Apply the workspace and person’s application access

Purpose

The console translates Security’s application and permission answer into visible working surfaces.

How It Works

The console receives an application and permission context from Security. A shared translator produces the authority used by navigation and page guards. Application domains and individual actions are evaluated separately. Custom-record grants also carry resource scope. The translator accepts the backend’s allowed keys as authoritative rather than reconstructing role evaluation. The product should retain tests for the alias boundary and scoped access as the catalogue grows.

Relationships

Security owns backend permission evaluation and the applications supplied in the context.
Navigation and page guards consume the translated answer.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Application availability and action authority remain separate.Unknown or restricted authority does not invent access.
Surfaces: console
Intent sources: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration (built and accepted by Andrew 2026-10-15)services-platform:docs/licensing.md#9. How a licence reaches the permission check (Andrew, 2026-10-14)

Controls

24 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-MON-003 TC-PI-001 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`platform.security-self.read`	api	tenant
`platform.application.access`	api	tenant
`crm.application.access`	api	tenant
`console.access`	console	tenant
`console.system`	console	tenant

Business Rules

11 rules, 10 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	Only applications listed in the security context enable their mapped console domains, for staff and customer users alike. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, items 1 and 3 (built and accepted by Andrew 2026-10-15) no proof recorded yet	policy	console	test react-console:lib/security-context/entitlements.test.ts#enables only the domains of the applications the context lists
`02`must prove Proposed	Platform enables Configuration, Security, Maintenance, Tools and Eligibility; its Accounting, Commerce and Events keys map to their console names, and Publications, Advertising or Subscriptions can enable Publications. no proof recorded yet	calculation	console	test react-console:lib/security-context/entitlements.test.ts#lets any of several applications switch a shared domain on
`03`must prove Proposed	A staff wildcard permission grant cannot enable a domain absent from the listed applications. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 3 (built and accepted by Andrew 2026-10-15) no proof recorded yet	permission	console	test react-console:lib/security-context/entitlements.test.ts#gives a staff wildcard no domain the applications did not give
`04`must prove Proposed	Allowed backend permissions grant their mapped console keys, including multiple console keys for one backend permission. no proof recorded yet	calculation	console	test react-console:lib/authz/__tests__/authz.test.ts#maps aliases onto registry keys
`05`must prove Proposed	A console domain with no backend aliases receives its item keys while enabled unless denied, and adding any alias makes its mapped authority decisive. no proof recorded yet	calculation	console	test react-console:lib/security-context/entitlements.test.ts#grants a keyless domain's item keys when its application is enabled
`06`must prove Proposed	At least one listed application supplies console access, staff identity supplies console system access, and an enabled domain supplies its domain access key subject to explicit denial. no proof recorded yet	calculation	console	observed react-console:lib/security-context/entitlements.ts:allowedConsoleKeys
`07`must prove Proposed	In normalized console checks, explicit denies override grants, prefix wildcards cover descendant permissions and keys without covering authority fail. no proof recorded yet	calculation	console	test react-console:lib/authz/__tests__/authz.test.ts#grants exact keys and prefix wildcards, and denies win
`08`must prove Proposed	A permission request with unknown entitlements is refused. no proof recorded yet	invariant	console	test react-console:lib/console/application-guard.test.ts#refuses a page that asks for something when there are no entitlements at all
`09` Proposed	Feature values are copied from the context and do not independently enable application domains. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 5 (built and accepted by Andrew 2026-10-15)	policy	console	test react-console:lib/security-context/entitlements.test.ts#reads features from the context rather than granting them all
`10`must prove Proposed	A scoped permission reveals its surface when no record is checked, permits only its named records when scope is checked, and does not narrow an existing workspace-wide grant. no proof recorded yet	permission	console	test react-console:lib/security-context/entitlements.test.ts#holds the key on that object and nowhere else
`11`must prove Proposed	While deriving console permissions, a backend allowed key takes precedence over a contradictory stale deny rule and is not added to the derived denied set. no proof recorded yet	calculation	console	test react-console:lib/authz/__tests__/backend-aliases.test.ts#lets allowed win over a stale deny rule, because allowed is the authority

Scenarios

Id	Given	When	Then	Provenance
`01`	A staff wildcard grant accompanies a context listing only CRM.	The console derives its application domains.	CRM is enabled and other unlisted applications remain disabled.	test react-console:lib/security-context/entitlements.test.ts#gives a staff wildcard no domain the applications did not give
`02`	An enabled domain has no backend aliases but one item is explicitly denied.	Console permissions are derived.	The domain’s other keys are granted while the denied item remains refused.	test react-console:lib/security-context/entitlements.test.ts#lets a deny rule take one keyless key away

Planning

Apply the workspace and person’s application access ​

Purpose ​

How It Works ​

Relationships ​