Refresh application choices when access changes

Purpose

The console updates application navigation when its current access answer becomes stale.

How It Works

A working tab can outlive a change made elsewhere. The shared refusal reporter detects application-related refusals and prompts the access provider. Tab focus also provides an opportunity to refresh an old answer. Refresh updates only the application portion of the context. A failed request leaves the person’s current answer in place. The product should test overlapping refreshes and workspace changes with controlled timing.

Relationships

Security supplies the applications refresh operation.
Application navigation responds when the context’s application list changes.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Recognized application refusals trigger an updated answer.Failed or outdated refreshes do not replace the current workspace context.
Surfaces: console
Intent sources: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration (built and accepted by Andrew 2026-10-15)services-platform:docs/proposals/application-access-and-entitlements.md#7.1 The person's applications (built and accepted by Andrew 2026-10-15)

Controls

19 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-LOG-004 TC-LOG-005 TC-MON-002 TC-PI-001 TC-PI-003 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`platform.security-self.read`	api	tenant

Business Rules

7 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	A forbidden request naming lost application permission or licensing prompts an application refresh and notifies each registered refusal listener once. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 4 (built and accepted by Andrew 2026-10-15) no proof recorded yet	lifecycle	console	test react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone
`02`must prove Proposed	Other refusal statuses or codes do not notify application-refresh listeners. no proof recorded yet	validation	console	test react-console:lib/security-context/application-refusal.test.ts#leaves every other refusal alone
`03`must prove Proposed	A visible tab regaining focus or visibility requests applications after at least five minutes since the last recorded read. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 4 (built and accepted by Andrew 2026-10-15) no proof recorded yet	lifecycle	console	observed react-console:lib/security-context/provider.tsx:SecurityContextProvider
`04`must prove Proposed	Application refresh replaces applications and features while retaining roles, permission rules and reachable workspaces. origin: services-platform:docs/proposals/application-access-and-entitlements.md#7.1 The person's applications (built and accepted by Andrew 2026-10-15) no proof recorded yet	invariant	console	observed react-console:lib/security-context/provider.tsx:refreshApplications
`05`must prove Proposed	Concurrent refresh calls reuse one request, and failures leave the existing application list without a separate error screen. no proof recorded yet	lifecycle	console	observed react-console:lib/security-context/provider.tsx:refreshApplications
`06`must prove Proposed	A refresh response is discarded when a workspace change supersedes the request. no proof recorded yet	invariant	console	observed react-console:lib/security-context/provider.tsx:refreshApplications
`07` Proposed	A context without a selected workspace performs no application refresh.	policy	console	observed react-console:lib/security-context/provider.tsx:refreshApplications

Scenarios

Id	Given	When	Then	Provenance
`01`	CRM is offered but a request is refused for lost application access.	The refusal triggers a refresh.	CRM leaves navigation while other offered applications remain.	test react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone
`02`	An application refresh is pending for the old workspace.	The person enters another workspace before that answer arrives.	The old result does not replace the new workspace’s application choices.	observed react-console:lib/security-context/provider.tsx:SecurityContextProvider

Planning

Refresh application choices when access changes ​

Purpose ​

How It Works ​

Relationships ​