User Account

What It Models

User Account is the planning concept for a person’s membership and authority. Its design groups four aggregates: membership and sign-in identities; roles, policies and permission definitions; scoped assignments; and staff access grants. Each aggregate retains its own lifecycle and transaction boundary. Service principals and security history are adjacent records owned by Security.

Identity and Attributes

Each membership receives a generated user identifier when invitation, confirmed portal registration founding-staff reconciliation or the retained direct-create route creates it. A membership belongs to one customer console or one workspace portal. An address may recur across these boundaries, but not within one boundary. Portal pool usernames use the member identifier. Sign-in identities use issuer and subject; definitions, assignments, grants and service principals retain their own stable identities.

The attribute rows distinguish stored fields, computed answers and supporting records.

Relationships

Console memberships and custom definitions store their owning customer reference. Portal memberships, scoped assignments and grants refer to a workspace. Workspace purge removes the portal memberships and their dependent identities and assignments.

Invariants

The structured invariant rows identify each protection, its enforcement layer and its evidence. Read their qualifications with the statement rather than treating a service check as a database constraint.

How It Is Stored and Shared

A customer-console membership and a workspace-portal membership are distinct even when the same person uses both. Definitions describe permissions; assignments apply them to subjects and scopes. The evaluator also supplies baseline self-service permissions. A linked CRM contact allows contact-derived assignments to contribute to a portal member’s access.

Open Design Questions

Security owns these records and exposes administration operations and evaluated context. Other services synchronize derived assignments through the shared capability in their own transactions. Workspace provisioning invokes Security to invite a first administrator. Assignments and security history do not use the ordinary per-workspace row policy because their access boundaries differ.

The database table inventory excludes the separate gateway route registry. These records have no custom-field enabling declaration. Fresh permission evaluation and cached permission use have different timing; a gateway decision can remain cached for sixty seconds and its signed context can remain usable for thirty more. Provider synchronization is separately best effort or queued, with documented failure and recovery limits.

The existing planning grouping is retained. Product still needs to settle contact-derived subject semantics and the desired consistency between suspension and durable account removal. The design records those disagreements rather than changing the planning concepts.

Show evidence (sources, provenance, origins, pinned commits)

Relationships

To	Cardinality	Ownership	Crosses a service	On archive or delete
`DOM-PFM-SEC-001`	many console memberships and custom definitions to one customer	Console memberships and custom definitions store their owning customer reference.	no
`DOM-PFM-SEC-002`	many portal memberships, assignments and staff access grants to one workspace	Portal memberships, scoped assignments and grants refer to a workspace. Workspace purge removes the portal memberships and their dependent identities and assignments.	no

Invariants

Invariant	Enforced at	Provenance
`INV-DOM-PFM-SEC-003-01` A membership has one console or portal boundary; an e-mail address is unique within its customer console or workspace portal.	service, database	observed services-platform:modules/security/db/users.table.ts:users (users_console_email_address_uidx, users_portal_email_address_uidx)
`INV-DOM-PFM-SEC-003-02` Fresh authorization refuses invited, suspended and revoked memberships. An earlier cached decision can remain usable until its applicable expiry.	service	observed services-platform:modules/security/authorizer/authorize.ts:authorize (step 9)
`INV-DOM-PFM-SEC-003-03` Only one invitation may remain outstanding for a membership; resend supersedes the earlier row before creating its replacement.	service, database	observed services-platform:modules/security/db/user-invitations.table.ts (user_invitations_live_uidx)
`INV-DOM-PFM-SEC-003-04` Invitation tokens are retained as hashes, expire after 168 elapsed hours and are consumed by a conditional update that admits only a usable invitation.	service, database	observed services-platform:modules/security/services/persistence/invitations.ts:acceptInvitation
`INV-DOM-PFM-SEC-003-05` Authorization resolves existing sign-in identities without creating them; a provider identity can link to only one account within a pool.	service, database	observed services-platform:modules/security/db/external-identities.table.ts (external_identities_pool_provider_uidx); modules/security/authorizer/authorize.ts:authorize (step 8)
`INV-DOM-PFM-SEC-003-06` An assignment names exactly one subject: a membership or a CRM contact.	database	observed services-platform:modules/security/db/security-assignments.table.ts (security_assignments_subject_check)
`INV-DOM-PFM-SEC-003-07` Assignment scope must remain inside the subject’s boundary. Platform scope requires a console membership in Rhythm’s customer; contacts are limited to their workspace and its record-type scopes.	service, database	observed services-platform:modules/security/services/persistence/assignments.ts:assertScopeInsideWall
`INV-DOM-PFM-SEC-003-08` Evaluation uses active assignments within their validity windows. Pending assignments grant no access and revoked rows are terminal.	service, database	observed services-platform:modules/security/db/security-assignments.table.ts:ASSIGNMENT_STATUSES
`INV-DOM-PFM-SEC-003-09` Uniqueness prevents duplicate non-revoked role grants for a subject, scope and window, and duplicate live derived rows for a role and resource key.	database	observed services-platform:modules/security/db/security-assignments.table.ts (security_assignments_live_grant_uidx, security_assignments_derivation_uidx)
`INV-DOM-PFM-SEC-003-10` Derived rows carry source and key metadata. Source synchronization controls them; manual amendment and withdrawal are refused.	service, database	observed services-platform:modules/security/services/persistence/assignments.ts:assertAssignmentNotDerived
`INV-DOM-PFM-SEC-003-11` Delegation checks require unconditional possession at the target scope and refuse grants to the caller’s own membership, subject to the documented founding-administrator exception.	service	observed services-platform:modules/security/services/invitations/widening.ts:assertMayGrant
`INV-DOM-PFM-SEC-003-12` Guarded changes roll back if no qualifying customer security administrator or no active Rhythm Administrator would remain.	service	observed services-platform:modules/security/services/membership/lockout.ts:guardedAgainstLockout; modules/security/services/membership/last-administrator.ts:assertRhythmAdministratorRemains
`INV-DOM-PFM-SEC-003-13` Release reconciliation is the permitted writer for built-in definitions, rules and policy attachments; other writers are rejected.	service, database	observed services-platform:modules/security/services/catalog/reconcile-catalog.ts:reconcileCatalog
`INV-DOM-PFM-SEC-003-14` Custom definitions belong to a customer. Role composition refuses another customer’s policy, archived policies and staff-only definitions.	service, database	test services-platform:modules/security/tests/integration/db/security-definition-integrity.integration.spec.js#refuses another customer's policy, the one way authority could cross a wall through a definition
`INV-DOM-PFM-SEC-003-15` Custom definitions are retained by archiving. Existing role assignments and policy references prevent archive.	service	observed services-platform:modules/security/services/definitions/manage-roles.ts:archiveCustomRole
`INV-DOM-PFM-SEC-003-16` Reconciliation increments a built-in definition’s version only when its materialized content changes.	service	observed services-platform:modules/security/services/catalog/catalog-plan.ts:planBuiltInPolicy
`INV-DOM-PFM-SEC-003-17` Cross-customer staff assignments require a matching active grant for member, role, scope and validity window.	service, database	observed services-platform:modules/security/services/staff-access/materialize-grant.ts:materializeStaffAccessGrant
`INV-DOM-PFM-SEC-003-18` Active-grant unique indexes protect staff target uniqueness. Open requests use a sequential precheck, with concurrent exclusion unknown. Approved entry lasts one to thirty days; emergency entry is at most 240 minutes and needs a reason of twenty characters or more.	service, database	unknown services-platform:modules/security/db/staff-access-grants.table.ts (staff_access_grants_active_uidx, EMERGENCY_MAX_MINUTES, EMERGENCY_REASON_MIN_LENGTH); modules/security/services/staff-access/request-tenant-access.ts:requestTenantAccess
`INV-DOM-PFM-SEC-003-19` Reconciliation preserves a manually revoked standing grant rather than recreating access at that target.	service	observed services-platform:modules/security/services/staff-access/ensure-standing-access.ts:ensureStandingAccess
`INV-DOM-PFM-SEC-003-20` Ordinary security writers append events and classified refusals follow rollback. Workspace purge can remove scoped events; general database append-only and credential-payload rejection guarantees are unknown.	service	unknown services-platform:modules/security/services/audit/refused-attempts.ts:auditedAttempt; modules/security/services/persistence/audit-events.ts:recordSecurityAuditEvent
`INV-DOM-PFM-SEC-003-21` Membership deletion retains a former-user identity and name and refuses unresolved references from other records.	service, database	observed services-platform:modules/security/services/invitations/user-deletion.ts:deleteUser
`INV-DOM-PFM-SEC-003-22` Challenges use digests, ten-minute expiry and five-attempt accounting. Sequential replacement supersedes earlier rows and link writes check existing claims, but concurrent single-challenge and single-contact exclusion are unknown.	service, database	unknown services-platform:modules/security/services/portal/contact-match.ts:startContactChallenge; modules/security/services/persistence/users.ts:linkPortalMemberContact; modules/security/services/persistence/portal-contact-challenges.ts:startPortalContactChallenge

Planning

Design

User Account ​

What It Models ​

Identity and Attributes ​

Relationships ​

Invariants ​

How It Is Stored and Shared ​

Open Design Questions ​

Relationships

Invariants

User Account

What It Models

Identity and Attributes

Relationships

Invariants

How It Is Stored and Shared

Open Design Questions