—	—	—	—
platform.associations.delete	✓	✓	✓	—	—	—	—	—
platform.associations.read	✓	✓	✓	✓	—	—	—	—
platform.associations.update	✓	✓	✓	—	—	—	—	—
platform.attention.manage	✓	✓	—	—	—	—	—	—
platform.attention.read	✓	✓	✓	✓	—	—	—	—
platform.attention.read-others	✓	✓	—	—	—	—	—	—
platform.attention.resolve-manually	✓	✓	—	—	—	—	—	—
platform.attention.use	✓	✓	✓	—	—	—	—	—
platform.audit-events.read	✓	✓	—	—	—	—	—	—
platform.communication-messages.read	✓	✓	✓	✓	—	—	—	—
platform.communication-messages.read-content	✓	✓	—	—	—	—	—	—
platform.communication-messages.update	✓	✓	✓	—	—	—	—	—
platform.communication-suppressions.create	✓	✓	—	—	—	—	—	—
platform.communication-suppressions.read	✓	✓	✓	✓	—	—	—	—
platform.communication-suppressions.update	✓	✓	—	—	—	—	—	—
platform.communication-templates.create	✓	✓	—	—	—	—	—	—
platform.communication-templates.delete	✓	✓	—	—	—	—	—	—
platform.communication-templates.publish	✓	✓	—	—	—	—	—	—
platform.communication-templates.read	✓	✓	✓	✓	—	—	—	—
platform.communication-templates.test-send	✓	✓	—	—	—	—	—	—
platform.communication-templates.update	✓	✓	—	—	—	—	—	—
platform.communications.request	—	—	—	—	—	—	—	✓
platform.custom-fields.bulk	✓	✓	—	—	—	—	—	—
platform.custom-fields.create	✓	✓	—	—	—	—	—	—
platform.custom-fields.delete	✓	✓	—	—	—	—	—	—
platform.custom-fields.read	✓	✓	✓	✓	—	—	—	—
platform.custom-fields.update	✓	✓	—	—	—	—	—	—
platform.custom-objects.create	✓	✓	—	—	—	—	—	—
platform.custom-objects.delete	✓	✓	—	—	—	—	—	—
platform.custom-objects.read	✓	✓	✓	✓	—	—	—	—
platform.custom-objects.update	✓	✓	—	—	—	—	—	—
platform.custom-records.create	✓	✓	✓	—	—	—	—	—
platform.custom-records.delete	✓	✓	—	—	—	—	—	—
platform.custom-records.export	✓	✓	—	—	—	—	—	—
platform.custom-records.history	✓	✓	✓	✓	—	—	—	—
platform.custom-records.publish	✓	✓	—	—	—	—	—	—
platform.custom-records.query	✓	✓	✓	✓	—	—	—	—
platform.custom-records.read	✓	✓	✓	✓	—	—	—	—
platform.custom-records.update	✓	✓	✓	—	—	—	—	—
platform.customers.read	✓	✓	✓	✓	—	—	—	—
platform.customers.update	✓	✓	—	—	—	—	—	—
platform.data-exports.download	✓	—	—	—	—	—	—	—
platform.data-exports.execute	✓	—	—	—	—	—	—	—
platform.data-exports.manage	✓	—	—	—	—	—	—	—
platform.data-exports.read	✓	—	—	—	—	—	—	—
platform.data-jobs.upload	✓	✓	—	—	—	—	—	—
platform.eligibility-bindings.manage	✓	✓	✓	—	—	—	—	—
platform.eligibility.population	✓	✓	✓	—	—	—	—	—
platform.eligibility.publish	✓	✓	—	—	—	—	—	—
platform.eligibility.read	✓	✓	✓	✓	—	—	—	—
platform.eligibility.reconcile	—	—	—	—	—	—	—	✓
platform.eligibility.retire	✓	✓	—	—	—	—	—	—
platform.eligibility.write	✓	✓	—	—	—	—	—	—
platform.explorer-views.manage	✓	✓	—	—	—	—	—	—
platform.explorer-views.share	✓	✓	✓	—	—	—	—	—
platform.explorer-views.use	✓	✓	✓	✓	—	—	—	—
platform.extension-bindings.manage	✓	✓	—	—	—	—	—	—
platform.extension-handlers.manage	✓	✓	—	—	—	—	—	—
platform.extension-handlers.test	✓	✓	—	—	—	—	—	—
platform.extension-invocations.read	✓	✓	—	—	—	—	—	—
platform.extension-points.read	✓	✓	✓	✓	—	—	—	—
platform.extension-rules.manage	✓	✓	—	—	—	—	—	—
platform.field-labels.update	✓	✓	—	—	—	—	—	—
platform.files.upload	✓	✓	✓	—	—	—	—	—
platform.integration-credentials.manage	✓	✓	—	—	—	—	—	—
platform.integration-executions.operate	✓	✓	—	—	—	—	—	—
platform.integration-executions.read	✓	✓	✓	✓	—	—	—	—
platform.integrations.invoke	✓	✓	—	—	—	—	—	—
platform.integrations.manage	✓	✓	—	—	—	—	—	—
platform.integrations.read	✓	✓	✓	✓	—	—	—	—
platform.jobs.read	✓	✓	✓	✓	—	—	—	—
platform.layouts.create	✓	✓	—	—	—	—	—	—
platform.layouts.delete	✓	✓	—	—	—	—	—	—
platform.layouts.read	✓	✓	✓	✓	—	—	—	—
platform.layouts.update	✓	✓	—	—	—	—	—	—
platform.llm-usage.read	✓	✓	—	—	—	—	—	—
platform.metadata.read	✓	✓	✓	✓	—	—	—	—
platform.notifications.manage	✓	✓	—	—	—	—	—	—
platform.notifications.publish	—	—	—	—	—	—	—	✓
platform.notifications.use	✓	✓	✓	✓	—	—	—	—
platform.queries.generate	✓	✓	✓	—	—	—	—	—
platform.queries.read	✓	✓	✓	✓	—	—	—	—
platform.query-schedules.external-recipients	✓	✓	—	—	—	—	—	—
platform.query-schedules.manage	✓	✓	—	—	—	—	—	—
platform.query-schedules.use	✓	✓	✓	—	—	—	—	—
platform.quick-search-settings.read	✓	✓	✓	✓	—	—	—	—
platform.quick-search-settings.rebuild	✓	✓	—	—	—	—	—	—
platform.quick-search-settings.update	✓	✓	—	—	—	—	—	—
platform.quick-search.read	✓	✓	✓	✓	—	—	—	—
platform.record-views.create	✓	✓	✓	✓	—	—	—	—
platform.record-views.read	✓	✓	✓	✓	—	—	—	—
platform.reports.manage	✓	✓	—	—	—	—	—	—
platform.reports.read	✓	✓	✓	✓	—	—	—	—
platform.reports.share	✓	✓	✓	—	—	—	—	—
platform.reports.use	✓	✓	✓	—	—	—	—	—
platform.responsibilities.delegate-own	✓	✓	✓	—	—	—	—	—
platform.responsibilities.manage	✓	✓	—	—	—	—	—	—
platform.responsibilities.read	✓	✓	✓	✓	—	—	—	—
platform.saved-queries.manage	✓	✓	—	—	—	—	—	—
platform.saved-queries.read	✓	✓	✓	✓	—	—	—	—
platform.saved-queries.share	✓	✓	✓	—	—	—	—	—
platform.saved-queries.use	✓	✓	✓	—	—	—	—	—
platform.security-access.explain	✓	—	—	—	—	—	—	—
platform.security-access.manage	✓	—	—	—	—	—	—	—
platform.security-policies.manage	✓	—	—	—	—	—	—	—
platform.security-policies.read	✓	—	—	—	—	—	—	—
platform.security-roles.manage	✓	—	—	—	—	—	—	—
platform.security-roles.read	✓	—	—	—	—	—	—	—
platform.security-self.read	—	—	—	—	—	—	—	—
platform.snapshots.read	✓	✓	✓	✓	—	—	—	—
platform.staff-access.manage	✓	—	—	—	—	—	—	—
platform.staff-access.read	✓	—	—	—	—	—	—	—
platform.tenant-applications.read	✓	✓	✓	✓	—	—	—	—
platform.tenants.bulk	✓	✓	—	—	—	—	—	—
platform.tenants.deletion-cancel	—	—	—	—	—	—	—	✓
platform.tenants.deletion-hold	—	—	—	—	—	✓	—	✓
platform.tenants.deletion-read	—	—	—	—	—	✓	✓	✓
platform.tenants.deletion-request	—	—	—	—	—	—	—	✓
platform.tenants.manage-commercial-link	—	—	—	—	—	—	—	✓
platform.tenants.manage-status	—	—	—	—	—	—	—	✓
platform.tenants.onboard	—	—	—	—	—	—	—	✓
platform.tenants.read	✓	✓	✓	✓	—	—	—	—
platform.tenants.update	✓	✓	—	—	—	—	—	—
platform.users.bulk	✓	✓	—	—	—	—	—	—
platform.users.change-password	✓	✓	✓	—	✓	—	—	—
platform.users.create	✓	✓	—	—	—	—	—	—
platform.users.delete	✓	✓	—	—	—	—	—	—
platform.users.manage-identities	✓	✓	—	—	—	—	—	—
platform.users.manage-passwords	✓	✓	—	—	—	—	—	—
platform.users.read	✓	✓	✓	✓	✓	—	—	—
platform.users.update	✓	✓	—	—	—	—	—	—
platform.workflow-actions.automation-manage	✓	✓	—	—	—	—	—	—
platform.workflow-actions.calendars-manage	✓	✓	—	—	—	—	—	—
platform.workflow-actions.registry-read	✓	✓	✓	✓	—	—	—	—
platform.workflow-actions.registry-register	✓	✓	—	—	—	—	—	—
platform.workflow-actions.runs-read	✓	✓	✓	✓	—	—	—	—
platform.workflow-actions.runs-resolve	✓	✓	—	—	—	—	—	—
platform.workflow-actions.templates-manage	✓	✓	—	—	—	—	—	—

Protected Actions

Access administration checks delegation at the target scopes and refuses self-widening or a change that removes the required administrator coverage. Customer operations cannot create platform staff authority. Inviting a Rhythm Administrator needs the additional role-management authority.

Customer entry for staff requires the appropriate approved, standing or emergency grant and its scope and duration. Reading captured AI content additionally requires live customer clearance and audit completion. Workspace removal, activation and recovery remain constrained by their lifecycle state and reviewed decision requirements. A permission does not bypass those guards.

Guards Distinguished From Permissions

Permissions admit an operation; guards determine whether the requested action is valid for the reached subject. Ownership, narrower record reach, current versions, lifecycle state, active staff clearance and delegation are guards. Dataset permissions are additional authority requirements, while workspace availability and application licensing are separate admission decisions. Platform and HQ are exempt from the application-access step.

The gateway uses a coarse cached admission result. Services evaluate the signed context and narrower restrictions for each request. Access changes can remain usable during the documented cache and context lifetimes; a successful flush request does not establish immediate eviction. The control findings preserve that limitation and the currently optional second factor for privileged sign-in.

What People See When Refused

Unusable identity produces an unauthorized response. A known caller refused at the gateway receives a forbidden response with a coarse access, workspace or permission cause and the required keys. That explanation exposes no other person’s identity or grants. Record handlers can present an inaccessible record as not found, while workspace and application gates can provide their own unavailability explanation.

The console can hide a destination or leave an action disabled with a reason. Its explanations distinguish access that has not loaded, an explicit deny, a missing grant and a scope mismatch. Where a grant is missing, the person is directed to their administrator. A presentation check never substitutes for service enforcement, and individual screen contracts retain their own refusal states.