Findings and Open Questions: Platform → Security, Workspaces and Customers
Findings
| id | severity | statement | affects | evidence | kind |
|---|---|---|---|---|---|
FND-PFM-SEC-001 | medium | The central registry’s console scope includes outdated or misplaced paths and omits relevant Security, sign-in and HQ records. The module charter now describes the actual registered-source interpretation, but the central registry row remains unchanged under this job’s edit boundary. | MOD-PFM-SEC | Structured evidence | inconsistency |
FND-PFM-SEC-002 | medium | The milestone index supplies no dedicated security, workspace or customer milestone. Detailed intent therefore needs the cited approved plans, dated decisions, guided acceptance checkpoints or standards; observed code cannot establish product approval. The milestone-status standard remains a separate source of maturity guidance. | MOD-PFM-SEC | Structured evidence | undocumented |
FND-PFM-SEC-003 | medium | Customer deletion checks workspace references and record locks. The accepted HQ plan additionally requires membership and custom-definition dependency checks, typed customer-name confirmation, a reason and security audit. Those additional safeguards remain unimplemented. | CAP-PFM-SEC-001, Affected business rule | Structured evidence | defect |
FND-PFM-SEC-004 | medium | The record-write contract and current handlers differ on required versions and no-op writes. Missing replacement versions can surface as server faults, some patches compare a version read by the handler rather than one supplied by the client, and some HQ and definition edits accept no version. Current saves can advance version even without a field change. The product should reconcile these paths with the contract. | CAP-PFM-SEC-001, CAP-PFM-SEC-002, CAP-PFM-SEC-012, Affected business rule, Affected business rule, Affected business rule, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-005 | low | The selected catalog contains unused bulk-write, staff-update and HQ role-reading keys. Platform’s application-access key also supplies no application-access gate because Platform is exempt. Staff role management is evaluated when inviting another Rhythm Administrator rather than as a general role-edit route. The product should assign an operation or retire unused declarations. | CAP-PFM-SEC-001, CAP-PFM-SEC-002, CAP-PFM-SEC-009, CAP-PFM-SEC-016, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-006 | low | Six older operations remain reachable without a customer in their path: five membership lifecycle actions and the global permission-catalog read. Granted staff customer authority cannot use those legacy routes; customer-named replacements provide the intended scope. Their retirement remains debt. | CAP-PFM-SEC-008, CAP-PFM-SEC-009, CAP-PFM-SEC-012 | Structured evidence | debt |
FND-PFM-SEC-007 | low | Earlier HQ text describes generated references and a separate domain field, while the later readable-reference decision supersedes that model. Destructive confirmations also differ: retirement requests confirm the workspace name and reset confirms its reference. The product should align the old record and decide whether the two confirmations are intentional. | CAP-PFM-SEC-003, CAP-PFM-SEC-004, Affected business rule, Affected business rule, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-008 | medium | The automatic-assignment milestone remains proposed although reconciliation services, routes, scheduled work and password-sign-in integration exist. The role editor control is unfinished, development disables eligibility-conditioned permissions, and contact-versus-login ownership remains undecided. Implementation evidence does not settle those product choices. | CAP-PFM-SEC-014, Affected business rule, Affected business rule, Affected business rule, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-009 | low | The grant-slice decision record says disabled workspaces remain reachable through authorization, whereas the availability gate refuses ordinary workspace work while disabled. These are different enforcement layers. The code settles current availability, but the product still needs the deferred disabled-workspace decision. | CAP-PFM-SEC-002, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-010 | low | Authentication and authorization records carry inconsistent status language. Authentication’s final acceptance checkpoint supersedes its pending wording, while the administration text calls an authorization design approved whose own header still awaits review. Approval should be attributed to the particular recorded decision or checkpoint rather than these broad labels. | CAP-PFM-SEC-005, CAP-PFM-SEC-006, CAP-PFM-SEC-012 | Structured evidence | inconsistency |
FND-PFM-SEC-011 | low | Retirement recovery can restart scheduling or retry purge without a supplied version or a separate security audit event. The implementation settles that omission; the product should decide and add the recovery audit contract. | CAP-PFM-SEC-004, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-012 | medium | The gateway flush can succeed without evicting cached decisions. Stored revocation, deactivation and definition edits therefore differ from their effect on already authorized requests. The accepted staff-access bound permits roughly ninety seconds through combined cache and signed-context lifetimes; stronger immediate-cutoff promises remain unsupported. | CAP-PFM-SEC-015, CAP-PFM-SEC-009, CAP-PFM-SEC-017, Affected business rule, Affected business rule, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-013 | low | Public portal identity routes encounter availability checks before their handler-level neutral refusal. An unknown workspace can consequently differ from an available workspace without a portal. Security context also distinguishes unknown workspace references from reachable but forbidden ones under the documented isolation exception. | CAP-PFM-SEC-019, CAP-PFM-SEC-007, Affected business rule, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-014 | low | Principal management and workspace retirement requests have backend operations but no dedicated HQ console pages in the inspected scope. The product should decide the operator experience before presenting those workflows as complete screen-based administration. | CAP-PFM-SEC-018, CAP-PFM-SEC-004, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-015 | low | The HQ role plan limits Support’s retirement authority to reading, while the lifecycle plan and catalog reconciliation give Support hold and release authority. Code establishes the shipped definition, but the two product records need reconciliation. | CAP-PFM-SEC-013, CAP-PFM-SEC-016, CAP-PFM-SEC-004, Affected business rule, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-016 | medium | The implemented business go-live action does not require proof that initial import has completed. The persistence test explicitly treats that check as debt. The product should decide the required prerequisite before assuming handover is guarded. | CAP-PFM-SEC-002, CAP-PFM-SEC-003, Affected business rule, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-017 | low | The emergency-access plan names multi-factor authentication among safeguards and also records its phase-one deferral. Current emergency access does not require MFA. The product should keep the deferral visible and decide when the requirement becomes enforceable. | CAP-PFM-SEC-017, CAP-PFM-SEC-006, CAP-PFM-SEC-016, Affected business rule, Affected business rule, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-018 | low | Portal identity’s successful signup, recovery and resend handlers use the ordinary success status where the documented contract specifies created or accepted responses. The backend contract mismatch remains a proposed correction. | CAP-PFM-SEC-019, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-019 | medium | The inspected backend bindings do not provide complete route-specific proof of staff-role invitation restrictions or HQ suspend and revoke. Shared membership tests cover underlying services and mock browser tests exercise controls; neither should be represented as a complete HQ lifecycle acceptance test. | CAP-PFM-SEC-016, Affected business rule, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-020 | low | Deployed proof remains missing for ordinary uninvited Google entry and the gateway’s observable revocation window. Local tests and documentation establish parts of these mechanisms, including the founding-staff exception and flush execution, but do not measure those deployed outcomes. | CAP-PFM-SEC-005, CAP-PFM-SEC-015, Affected business rule, Affected business rule | Structured evidence | debt |
FND-PFM-SEC-021 | low | An HQ customer editor can change the customer’s commercial reference under customer-update authority. Workspace commercial moves require a separate staff permission because they influence licensed applications. The product should decide whether this difference in authority is intended. | CAP-PFM-SEC-001, CAP-PFM-SEC-002, Affected business rule, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-022 | medium | Some lifecycle defaults were adopted under a standing order and await individual review, including the shorter never-activated waiting period and removal of workspace-scoped security events. Their implementation is evidence of behavior rather than a confirming decision. The affected capability intent and origins now preserve that distinction. | CAP-PFM-SEC-004, CAP-PFM-SEC-011, Affected business rule, Affected business rule | Structured evidence | undocumented |
FND-PFM-SEC-023 | low | The original lifecycle plan lists five states; implementation also includes initial loading, added through the data-job plan. The later loading design explains the sixth state, but the earlier lifecycle summary remains inconsistent. | CAP-PFM-SEC-002, CAP-PFM-SEC-003, Affected business rule, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-024 | low | The security and lifecycle scopes both include workspace code, and data-job ownership also touches loading and reset. This layer assigns staff-facing requests here and participant execution to dependencies pending the ownership decision; overlapping source scope does not justify duplicate rule homes. | CAP-PFM-SEC-003, CAP-PFM-SEC-004 | Structured evidence | inconsistency |
FND-PFM-SEC-025 | low | Older records specify a three-hundred-second gateway cache, while the current authorizer and flush investigation establish sixty seconds. Specifications now use the current bound; the earlier records still require correction. | CAP-PFM-SEC-015, Affected business rule | Structured evidence | inconsistency |
FND-PFM-SEC-026 | low | No acceptance inventory for this module was identified in the registered scope. The attention inventory’s security-labelled journeys assess attention visibility and belong to that module; they do not seed security acceptance identifiers. | MOD-PFM-SEC | Structured evidence | undocumented |
FND-PFM-SEC-027 | low | The invitation lifecycle record retains older disabled-account terminology and an undecided return path. Current membership operations distinguish suspension, reinstatement and revocation, with reinvitation after removal. The old explanatory record needs to reflect that lifecycle. | CAP-PFM-SEC-009 | Structured evidence | debt |
| FND-PFM-SEC-028 | low | Resolved in this continuation: both named briefs are present and were read. The earlier checkout absence no longer prevents comparison with the drafting and examination instructions. | MOD-PFM-SEC | Structured evidence | undocumented |
| FND-PFM-SEC-029 | medium | Resolved for this corpus text: the continuation rewrites capability, acceptance, journey and concept descriptions to distinguish fresh evaluation from cached requests and flush submission from eviction. The implementation limitation remains recorded separately as cache debt. | CAP-PFM-SEC-009, CAP-PFM-SEC-010, CAP-PFM-SEC-012, CAP-PFM-SEC-017, CAP-PFM-SEC-020 | Structured evidence | inconsistency |
| FND-PFM-SEC-030 | medium | The contact-claim decision approves the signed claim, not candidate selection, challenge limits or contact creation. Likewise the proposed eligibility milestone cannot approve its detailed behavior. Unrelated origins are removed, and unreviewed lifecycle and audit defaults remain proposed rather than confirmed through code observation. | CAP-PFM-SEC-014, CAP-PFM-SEC-020 | Structured evidence | inconsistency |
| FND-PFM-SEC-031 | high | Resolved for final text: the remaining capability and acceptance pairs, journeys, charter, ledger and finding descriptions receive this OpenAI continuation. Completion of wording and corpus checks does not resolve the product questions or the behavioral proof gaps retained in other findings. | MOD-PFM-SEC | Structured evidence | debt |
| FND-PFM-SEC-032 | medium | Customer replacement tests assert absence of an obsolete camel-case commercial field while the mapper returns snake-case fields. Their assertions do not establish clearing of the current persisted value. The affected rule remains unknown and the acceptance scenario has no insufficient binding. | CAP-PFM-SEC-001, ATS-PFM-SEC-001 | Structured evidence | inconsistency |
| FND-PFM-SEC-033 | medium | The ordinary customer-create handler performs standing-access reconciliation, while HQ customer creation writes the record without that hook. The HQ creation test does not prove the missing side effect. The product should align the paths and add proof before assuming every newly created customer has those standing grants. | CAP-PFM-SEC-001, CAP-PFM-SEC-017 | Structured evidence | defect |
| FND-PFM-SEC-034 | medium | Inventory and concept grain are resolved in this continuation: the selected permission groups, asynchronous declarations and browser files are independently counted, and access definitions and grant records become User Account facets with their former identifiers retained as superseded. Mapping is still distinct from complete behavioral proof; asynchronous recovery gaps are named in the separate finding. | MOD-PFM-SEC, CON-PFM-SEC-004, CON-PFM-SEC-005, CON-PFM-SEC-006 | Structured evidence | debt |
| FND-PFM-SEC-035 | medium | Workspace replacement tests likewise inspect absence of the obsolete camel-case commercial field rather than the mapper’s current field. They do not prove response or stored-value clearing. The rule stays unknown until a readback test observes the current persisted field. | CAP-PFM-SEC-002, ATS-PFM-SEC-002 | Structured evidence | inconsistency |
| FND-PFM-SEC-036 | medium | The original asynchronous count omitted the derived-reconcile dispatcher schedule and both dead-letter companions. The corrected charter names two primary queues, their two dead-letter queues and three schedules. Retry exhaustion, redrive, batch failure and dispatcher recovery still need explicit acceptance coverage instead of a resource-count claim. | CAP-PFM-SEC-009, CAP-PFM-SEC-014, MOD-PFM-SEC | Structured evidence | debt |
| FND-PFM-SEC-037 | medium | Suspension and reinstatement attempt provider synchronization once after membership commit and return provider trouble separately. Revocation/deletion instead persist queue work with bounded retries and dead-letter recovery. The design proposes durable synchronization for the two single-attempt actions; fresh authority and provider sign-in state can differ until repair. | CAP-PFM-SEC-009, WF-PFM-SEC-007, Affected business rule, Affected business rule | Structured evidence | defect |
| FND-PFM-SEC-038 | low | HQ has no observed screen for approved-access requests, request withdrawal, initial-load opening, reset or loaded activation. The service operations exist, while the current staff surface offers emergency entry and selected grant-ending controls. Product should decide which direct-call journeys need screens before implementation preparation. | CAP-PFM-SEC-003, CAP-PFM-SEC-017, SCR-PFM-SEC-027 | Structured evidence | debt |
| FND-PFM-SEC-039 | low | Pool readers honor suspended and retired values, but no observed administration operation writes them. The available persistence setter has no production caller in the examined path. Their writer and operator behavior remain unknown rather than invented lifecycle transitions. | STATE-PFM-SEC-010, CAP-PFM-SEC-019 | Structured evidence | undocumented |
| FND-PFM-SEC-040 | low | The module exposes provisioning notifications but no declared domain-change events for customer, workspace, membership or access changes. Participant calls and evaluated context carry the observed cross-service effects. Product should confirm or replace that event boundary; code alone does not approve it. | SVC-PFM-SEC-security, SVC-PFM-SEC-tenants, SVC-PFM-SEC-customers | Structured evidence | undocumented |
| FND-PFM-SEC-041 | low | No examined module path calls a model. Contracts therefore have empty inference lists and no inference artifacts are needed. The module charter still lacks the convention’s explicit no-inference sentence; it is a planning artifact outside this examination’s edit boundary. | MOD-PFM-SEC | Structured evidence | undocumented |
| FND-PFM-SEC-042 | low | A stopped retirement watcher can leave a valid request without a running schedule until an operator resumes it. Delivery-failure alarms cover gating notices, but no inspected alarm establishes detection of a stopped watcher. The request can stall after eligibility without the intended operator signal. | WF-PFM-SEC-003, CAP-PFM-SEC-004, Affected business rule | Structured evidence | debt |
| FND-PFM-SEC-043 | low | Loading-to-retirement is declared in the lifecycle graph but unreachable through the request capability: request accepts active or failed provisioning and loading cannot be disabled. A staff member must currently activate, disable and then request retirement. Product should settle whether to expose loading retirement or withdraw the declared edge. | STATE-PFM-SEC-001, CAP-PFM-SEC-004, Affected business rule | Structured evidence | inconsistency |
| FND-PFM-SEC-044 | medium | Loading activation changes readiness without stamping first activation. The corrected design preserves the existing timestamp; product should decide whether imported workspaces need a separate activation timestamp before waiting-period policy relies on it. | STATE-PFM-SEC-001, WF-PFM-SEC-002, DOM-PFM-SEC-002 | Structured evidence | inconsistency |
| FND-PFM-SEC-045 | medium | Invitation issuance precedes delivery and can leave a valid hashed token after a withheld or failed send. Concurrent e-mail completion does not determine which link remains valid; the outstanding invitation and token digest do. The design now separates issuance, delivery and acceptance, while delivery-race proof remains needed. | STATE-PFM-SEC-005, WF-PFM-SEC-005 | Structured evidence | debt |
| FND-PFM-SEC-046 | medium | The one-minute removal dispatcher schedule is a recovery opportunity, not a completion deadline. Provider failures, queue backlog and eight receives can leave pool work in a dead-letter queue requiring operator redrive. The design removes the guaranteed completion time; exhaustion and recovery still need acceptance proof. | STATE-PFM-SEC-004, WF-PFM-SEC-007 | Structured evidence | debt |
| FND-PFM-SEC-047 | high | Catalog reconciliation commits before the route registry is activated in a different store. Failure between them can leave the new permission catalog beside the old active manifest and the staged manifest. The design records this seam instead of claiming rollback across both stores; recovery by repeating activation needs explicit proof. | WF-PFM-SEC-012, SVC-PFM-SEC-security | Structured evidence | debt |
| FND-PFM-SEC-048 | medium | HQ console controls gate staff suspension and reinstatement with staff-update authority, while both routes require staff-disable authority. The roles page gates on role-reading authority while its route requires staff-reading authority. The corrected Screen Contracts preserve both sides; product should align the checks and prove access with independently granted keys. | SCR-PFM-SEC-029, SCR-PFM-SEC-030, SCR-PFM-SEC-031, CAP-PFM-SEC-016 | Structured evidence | defect |
| FND-PFM-SEC-049 | low | The bare Security page always redirects to Users; it does not select a permitted section from the security context. A person allowed to read roles or policies without user-reading authority can reach a refused Users page through this entry. The design now states the fixed destination; product should decide whether entry should choose a section the person can read. | SCR-PFM-SEC-001 | Structured evidence | defect |
| FND-PFM-SEC-050 | medium | Purge finalization can complete the database request and remove the workspace before the external ledger write succeeds. A later failure does not change a completed request to failed, so the request-specific purge retry is unavailable; task replay can finish the outstanding ledger work. The design records the completed-request and missing-ledger outcome, and operator recovery needs a documented, proved path. | WF-PFM-SEC-004, STATE-PFM-SEC-003, SVC-PFM-SEC-tenants | Structured evidence | debt |
| FND-PFM-SEC-051 | medium | Retirement notice delivery precedes recording the delivered result. A successful send followed by a failed outcome write is sent again on retry, so the draft’s exactly-once claim is false. The corrected workflow records at-least-once delivery; product should decide whether duplicate reminders need provider-level deduplication. | WF-PFM-SEC-003 | Structured evidence | debt |
| FND-PFM-SEC-052 | high | Concurrent password acceptances can both pass token checks and set the provider password before conditional database consumption allows one winner. The losing request can therefore affect the credential even though its activation is refused. The design limits single-use to database consumption; acceptance needs a concurrency proof and a decision about credential ownership. | WF-PFM-SEC-006, STATE-PFM-SEC-005 | Structured evidence | debt |
| FND-PFM-SEC-053 | medium | Contact matching can create a CRM contact before the separate membership-link write succeeds. A refused or failed link can leave a created contact without its intended membership link, and decline can intentionally create a possible duplicate. The workflow now exposes the cross-service gap; compensation or convergent retry needs proof. | WF-PFM-SEC-015 | Structured evidence | debt |
| FND-PFM-SEC-054 | high | Contact linking checks for another link inside an update, but the declared contact index is not unique and different members do not share a lock. Challenge starts likewise supersede existing rows before inserting without a declared live-row uniqueness constraint or shared member lock. These checks support sequential refusal, not proved exclusion under concurrency. The design marks both concurrency guarantees unknown; simultaneous linking and challenge-start scenarios are required. | DOM-PFM-SEC-003, STATE-PFM-SEC-011, WF-PFM-SEC-015 | Structured evidence | debt |
| FND-PFM-SEC-055 | medium | Staff request submission reads for an existing open request before inserting, while declared unique indexes protect active grants only. No shared request-target lock or unique requested-row index is present in the inspected path. The corrected design distinguishes sequential duplicate checks from active-grant uniqueness and leaves concurrent open-request exclusion unknown pending proof. | DOM-PFM-SEC-003, STATE-PFM-SEC-007, WF-PFM-SEC-011 | Structured evidence | debt |
| FND-PFM-SEC-056 | medium | The ordinary security-history writer appends events, but its raw before/after payloads have no general credential-rejection filter, and the cited table declaration does not establish database refusal of updates or deletion. Authorized workspace purge also deletes scoped history. The draft’s unconditional database-enforced append-only and secret-exclusion invariant is therefore unproved; the design now states the observed writer behavior and retention exception. | DOM-PFM-SEC-003, ADR-PFM-SEC-014 | Structured evidence | debt |
| FND-PFM-SEC-057 | low | Workflow start hops name a shared job-engine function outside the two pinned source repositories. The pinned job standard documents the start-after-commit contract and module call sites use it, but this examination cannot open that dependency implementation at an independently pinned library commit. The hops remain documented rather than observed evidence, and a library pin plus execution proof is needed before treating the dependency internals as verified. | WF-PFM-SEC-001, WF-PFM-SEC-003, ADR-PFM-SEC-005 | Structured evidence | undocumented |
| FND-PFM-SEC-058 | medium | Dedicated rule, edge, failure proof remains incomplete for establish and administer a customer. | CAP-PFM-SEC-001 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-059 | medium | Dedicated failure proof remains incomplete for maintain workspace information and operating status. | CAP-PFM-SEC-002 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-060 | medium | Dedicated invariant proof remains incomplete for prepare a workspace for customer use. | CAP-PFM-SEC-003 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-061 | medium | Dedicated rule, transition, edge proof remains incomplete for manage a workspace retirement request. | CAP-PFM-SEC-004 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-062 | medium | Dedicated failure, concurrency proof remains incomplete for join through an invitation. | CAP-PFM-SEC-005 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-063 | medium | Dedicated rule, edge, concurrency proof remains incomplete for use and recover a console sign-in. | CAP-PFM-SEC-006 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-064 | medium | Dedicated concurrency, invariant proof remains incomplete for understand available workspace access. | CAP-PFM-SEC-007 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-065 | medium | Dedicated rule, edge, concurrency proof remains incomplete for offer and manage an invitation. | CAP-PFM-SEC-008 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-066 | medium | Dedicated rule, permission, edge proof remains incomplete for maintain console memberships. | CAP-PFM-SEC-009 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-067 | medium | Dedicated validation, edge, failure proof remains incomplete for assign roles within a controlled scope. | CAP-PFM-SEC-010 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-068 | medium | Dedicated validation, edge, concurrency proof remains incomplete for review security changes and refused attempts. | CAP-PFM-SEC-011 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-069 | medium | Dedicated rule, failure proof remains incomplete for model customer responsibilities with roles and policies. | CAP-PFM-SEC-012 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-070 | medium | Dedicated edge, failure, concurrency proof remains incomplete for publish shared access definitions from releases. | CAP-PFM-SEC-013 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-071 | medium | Dedicated rule, edge, failure proof remains incomplete for derive member access from appointments and eligibility. | CAP-PFM-SEC-014 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-072 | medium | Dedicated rule, transition, failure, concurrency proof remains incomplete for enforce access at request boundaries. | CAP-PFM-SEC-015 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-073 | medium | Dedicated validation, edge, failure, boundary, concurrency proof remains incomplete for administer rhythm staff memberships. | CAP-PFM-SEC-016 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-074 | medium | Dedicated rule, edge, failure, concurrency proof remains incomplete for control staff access to customer workspaces. | CAP-PFM-SEC-017 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-075 | medium | Dedicated rule, edge, failure, boundary, concurrency, invariant proof remains incomplete for suspend and resume service principals. | CAP-PFM-SEC-018 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-076 | medium | Dedicated rule, transition, invariant proof remains incomplete for register and authenticate portal members. | CAP-PFM-SEC-019 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-077 | medium | Dedicated permission, edge, failure, concurrency proof remains incomplete for match portal memberships to crm contacts. | CAP-PFM-SEC-020 | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-078 | medium | The new whole-feature chains lack executable suites that prove every ordered step. Existing capability assertions remain independently bound. | undefined | testing_coverage_gaps frontmatter | coverage-gap | | FND-PFM-SEC-078 | medium | Whole-feature chains need ordered executable proof; the existing custom-role browser chain cannot be bound until valid feature scenario references pass the validator. | FAS-PFM-SEC-01, FAS-PFM-SEC-02, FAS-PFM-SEC-03, FAS-PFM-SEC-04, FAS-PFM-SEC-05, FAS-PFM-SEC-06 | testing_coverage_gaps frontmatter | coverage-gap |
Open Questions
| id | question | why_it_matters | options | recommendation | affects |
|---|---|---|---|---|---|
OQ-PFM-SEC-001 | How should workspace setup, loading and retirement ownership be divided? | Staff-facing requests and cross-service execution share workspace sources, while loading also involves data jobs. A product decision is needed to keep each rule in one module. | A: retain staff decisions here and participant protocols in lifecycle; B: move setup and retirement entirely to lifecycle; C: use A and place loading and reset decisions with data jobs. | The product should choose A, preserving the staff administration outcome here and execution protocols with their owners. | CAP-PFM-SEC-003, CAP-PFM-SEC-004, MOD-PFM-SEC |
OQ-PFM-SEC-002 | Who may work in a disabled workspace? | Current availability permits staff HQ work while refusing ordinary customer work. Read-only customer administration or exports would require an explicit exception; the recorded decision remains deferred. | A: authorized HQ staff only; B: also allow customer administrators read-only; C: refuse all workspace work, including staff. | The product should confirm A if the observed boundary is intended, with any exception recorded explicitly. | CAP-PFM-SEC-002 |
OQ-PFM-SEC-003 | Should derived access identify a contact or a sign-in account? | Contact-keyed assignments can precede membership and align with association responsibilities. Account-keyed assignments offer a different administrative model; the proposed milestone leaves that choice open. | A: contact subjects; B: account subjects; C: let each source choose either subject. | The product should select contact subjects because appointments and eligibility describe association people, then document merge and membership implications. | CAP-PFM-SEC-014 |
OQ-PFM-SEC-004 | Does the existing User Account grouping need a future planning revision? | The current planning layer already groups definitions, assignments and staff grants as facets, and this design retains that decision with separate aggregate lifecycles. | Keep the present grouping, or commission a separate planning review before any concept split. | Retain the current grouping for this examination; no superseded concept is reinstated here. | CON-PFM-SEC-003, DOM-PFM-SEC-003, ADR-PFM-SEC-002 |