Understand the workspace’s application availability

Purpose

Administrators inspect a read-only overview of which applications the workspace can use.

How It Works

An administrator opens the Applications overview from Configuration or a blocked page. The overview reads the workspace’s availability answer from Platform. It uses plain labels and explanations without exposing the staff licensing record. Available entries may lead to their configuration area. Loading, empty and failure states keep the overview usable when no list is ready. The product should make incomplete availability answers fail closed and prove that behavior before relying on the overview.

Relationships

Operations owns the availability calculation and licensing records.
The workspace applications route enforces the administrator’s read authority.
Application unavailability links here for further explanation.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Workspace availability is explained independently of personal menu access.The overview supplies recovery actions for loading problems.
Surfaces: consoleapi
Intent sources: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration (built and accepted by Andrew 2026-10-15)services-platform:docs/proposals/application-access-and-entitlements.md#7.2 Tenant administrators: why an application is unavailable (built and accepted by Andrew 2026-10-15)

Controls

28 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-DAT-001 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`configuration.applications.view`	console	tenant
`platform.tenant-applications.read`	api	tenant

Business Rules

14 rules, 12 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Proposed	Configuration’s home hosts the Applications overview behind its console view key, mapped to the workspace-applications read authority. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 6 (built and accepted by Andrew 2026-10-15) no proof recorded yet	permission	console	observed react-console:components/configuration/applications/tenant-applications.tsx:TenantApplications; lib/authz/backend-aliases.ts:BACKEND_ALIASES
`02`must prove Proposed	The overview displays the returned applications with available entries first and name ordering within each group. no proof recorded yet	calculation	console	test react-console:lib/applications/availability.test.ts#lists the available applications first, then by name
`03`must prove Proposed	Availability badges and explanations use readable wording, converting recognized service reason codes rather than displaying those codes. origin: services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 6 (built and accepted by Andrew 2026-10-15) no proof recorded yet	calculation	console	test react-console:lib/applications/availability.test.ts#turns Platform's reason code into English and never shows the code
`04`must prove Proposed	An ordinary working application needs no explanation, while an ending licence is described without changing its Available badge. no proof recorded yet	calculation	console	test react-console:lib/applications/availability.test.ts#tells somebody a licence is ending without calling the application unavailable
`05`must prove Proposed	Licence dates are presented as the supplied calendar day across reader time zones. no proof recorded yet	calculation	console	test react-console:lib/applications/availability.test.ts#reads a licence date as the day Platform sent it, in a zone behind UTC
`06` Proposed	Open Configuration appears only for an available application with a configuration destination.	policy	console	observed react-console:components/configuration/applications/applications-page.tsx:ApplicationRow
`07` Proposed	The overview identifies itself as read-only and says Rhythm controls application changes.	policy	console	observed react-console:components/configuration/applications/applications-page.tsx:ApplicationsPage
`08`must prove Proposed	The body displays loading, retry after a failed initial read, and a contact-Rhythm empty state for no applications. no proof recorded yet	lifecycle	console	observed react-console:components/configuration/applications/applications-page.tsx:ApplicationsBody
`09`must prove Proposed	Parsing drops entries without a readable key and maps unknown licence and operational states to unlicensed and not set up. no proof recorded yet	validation	console	test react-console:lib/applications/availability.test.ts#takes the records it understands and leaves out the ones it does not; lib/applications/availability.test.ts#treats a state it cannot read as no licence and an operation it cannot read as never set up
`10`must prove Proposed	All Applications is the first Configuration application link when the person holds its view permission. no proof recorded yet	permission	console	observed react-console:components/console/nav-config.ts:configurationArea
`11`must prove Proposed	Parsing defaults availability to true for any value other than exactly false, including a missing flag and unreadable companion states. no proof recorded yet	calculation	console	observed react-console:lib/applications/types.ts:parseTenantApplication
`12`must prove Proposed	The administrator list checks workspace reach itself, returns not found outside that reach and can answer for a disabled workspace within reach. no proof recorded yet	permission	api	observed services-platform:modules/tenants/aws/api/tenant-applications.routes.ts:tenantApplicationsRoutes
`13`must prove Proposed	The administrator answer includes application identity, licence dates, operational state and availability, collapses licence state to licensed or unlicensed, translates withholding to unlicensed and omits overrides, staff identities and operational reasons. no proof recorded yet	calculation	service	observed services-platform:modules/licensing/aws/api/licensing-api-mapper.ts:toTenantApplications, tenantLicenceStateOf, tenantReasonOf
`14`must prove Proposed	The administrator application API serves a permitted console caller, refuses a caller lacking its read key as forbidden and refuses an anonymous caller as unauthenticated. no proof recorded yet	permission	api	test services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#serves an administrator of the customer holding platform.tenant-applications.read; modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a console user who does not hold that key, with 403; modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses an anonymous caller with 401

Scenarios

Id	Given	When	Then	Provenance
`01`	An application is available and its licence has a finite end day.	The administrator reads the overview.	The entry remains Available and explains its ending date.	test react-console:lib/applications/availability.test.ts#tells somebody a licence is ending without calling the application unavailable
`02`	The initial workspace applications request fails.	The overview renders the result.	The failure state offers a retry.	observed react-console:components/configuration/applications/applications-page.tsx:ApplicationsBody

Planning

Understand the workspace’s application availability ​

Purpose ​

How It Works ​

Relationships ​