Person-requested work uses current person access

Context

A request may execute after access changes. A shared definition must not supply authority to read its records.

Decision

Person-requested query work uses the requester or schedule owner context when executing, while maintenance, snapshots, indexing and staff validation retain their dedicated service or system contexts.

Alternatives Considered

Give background requests unrestricted service authority: That could expose records beyond the requester’s access.

Reuse grants captured at admission: A later access withdrawal would not affect queued work.

Consequences

Workers reconstruct the person context for the request they execute. Access loss can fail a file or pause a schedule. Sharing a definition does not grant access to its underlying records.