Application Gating Precedes Page Permissions

Context

Availability and personal permission answer different access questions. Security and Operations provide the inputs rather than leaving the console to infer licensing.

Decision

Use the context application list to enable domains and explain a missing application before evaluating page permission. Wildcard permissions alone add no domain.

Alternatives Considered

Permission-derived licensing could mislabel unavailable work as a personal refusal. Staff wildcards that exposed every application would ignore workspace availability.

Consequences

The refusal presentation distinguishes application access from page permission, although current copy can overstate the organization-level reason. Keyless applications use Platform’s special rule. Other destinations still need their own guards.