Staff access grant

The Lifecycle

The diagram summarizes the observed transition rows; declared edges without an observed writer remain outside the operational graph.

Transitions Explained

The state rows describe requested and granted customer entry. Emergency and standing creation can begin directly in active state through their own capabilities; they do not imply customer approval of a requested row.

Expiry is enforced by assignment validity and settled lazily on reads. Revocation records the actor and preserves the customer’s ability to end standing access.

What Cannot Happen

A manual standing-access revocation remains final for that target through reconciliation.

A closed decision cannot be approved later; the staff member submits another request.

Requested rows store the requested window but expiry settlement only updates active grants. An undecided request is not automatically expired by that path.

Concurrency and Timing

Active-grant unique indexes protect workspace and customer targets. Request submission checks for existing requested work before insertion but does not prove concurrent request exclusion. Materialization and grant writes share a transaction, and matching-grant database integrity protects cross-customer assignments. Evaluation enforces validity; expiry settlement applies to active grants only.