Recorded staff customer entry

Context

The HQ planning decisions already chose the staff-entry mechanism. This record carries those origins without requesting another decision on impersonation or platform-role reach.

Provider notices and cached contexts have their own failure and expiry behavior after grant changes.

Decision

Require recorded approved, directly given, emergency or standing grants and matching ordinary assignments for staff entry to customer work; keep HQ system administration as its separate authority path.

Alternatives Considered

Let platform staff roles directly authorize every customer operation. The recorded scope narrowing removed that broad customer reach; reintroducing it would bypass customer entry grants.

Impersonate a customer member for staff work. Impersonation would conceal the acting staff member and bypass the recorded consent model.

Consequences

Customer administrators can inspect and revoke staff access, including standing entry preserved as revoked across deploys.

Ordinary staff entry uses the shared evaluator and applicable delegation and lockout checks.

Emergency entry is bounded and requires its reason, ticket and notices.