Explain workspace licensing to Rhythm staff

Purpose

Give Rhythm staff enough licensing context to investigate and explain application access.

How It Works

Rhythm staff inspect Licensing & Applications on the workspace’s HQ page. Readers can see the states and decisions behind access, including historical overrides. The panel resolves authors into names and folds past decisions out of the initial view. Managers receive actions for commercial decisions and operational changes. Dialogs require a substantive explanation before submission. The revoke dialog asks for an explanation the receiving route does not store. Failed application setup also has a retry action, but its address does not match the served route. Company contract inspection and sync health remain API-only, leaving staff without a complete HQ commercial-monitoring surface.

Relationships

Licence decisions feed availability alongside operational state; security applies the resulting access decision and the console explains it.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Staff can inspect the decisions behind workspace application availability.Management controls depend on separate staff authority.
Surfaces: consoleapi
Preconditions: The staff caller holds HQ licensing-read authority.
Postconditions: Licensing inspection does not alter the decision or operational records.
Constraints: The licensing section appears within the workspace’s HQ page owned by security.
Intent sources: services-platform:docs/proposals/application-access-and-entitlements.md#Status (HQ licensing panel accepted by Andrew, 2026-10-15)

Controls

27 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-003 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-004 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`hq.licensing.read`	api	global
`hq.licensing.manage`	console	global

Business Rules

8 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 8 confirmed by a product decision, the rest inheriting this capability's confirmed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Confirmed	HQ licensing readership exposes each application’s commercial, operational and availability states with current and historical override reasons and authors, while unauthorized staff and customer callers are refused. proved by `ATS-PFM-OPS-013-01`, `ATS-PFM-OPS-013-08`, `ATS-PFM-OPS-013-09`, `TST-PFM-OPS-081`	permission	api	test services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers the overrides behind the decision, with the reason and the author of each
`02`must prove Confirmed	Revoked overrides remain in the staff licensing response as part of the decision history. proved by `ATS-PFM-OPS-011-12`, `ATS-PFM-OPS-013-02`, `ATS-PFM-OPS-013-07`, `TST-PFM-OPS-081`	policy	api	test services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#keeps a revoked override in the answer, because the trail is what the screen is for
`03`must prove Confirmed	The staff response distinguishes withheld access from missing licensing and contract-derived licences from override-derived licences. proved by `ATS-PFM-OPS-013-03`, `ATS-PFM-OPS-016-04`, `TST-PFM-OPS-081`	policy	api	test services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#tells staff the same application was withheld, which is the distinction the two answers keep
`04`must prove Confirmed	The HQ panel resolves author names, collapses historical overrides and limits licensing actions to staff with management authority. proved by `ATS-PFM-OPS-013-04`	permission	console	test react-console:e2e/dev/hq-licensing.dev.spec.ts#the panel lists the Fictional Association's applications, names every author and folds the past overrides away
`05`must prove Confirmed	Panel actions require a reason of at least twenty characters, and a grant for a customer workspace also requires an end date. proved by `ATS-PFM-OPS-013-05`, `TST-PFM-OPS-053`	validation	console	test react-console:e2e/mock/application-access.mock.spec.ts#asks for a reason long enough to be one
`06` Confirmed	The revoke dialog collects a reason that the backend route neither accepts nor retains, leaving the original override reason in history.	policy	console	observed react-console:components/console/hq/tenant-licensing-card.tsx (Reason for Revoking); services-platform:modules/licensing/aws/api/licensing.routes.ts:revokeTenantLicenceOverride (no body)
`07`must prove Confirmed	The product should restore the failed-application retry action; its console address differs from the served route and therefore cannot invoke that operation. proved by `ATS-PFM-OPS-013-06`	policy	console	observed react-console:lib/hq/licensing.ts:licensingPaths.application ("retry-provisioning"); services-platform:modules/licensing/aws/api/licensing.routes.ts:retryTenantApplicationProvisioning ("retry_provisioning")
`08` Confirmed	Company contract and sync-health reads exist for staff but have no corresponding HQ interface.	policy	console	observed react-console:lib/hq/licensing.ts (no company or sync health read)

Scenarios

Id	Given	When	Then	Provenance
`01`	The workspace has current and historical override records.	A Rhythm administrator opens its licensing panel.	Applications use readable states and author names, with past decisions collapsed.	inferred react-console:e2e/dev/hq-licensing.dev.spec.ts#the panel lists the Fictional Association's applications, names every author and folds the past overrides away
`02`	An HQ staff reader lacks licensing-management authority.	The reader inspects the workspace licensing panel.	The information remains readable without management actions.	observed react-console:components/console/hq/tenant-licensing-card.tsx:ApplicationRow (canManage)

Planning

Implementation

Explain workspace licensing to Rhythm staff ​

Purpose ​

How It Works ​

Relationships ​