Resolve a workspace’s application availability

Purpose

Combine licensing and operational readiness into a consistent application-access decision.

How It Works

The resolver gathers registered applications, the workspace’s overrides, company licence windows and operational records. It evaluates them for the execution’s current day and instant. An explicit withhold wins even for an otherwise always-available application. Current or grace contract coverage explains the licence before a grant is used as a fallback. Licensed applications then need an enabled operational state. Always-available applications preserve their reported operational state but bypass that readiness requirement. Unavailable results carry one explanatory reason. Authorization and application lists consume the availability decision, while personal application permission remains a separate concern.

Relationships

Licence decisions feed availability alongside operational state; security applies the resulting access decision and the console explains it.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: Application lists and authorization have a shared commercial and operational basis.Always-available exceptions and ordinary readiness checks remain explicit.
Surfaces: api
Postconditions: Availability is resolved for the execution’s day and instant without storing a separate verdict.
Constraints: The pure availability resolver and the authorization query are separate implementations that must agree.
Intent sources: services-platform:docs/proposals/application-access-and-entitlements.md#Status (built and accepted, 2026-10-15)services-platform:docs/proposals/application-access-and-entitlements.md#10.1 (D3, D10, D11)services-platform:docs/licensing.md#2. What this does NOT do (Andrew, 2026-10-13: "enforce everywhere")

Controls

23 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-DAT-001 TC-DAT-003 TC-DAT-004 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-003 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Business Rules

10 rules, 7 to be proved before approval. A rule's product intent is derived from its origin: 10 confirmed by a product decision, the rest inheriting this capability's confirmed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Confirmed	Workspace availability includes always-available applications and licensed applications whose operational state is enabled. origin: services-platform:docs/proposals/application-access-and-entitlements.md#3.2 proved by `ATS-PFM-OPS-012-15`, `ATS-PFM-OPS-014-01`, `ATS-PFM-OPS-014-09`, `ATS-PFM-OPS-014-10`, `ATS-PFM-OPS-014-14`, `ATS-PFM-OPS-015-10`, `TST-PFM-OPS-110`	calculation	service, database	test services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers the available ones, and only those, from the same resolution
`02`must prove Confirmed	Licence source resolution checks withhold, always-available status, current contract, grace contract, grant and expired contract in that order, regardless of decision recency. proved by `ATS-PFM-OPS-011-13`, `ATS-PFM-OPS-014-02`, `ATS-PFM-OPS-014-08`, `TST-PFM-OPS-110`	calculation	service, database	observed services-platform:modules/licensing/services/availability/application-availability.ts:licenceStateOf
`03`must prove Confirmed	Contract terms include their last calendar day, remain licensed throughout grace and become expired afterwards, while future terms provide no current licence. origin: services-platform:docs/proposals/application-access-and-entitlements.md#D3 proved by `ATS-PFM-OPS-014-03`, `ATS-PFM-OPS-014-13`, `TST-PFM-OPS-110`	calculation	service	test services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers expired the day after the grace ends, which is when a licence really runs out
`04`must prove Confirmed	A current term outranks grace or expired terms, and a grant can supply access after all contract coverage and grace have ended. proved by `ATS-PFM-OPS-014-04`, `TST-PFM-OPS-110`	calculation	service	test services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#falls back to a grant override once the contract has expired, which is a goodwill extension
`05`must prove Confirmed	Platform and Contacts & Organizations bypass operational readiness but remain subject to explicit withholds, while Rhythm HQ is available by rule outside workspace application records. origin: services-platform:docs/proposals/application-access-and-entitlements.md#10.1 Decided by Andrew on 2026-10-11 (D10, D11, 2026-10-12) proved by `ATS-PFM-OPS-014-05`, `ATS-PFM-OPS-014-15`, `TST-PFM-OPS-110`	policy	service	test services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#lets a withhold beat always_available, which is the only way to take one of those away
`06`must prove Confirmed	An unavailable application reports one commercial or operational refusal reason, covering absent licence, withhold, expiry, missing setup, setup in progress, failed setup or suspension. proved by `ATS-PFM-OPS-014-06`, `TST-PFM-OPS-110`	calculation	service	test services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#gives each unavailable one the reason its own half of the rule refused by
`07` Confirmed	A workspace without a HubSpot company resolves licensing solely from overrides and always-available status.	calculation	service	test services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers the same for a tenant with no licence windows as for one whose windows were not asked for
`08` Confirmed	The availability decision supplies authorization and application-list inputs in every environment, so unlicensed application requests are refused before the handler executes. origin: services-platform:docs/licensing.md#2. What this does NOT do (Andrew, 2026-10-13) proved by `ATS-PFM-OPS-014-11`, `ATS-PFM-OPS-014-12`	policy	service	documented services-platform:docs/licensing.md#9. How a licence reaches the permission check
`09`must prove Confirmed	The catalog retains the retired commercial application key while product mappings grant Accounting & Billing under its replacement key. origin: services-platform:docs/licensing.md#1. The rule (Andrew, 2026-10-13: accounting is the key, collect retired) proved by `ATS-PFM-OPS-014-07`, `TST-PFM-OPS-112`	lifecycle	service, database	test services-platform:modules/licensing/tests/unit/catalog/product-grants.spec.ts#grant `accounting` and never the retired `collect`, which is the rename of 2026-10-13
`10` Confirmed	Websites and Marketing have no mapped commercial product grants, so their production licensing currently depends on explicit overrides. origin: services-platform:docs/licensing.md#1. The rule (Andrew, 2026-10-20: Marketing key, no product yet)	policy	service	documented services-platform:docs/licensing.md#1. The rule

Scenarios

Id	Given	When	Then	Provenance
`01`	An enabled application’s contract ended four days earlier.	Availability is resolved for the workspace day.	The application remains in grace; a date beyond grace produces expiry.	inferred services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#answers in_grace the day after the window ends, which is still available (D3)
`02`	An always-available application has failed preparation.	Availability is resolved.	The failure state remains reported without making the application unavailable.	inferred services-platform:modules/licensing/tests/unit/availability/application-availability.spec.ts#is available while its own provisioning is still failed, and reports that state all the same

Planning

Implementation

Resolve a workspace’s application availability ​

Purpose ​

How It Works ​

Relationships ​