The Person Is Always the Signed Caller; Support Reads Need a Grant

Context

Personal inbox, administrative History and HQ support expose related records under different authority.

Decision

Personal actions use signed-caller identity, workspace History uses management authority and HQ customer lists require an active access grant.

Alternatives Considered

A selectable inbox owner adds an authorization check that personal routes can avoid entirely. Unrestricted HQ customer content would bypass the approved support-grant boundary.

Consequences

Personal reads treat another person’s notice as missing. Operator dead-letter and retry content lacks the History grant check and remains an open question. HQ notification keys currently belong to the administrator role pending broader support policy.