Rhythm 2.0 Specifications

Appearance

CAP-PFM-OPS-011Make a reasoned exception to application licensing

Markdown

CAP-PFM-OPS-011

Make a reasoned exception to application licensing

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-OPS-03
Exercised by
FAS-PFM-OPS-03-01, FAS-PFM-OPS-03-02, FAS-PFM-OPS-03-03, FAS-PFM-OPS-03-04, FAS-PFM-OPS-03-05
Key concepts
CON-PFM-OPS-003
Actors
ACT-PFM-004, ACT-PFM-006
Journeys
JNY-PFM-OPS-004
Depends on
CAP-PFM-OPS-015
Related
CAP-PFM-OPS-013, CAP-PFM-OPS-014, CAP-PFM-SEC-011, CAP-PFM-SEC-015
Proved by
ATS-PFM-OPS-011

Implementation

Executable suites
TST-PFM-OPS-081, TST-PFM-OPS-087, TST-PFM-OPS-090, TST-PFM-OPS-110

KindCapabilityProduct areaPlatformModuleOperational RecordsRevision1

Read atservices-platform ad3f6a65

Make a reasoned exception to application licensing ​

Purpose ​

Let Rhythm staff record justified application-access exceptions independently of contracts.

How It Works ​

Rhythm staff select an application and record a grant or withhold with its reason and effective period. The service validates the workspace and application before saving the decision. A first grant also attempts to prepare the application for that workspace. Existing operational states remain deliberate decisions and are not reset by another grant. Withdrawing an override records revocation rather than replacing its original meaning. Security history is attempted after the commercial decision commits. A failure between those steps can leave a decision without its expected history entry. A completed flow requests authorization-cache invalidation, whose asynchronous completion is separate from the response. Development seeding uses the same decision model while preserving earlier staff choices.

Relationships ​

Licence decisions feed availability alongside operational state; security applies the resulting access decision and the console explains it.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Trials and deliberate exceptions can be recorded independently of HubSpot terms.Staff can inspect the original decision and its revocation history until workspace purge.
Surfaces
consoleapi
Preconditions
The staff caller holds platform-level licensing-management authority.
Postconditions
The recorded override remains available as history until workspace purge and affects licensing only while effective.
Constraints
The workspace-type requirement for grant expiry is service validation rather than a database constraint.
Intent sources
services-platform:docs/proposals/application-access-and-entitlements.md#Status (built and accepted by Andrew, 2026-10-15)services-platform:docs/proposals/application-access-and-entitlements.md#10.2 Later (D6: staff use audited, time-bounded overrides; default taken)

Controls

34 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-DAT-005 TC-DAT-006 TC-IAM-001 TC-IAM-003 TC-IAM-006 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.licensing.manageapiglobal

Business Rules

10 rules, 10 to be proved before approval. A rule's product intent is derived from its origin: 10 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
An override identifies an existing workspace and active application, a grant or withhold effect, and a nonblank reason of no more than five hundred characters.
proved by ATS-PFM-OPS-011-01, TST-PFM-OPS-081
validationapi, service, databasetest
services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses an override with no reason, with 400 naming the field
02must prove
Confirmed
Customer-workspace grants require an expiry, other supported workspace types may receive open-ended grants, withholds need no expiry, and an expiry must follow its start.
✓ A demo workspace can receive an open-ended application grant.✗ A customer-workspace grant without expiry is refused before the decision is saved.
proved by ATS-PFM-OPS-011-02, TST-PFM-OPS-081
validationservicetest
services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a grant on a customer tenant that does not say when it ends, with 400
03must prove
Confirmed
An unrevoked override applies from its start instant up to but excluding its end instant, and expiration takes effect without a scheduled state change.
proved by ATS-PFM-OPS-011-03, ATS-PFM-OPS-011-17, ATS-PFM-OPS-012-14, TST-PFM-OPS-110
calculationservicetest
services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is not in force at the instant it ends, so a replacement starting there leaves no overlap
04must prove
Confirmed
Overrides are withdrawn by recording revocation author and time together, and a second withdrawal is refused rather than editing the decision.
proved by ATS-PFM-OPS-011-04, ATS-PFM-OPS-011-12, ATS-PFM-OPS-011-13, ATS-PFM-OPS-013-07, ATS-PFM-OPS-014-08, TST-PFM-OPS-081
lifecycleservice, databasetest
services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses to withdraw the same override twice, with 409
05must prove
Confirmed
A grant initializes an application only when the workspace has no operational record for it; existing states, withholds and revocations leave operational data intact.
origin: services-platform:docs/proposals/application-access-and-entitlements.md#10.2 Later (D5: provisioning on licence; default taken)
proved by ATS-PFM-OPS-011-05, ATS-PFM-OPS-015-09, TST-PFM-OPS-087
lifecycleservicetest
services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#leaves the operational row exactly as it was, because the licence does not decide the state
06must prove
Confirmed
Override and revocation flows commit their decisions before attempting a security-history entry with the original reason and widening direction, allowing a later audit failure to leave an unaudited decision.
proved by ATS-PFM-OPS-011-06, ATS-PFM-OPS-011-14, ATS-PFM-OPS-011-16, TST-PFM-OPS-087
policyserviceobserved
services-platform:modules/licensing/services/enablement/grant-licence-override.ts:grantLicenceOverride
07must prove
Confirmed
Completed staff decision flows request an authorizer flush after writing, while refusals request none and a failed flush start leaves committed decisions subject to cache expiry.
proved by ATS-PFM-OPS-011-07, ATS-PFM-OPS-011-15, TST-PFM-OPS-081
policyservicetest
services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#asks for none when the second revocation of the same override is refused, because nothing changed
08must prove
Confirmed
Override creation and withdrawal require staff licensing-management authority; read-only staff and customer administrators are refused without a decision write.
proved by ATS-PFM-OPS-011-08, TST-PFM-OPS-081
permissionapitest
services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#leaves the tenant with no override after that refusal
09must prove
Confirmed
Development seeding adds missing licensed-application grants for workspaces outside deletion but preserves any prior override decision, including revoked decisions, and repeated seeding adds nothing.
proved by ATS-PFM-OPS-011-09, TST-PFM-OPS-090
policyservicetest
services-platform:modules/licensing/tests/integration/services/enablement/seed-development-licences.revoked.integration.spec.js#writes no override on the second pass for the tenant whose grant was revoked
10must prove
Confirmed
Data export allowances permit one unrevoked record per customer or workspace scope, replace prior allowances by revocation with a reason, and fall back to the standard allowance when absent.
proved by ATS-PFM-OPS-011-10
invariantservice, databasetest
services-platform:modules/licensing/tests/integration/services/persistence/data-export-entitlements.integration.spec.js#revokes the scope’s earlier row when it is set again, so one is in effect

Scenarios

IdGivenWhenThenProvenance
01A workspace lacks contract coverage for an application.A licensing manager records a dated grant with an explanation.The grant is saved and missing application state is prepared; authorization invalidation is requested after successful completion.inferred
services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers the override and the application state it caused
02An enabled contracted application has an effective withhold.A manager withdraws the withhold.The decision is marked as a widening and contract coverage can again govern access.inferred
services-platform:modules/licensing/tests/integration/services/enablement/provision-tenant-application.integration.spec.js#records the revocation of a withhold as a widening, because it gives the application back

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software