Skip to content

CAP-PFM-QRY-018Request a portable workspace data package

Markdown

CAP-PFM-QRY-018

Request a portable workspace data package

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationPartially observed

KindCapabilityProduct areaPlatformModuleQuestions, record exploration and data deliveryRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
The planned package supports data portability.Dedicated export permissions protect broad extraction.Execution and destination widening remain accountable.
Surfaces
consoleapi
Intent sources
services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-03services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-05services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-11services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-14services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#1. Decisions (all fifteen decided by Andrew on 2026-10-18)

Controls

33 controls apply, from the corpus control catalogue.

TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-DAT-005 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.data-exports.readapitenant
platform.data-exports.manageapitenant
platform.data-exports.executeapitenant
platform.data-exports.downloadapitenant
hq.data-exports.readapiglobal
hq.data-exports.operateapiglobal

Business Rules

13 rules, 13 to be proved before approval. A rule's product intent is derived from its origin: 13 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Data-export read, manage, execute and download are sensitive administrator permissions excluded from generated policies and granted by the dedicated exporter policy to Administrators rather than Power Users.
permissionapitest
02must prove
Confirmed
Every export route requires its specific permission independently of the other export permissions and administrator tier.
permissionapitest
services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#is refused the download route when it holds the other three keys and the administrator tier
03must prove
Confirmed
Export settings creation and execution admission require a live workspace that is not a sandbox.
policyservicetest
services-platform:modules/data-exports/tests/integration/services/persistence/definitions.integration.spec.js#refuses a sandbox as TenantNotEligible, though it is live, because its data is its parent’s
04must prove
Confirmed
A workspace holds one version-controlled export definition with retention of one to thirty days and at most twenty additional notification users.
validationservice, databasetest
05must prove
Confirmed
Destinations are limited to five distinct connections with connection-relative paths; adding or enabling one records access widening, and removing one retires its binding.
validationservicetest
06must prove
Confirmed
Admission queues an export at request time with copied settings, marks allowance consumption except for staff runs, rejects suspended definitions and allows only one queued or running execution per workspace.
policyservice, databasetest
07must prove
Confirmed
Execution admission records an access-widening export event in the same transaction.
invariantservicetest
services-platform:modules/data-exports/tests/integration/services/persistence/executions.integration.spec.js#records the data export event: execute, widening, in its own transaction
08must prove
Confirmed
Package generation and delivery completion are unfinished; download, cancellation, early artifact deletion and delivery retry return not implemented, and a manifest is missing before a package exists.
lifecycleapitest
services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#is answered 409 not_implemented for a download, until the generation job
09must prove
Confirmed
Rhythm staff cannot use customer-console export routes, while HQ export reads require the staff permission, span workspaces and reject customer administrators.
permissionapitest
services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#is refused every console route, whatever it holds at platform scope (rule S1)
10must prove
Confirmed
Coverage reconciliation adds declarations at a new coverage version, reports unchanged-version shape conflicts without replacing them, and retires or restores declarations as releases remove or reintroduce them.
lifecycleservicetest
services-platform:modules/data-exports/tests/integration/services/export-coverage/reconcile-coverage.integration.spec.js#refuses a shape changed under an unchanged version, logged at error and counted, leaving the registry as it was
11must prove
Confirmed
An execution from another workspace is reported as missing.
permissionservicetest
services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#answers another tenant’s execution 404, as one that does not exist
12must prove
Confirmed
The product should require a sign-in within fifteen minutes for package downloads and destination changes.
policyapidocumented
services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-11. Elevated authentication for download and destination changes: a recent-authentication check in release 1
13must prove
Confirmed
The product should apply export allowances per workspace, with workspace-specific or customer-wide overrides.
calculationservicedocumented
services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-14. Where the allowance attaches (blocks WP-5) — decided: per tenant

Scenarios

IdGivenWhenThenProvenance
01A user holds the built-in Power User role.They request data-export operations.Those routes refuse the user’s default permissions.test

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.