Role assignment

The Lifecycle

The diagram summarizes the observed transition rows; declared edges without an observed writer remain outside the operational graph.

Transitions Explained

Only pending, active and revoked are stored statuses. Scheduled, live and ended describe active rows relative to their validity windows; the table lists representative changes rather than an exhaustive graph of every amended window.

Source-managed assignments retain their derivation ownership. A renewal or amendment can make a previously ended active row usable again; it does not revive a revoked row.

What Cannot Happen

Revoked rows are not revived; replacement uses a new assignment.

Acceptance cannot activate grants beyond the inviter’s remaining authority and leaves token and grants unchanged on refusal.

Manual administration cannot withdraw a source-managed derived assignment.

Concurrency and Timing

Unique indexes refuse duplicate live grants. Source reconciliation locks derivation keys before inspecting current rows. Scope checks take a shared membership lock. Commit changes fresh evaluation; gateway caches can lag for sixty seconds, with signed contexts subject to their own expiry. Window-based labels are derived views, so amendments can move between them without a dedicated status transition.