Remember a person’s visits to records

Purpose

Retain attributed visits so people can return to their recent record work.

How It Works

A successfully displayed record screen begins a visit and reports it using a unique visit key. The backend resolves the record through the caller’s authorized query context before accepting the report. Attribution comes from the verified request rather than fields supplied by the browser. A delivery retry uses the same key, and the response indicates when that event already exists. Leaving the screen and returning starts another visit. Tab changes on the same screen retain the current visit. Reporting failures do not interrupt the person’s record work. Custom records use a separate server-side read hook whose visits are created even without a console report.

Relationships

Record owners establish the activity, and authorized queries use visits to support recent work without replacing raw history.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Accepted delivery repeats retain one visit event.The visit can feed personal recent-work queries without exposing reporting errors.
Surfaces: consoleapi
Preconditions: The caller holds view-reporting authority, which built-in reading roles include.
Postconditions: Accepted repeat deliveries share one event and rejected reports leave no new event.
Constraints: Accepted first and repeated reports both return success, distinguished by the duplicate indicator.
Intent sources: services-platform:docs/audit-events.md#2026-10-12 — Final acceptance (accepted by Andrew)services-platform:docs/audit-events.md#What an event means, and what it does not (Andrew, 2026-10-10)

Controls

29 controls apply, from the corpus control catalogue.

TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`platform.record-views.create`	api	tenant
`crm.contacts.read`	service	tenant
`crm.organizations.read`	service	tenant
`committees.committees.read`	service	tenant

Business Rules

10 rules, 10 to be proved before approval. A rule's product intent is derived from its origin: 10 confirmed by a product decision, the rest inheriting this capability's confirmed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Confirmed	The view-reporting registry accepts contacts, organizations and committees and rejects unsupported record types with the supported vocabulary. origin: services-platform:docs/audit-events.md#Which record types report views proved by `ATS-PFM-OPS-008-01`, `TST-PFM-OPS-060`	validation	service	test services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#refuses a record type the registry does not hold, naming the types it does
`02`must prove Confirmed	View reporting resolves the target under the caller’s record-read and dataset-query authority before writing; refused or missing targets create no event. ✓ A request satisfying the stated conditions receives the permitted result.✗ A request outside the allowed conditions cannot establish the claimed result. origin: services-platform:docs/audit-events.md#2026-10-12 — Final acceptance proved by `ATS-PFM-OPS-008-02`, `TST-PFM-OPS-060`	permission	api, service	test services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#writes nothing at all for any of those refusals
`03`must prove Confirmed	Organization views require organization readership rather than contact readership. proved by `ATS-PFM-OPS-008-03`, `TST-PFM-OPS-060`	permission	service	test services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#refuses an organization when the caller holds only contact read, because opening one needs organization read
`04`must prove Confirmed	The server derives attribution and event identity from verified execution context and refuses request bodies that supply those values or undeclared fields. proved by `ATS-PFM-OPS-008-04`, `ATS-PFM-OPS-008-13`, `ATS-PFM-OPS-010-10`, `TST-PFM-OPS-062`	validation	api	test services-platform:modules/audit/tests/unit/aws/api/audit-api-mapper.spec.ts#refuses a body naming the actor, which is how a trail would be written in somebody else’s name
`05`must prove Confirmed	A repeat visit key for the same record returns the original event as a duplicate, while reuse for another record is refused and a fresh visit needs a fresh key. proved by `ATS-PFM-OPS-008-05`, `ATS-PFM-OPS-008-12`, `TST-PFM-OPS-060`	invariant	service, database	test services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#reports the retry as a duplicate rather than refusing it, because the client has nothing to fix
`06`must prove Confirmed	Visit keys use UUID form, are normalized to lower case and are unique within a person’s workspace history. proved by `ATS-PFM-OPS-008-06`, `TST-PFM-OPS-058`	validation	service, database	test services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#lower-cases the occurrence key, so one visit cannot become two by changing its case
`07`must prove Confirmed	View metadata admits only short application and screen tokens and stores no record name, image or content. proved by `ATS-PFM-OPS-008-07`, `TST-PFM-OPS-058`	validation	service, database	test services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#refuses a metadata value outside the token grammar, naming the key
`08`must prove Confirmed	Console tracking records one visit after a successfully displayed record navigation; tab changes retain that visit, returning or reloading creates another, and unresolved screens report nothing. proved by `ATS-PFM-OPS-008-08`, `TST-PFM-OPS-048`	policy	console	test react-console:e2e/controlled/record-views.controlled.spec.ts#switching tab on the same record is still one visit
`09`must prove Confirmed	View-reporting errors remain invisible to the person; retryable transport, throttle and server failures reuse the visit key, while client refusals are not retried. proved by `ATS-PFM-OPS-008-09`, `TST-PFM-OPS-048`	policy	console	test react-console:e2e/controlled/record-views.controlled.spec.ts#a failure to report a visit never reaches the person, and the retries are one visit
`10`must prove Confirmed	The custom-record read endpoint records a server-attributed view with a newly generated key rather than relying on console reporting. proved by `ATS-PFM-OPS-008-10`	policy	service	observed services-platform:modules/custom-objects/aws/api/custom-object-records.routes.ts:recordViewEvent

Scenarios

Id	Given	When	Then	Provenance
`01`	A reader navigates to a successfully loaded contact.	Contact 360 reports the navigation visit.	The visit is retained and can feed the person’s Recent Items query.	inferred react-console:e2e/controlled/record-views.controlled.spec.ts#reports one visit per navigation, and the header lists the records newest first
`02`	The caller can read contacts but lacks organization readership.	The caller reports a visit to an organization.	The reporting operation refuses it and leaves the trail unchanged.	inferred services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#refuses an organization when the caller holds only contact read, because opening one needs organization read

Edge Cases

Id	Given	When	Then	Provenance
`03`	A visit key already identifies another record.	A client reuses that key for a new record report.	The server asks for a fresh visit key and preserves the original event.	inferred services-platform:modules/audit/tests/integration/services/record-views/record-view.integration.spec.js#tells the client to mint a new key for each visit

Planning

Implementation

Remember a person’s visits to records ​

Purpose ​

How It Works ​

Relationships ​