Security, Customers and Workspaces

Purpose

This module connects customers and workspaces to the memberships and access used for Rhythm work. Customer administrators manage their colleagues’ access; Rhythm staff prepare customer environments and administer staff work through HQ. The planning layer separates product decisions from behavior observed in the pinned implementation.

Boundary

The charter owns the records and administrative outcomes listed above. Cross-service lifecycle execution, data jobs, licensing, eligibility, notifications and CRM matching inputs remain dependencies with separate owners. The precise division of staff-facing lifecycle rules still needs the ownership decision recorded in the open questions. The reader projects these specifications and supplies no independent requirement authority.

Features

Feature	Owned active concepts	Capabilities	Journeys
FEAT-PFM-SEC-01 — Customer and Workspace Administration	2	4	1
FEAT-PFM-SEC-02 — Console Entry and Sessions	1	3	1
FEAT-PFM-SEC-03 — People and Access Administration	0	4	1
FEAT-PFM-SEC-04 — Access Definitions and Authorization	0	4	1
FEAT-PFM-SEC-05 — Staff Administration and Customer Entry	0	3	1
FEAT-PFM-SEC-06 — Portal Membership and Identity	0	2	0

Capabilities

Id	Title	Feature	Product intent	Implementation evidence
CAP-PFM-SEC-001	Establish and administer a customer	FEAT-PFM-SEC-01	confirmed	observed
CAP-PFM-SEC-002	Maintain workspace information and operating status	FEAT-PFM-SEC-01	confirmed	observed
CAP-PFM-SEC-003	Prepare a workspace for customer use	FEAT-PFM-SEC-01	confirmed	observed
CAP-PFM-SEC-004	Manage a workspace retirement request	FEAT-PFM-SEC-01	proposed	observed
CAP-PFM-SEC-005	Join through an invitation	FEAT-PFM-SEC-02	confirmed	observed
CAP-PFM-SEC-006	Use and recover a console sign-in	FEAT-PFM-SEC-02	confirmed	observed
CAP-PFM-SEC-007	Understand available workspace access	FEAT-PFM-SEC-02	confirmed	observed
CAP-PFM-SEC-008	Offer and manage an invitation	FEAT-PFM-SEC-03	confirmed	observed
CAP-PFM-SEC-009	Maintain console memberships	FEAT-PFM-SEC-03	confirmed	observed
CAP-PFM-SEC-010	Assign roles within a controlled scope	FEAT-PFM-SEC-03	confirmed	observed
CAP-PFM-SEC-011	Review security changes and refused attempts	FEAT-PFM-SEC-03	proposed	observed
CAP-PFM-SEC-012	Model customer responsibilities with roles and policies	FEAT-PFM-SEC-04	confirmed	observed
CAP-PFM-SEC-013	Publish shared access definitions from releases	FEAT-PFM-SEC-04	confirmed	observed
CAP-PFM-SEC-014	Derive member access from appointments and eligibility	FEAT-PFM-SEC-04	proposed	partially-observed
CAP-PFM-SEC-015	Enforce access at request boundaries	FEAT-PFM-SEC-04	confirmed	observed
CAP-PFM-SEC-016	Administer Rhythm staff memberships	FEAT-PFM-SEC-05	confirmed	observed
CAP-PFM-SEC-017	Control staff access to customer workspaces	FEAT-PFM-SEC-05	confirmed	observed
CAP-PFM-SEC-018	Suspend and resume service principals	FEAT-PFM-SEC-05	proposed	observed
CAP-PFM-SEC-019	Register and authenticate portal members	FEAT-PFM-SEC-06	proposed	partially-observed
CAP-PFM-SEC-020	Match portal memberships to CRM contacts	FEAT-PFM-SEC-06	proposed	observed

Journeys

Id	Title	Feature	Product intent	Browser policy
JNY-PFM-SEC-001	Prepare and hand over a customer workspace	FEAT-PFM-SEC-01	confirmed	required
JNY-PFM-SEC-002	Join the console through an invitation	FEAT-PFM-SEC-02	confirmed	required
JNY-PFM-SEC-003	Invite a colleague and maintain their console access	FEAT-PFM-SEC-03	confirmed	required
JNY-PFM-SEC-004	Compose and assign a customer role	FEAT-PFM-SEC-04	confirmed	required
JNY-PFM-SEC-005	Approve and end customer workspace access for support	FEAT-PFM-SEC-05	confirmed	required

Test Artifact Tree

The design layer holds one detailed test specification per capability. The planning layer holds one cumulative acceptance suite per feature, and the implementation layer registers the existing executable files with their verification boundaries. The frontmatter lists every artifact in these three branches.