Skip to content

CAP-PFM-SEC-003Prepare a workspace for customer use

Markdown

CAP-PFM-SEC-003

Prepare a workspace for customer use

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

KindCapabilityProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Staff follow setup across participating services before handover.Failed setup retains completed work for a later retry.Initial loading, reset and activation support preparation before a separate go-live decision.
Surfaces
consoleapijob
Intent sources
services-platform:docs/tenants/tenant-lifecycle-plan.md#4. Provisioningservices-platform:docs/tenants/tenant-lifecycle-plan.md#13 (D3)services-platform:docs/hq/rhythm-hq-plan.md#I. Provisioning workflowservices-platform:docs/hq/rhythm-hq-plan.md#K3services-platform:docs/hq/rhythm-hq-plan.md#K8services-platform:docs/tenants/tenant-identity.md#The rules (Andrew, 2026-10-17)

Controls

38 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-CHG-001 TC-CHG-002 TC-CHG-003 TC-CHG-004 TC-CHG-005 TC-CHG-006 TC-CHG-007 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-MON-001 TC-MON-002 TC-PI-001 TC-PI-002 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.tenants.provisionapiglobal
hq.tenants.readapiglobal
hq.tenants.activateapiglobal
hq.data-runs.manageapiglobal

Business Rules

15 rules, 13 to be proved before approval. A rule's product intent is derived from its origin: 15 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Provisioning, progress reads, retries and initialization require staff authority; customer administrators cannot perform them even for their own workspace.
permissionapitest
02must prove
Confirmed
Provisioning requires a chosen readable slug of 1–64 lowercase characters with alphanumeric ends and no adjacent dots, generated-identifier shape, reserved value, existing value or retired workspace identifier; a new customer uses the same slug validation.
✓ A production identifier and a distinct sandbox identifier pass validation.✗ A generated-identifier shape fails with the invalid-identifier code.
origin: services-platform:docs/tenants/tenant-identity.md#The rules (Andrew, 2026-10-17)
validationapi, service, databasetest
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses an id another tenant has as 409 tenant_id_taken
03must prove
Confirmed
Replaying a submission returns its original workspace and job, while a distinct submission using an occupied workspace identifier fails.
invariantservice, databasetest
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#answers the same tenant and the same job when the same submission is sent twice
04must prove
Confirmed
Workspace activation follows provisioning and readiness confirmation from every enabled participant and records the activation time.
lifecycleservicetest
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#asks every participant to confirm what it made before the tenant is opened
05must prove
Confirmed
Failed provisioning preserves completed work and marks the workspace failed; retries are permitted only from that state and resume unfinished work.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#4.4 Partial failure, compensation, external success
lifecycleservicetest
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#does the missing work and not the finished work when it is provisioned again
06must prove
Confirmed
A provisioning request creating a customer with a first administrator sends one customer-wide Administrator invitation and records it to prevent a second invitation on retry.
lifecycleservicetest
07must prove
Confirmed
Provisioning sends the requester an outcome e-mail and publishes an operations alert with the job link without repeating delivered notices; notice failure does not turn the provisioning job into a failure.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#4.6 The requester is told how it ended
policyservicetest
08must prove
Confirmed
Sender setup validates domain or address strategies before creating a workspace; a supplied address must match a supplied domain, domain values must be hostnames, and an omitted domain can use a hostname-shaped workspace identifier.
validationapi, servicetest
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#creates no tenant at all when the strategy is refused: the request is rejected whole
09
Confirmed
Pending sender verification does not block activation; the shared Rhythm sender remains available until the customer publishes the required records.
policyservicetest
10
Confirmed
Provisioning inherits the customer’s commercial account unless the request explicitly selects a different account or no account.
calculationserviceobserved
11must prove
Confirmed
Reconciliation moves a still-provisioning workspace behind a settled failed job to provisioning failure and records its outcome notice without repeating a delivered notice.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#4.4 Partial failure, compensation, external success
lifecycleservicetest
services-platform:modules/tenants/tests/integration/services/provisioning/repair-stranded-provisioning.integration.spec.js#moves the stranded tenant to provisioning_failed, which makes it retryable and deletable again
12must prove
Confirmed
Initialization rejects missing workspaces, unknown participants and workspaces whose deletion is pending or underway.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#6.5 Initialization for capabilities added later
validationservicetest
services-platform:modules/tenants/tests/integration/services/provisioning/initialize-tenant.integration.spec.js#refuses a participant that is not in the registry, and names the ones that are
13must prove
Confirmed
Initial loading requires implementation status, records the initiating person and reason, and blocks ordinary customer work during the import.
lifecycleservicetest
services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant
14must prove
Confirmed
Reset requires a loading workspace, an exact identifier confirmation, reset support from every required participant and no running reset; it preserves configuration and returns the workspace to loading.
validationservicetest
services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses a confirmation that is not the tenant’s id, and does not say what to type
15must prove
Confirmed
Activation requires authority separate from import execution and restores ordinary availability while leaving business status unchanged.
permissionapi, servicetest
services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key

Scenarios

IdGivenWhenThenProvenance
01An association is preparing a migrated workspace.Staff provision its production workspace and a sandbox under the same customer.Both retain their chosen identifiers, and the sandbox can be selected by its identifier in security context.test
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#creates the sandbox sandbox.rubber.org under it
02A setup participant has failed.Staff start a retry and subsequently read progress.The retry uses a new job, reaches readiness when work succeeds and becomes the latest provisioning snapshot.test
services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers the retry’s job to a reader afterwards, which is the latest provisioning

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.