Source-owned contact-derived access

Context

The cited derivation and eligibility records remain proposed where indicated. The design records their observed source ownership without confirming an unresolved subject choice.

The shared synchronization function does not require every source to supply the eligibility refresh lifetime. The corrected fail-safe claim applies specifically to eligibility-bound renewal.

Decision

Retain contact-keyed source synchronization for appointment and eligibility assignments, exclude manual edits, and apply them to the linked portal member; eligibility renewals have bounded windows while other sources provide their validity.

Alternatives Considered

Store all derived grants against the sign-in membership. Appointments can exist before a login, making contact identity useful; Product has not settled the contact/account choice.

Withdraw access on every evaluator failure. An outage or indeterminate result should not be interpreted as a proved ineligible decision; the implementation preserves the existing set.

Consequences

Missed eligibility renewal removes access at its stored window end; other sources’ windows must be assessed independently.

Only the linked portal member receives contact-derived assignments through this evaluation path.

Contact-versus-account subject semantics remain a planning question.