Rhythm 2.0 Specifications

Appearance

CAP-PFM-SEC-007Understand available workspace access

Markdown

CAP-PFM-SEC-007

Understand available workspace access

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-SEC-02
Key concepts
CON-PFM-SEC-003, CON-PFM-SEC-002
Actors
ACT-PFM-002, ACT-PFM-003, ACT-PFM-004, ACT-PFM-005
Journeys
JNY-PFM-SEC-002
Depends on
CAP-PFM-SEC-015
Related
CAP-PFM-SEC-006, CAP-PFM-SEC-010, CAP-PFM-SEC-017
Proved by
ATS-PFM-SEC-007
Exercised by
JNY-PFM-OPS-004, JNY-PFM-SEC-005
Executed by
TST-PFM-SEC-006, TST-PFM-SEC-015, TST-PFM-SEC-020, TST-PFM-SEC-030, TST-PFM-SEC-046, TST-PFM-SEC-047, TST-PFM-SEC-065, TST-PFM-SEC-068, TST-PFM-SEC-182, TST-PFM-SEC-199, TST-PFM-SEC-230

KindCapabilityProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Understand available workspace access ​

Purpose ​

People need to understand where they can work and which actions are available. The context gives the console an evaluated view of that access before it offers application work.

How It Works ​

The console asks for context after sign-in and when selecting a workspace. A person can inspect the resulting workspace choices and available applications. A strict deep link remains tied to its named workspace rather than silently opening different work. A remembered choice can fall back with an explanation when it is no longer usable. The screen waits while context loads and supplies retry guidance when the service cannot answer. No Access gives a signed-in person a stable place to understand that an administrator still needs to grant access. Staff inspect HQ authority separately from customer work. The access document explains assignment state and derivation when a person needs more detail. Record displays use the limited name lookup to make creator and editor identities recognizable. Context reads also record recent authentication activity, a bookkeeping side effect with its own rule and tests.

Relationships ​

  • Sign-in supplies the established caller identity.
  • The authorization evaluator determines permission results.
  • Role assignment and staff-access grants supply the authority being explained.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Console navigation reflects the person’s evaluated workspace access.HQ authority appears separately from customer workspace permissions.Record screens can resolve permitted people to names and pictures.
Surfaces
consoleportalapi
Intent sources
services-platform:docs/security/console-authentication.md#Acceptance checkpoints (2026-10-10 Final acceptance)services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)services-platform:docs/security/security-administration.md#Naming the people a record mentions (approved by Andrew 2026-10-14)services-platform:docs/security/application-access.md#The application access step, enforced everywhere

Controls

38 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-MON-003 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-004 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.security-self.readapirecord
platform.application.accessconsoletenant

Business Rules

13 rules, 12 to be proved before approval. A rule's product intent is derived from its origin: 13 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Security-context and access-document reads identify the authenticated active caller, refuse inactive or unknown memberships, never return another person’s document and send no-store response guidance.
origin: services-platform:docs/security/console-authentication.md#Acceptance checkpoints (2026-10-10 Final acceptance)
no proof recorded yet
permissionapi, servicetest
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the user the signed context names and no other, so one person can never read another’s document
02must prove
Confirmed
Context refuses callers without an in-force assignment, including pending or future-only grants, using the no-access code that displays the console’s No Access page rather than another sign-in redirect.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
policyservice, consoletest
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#is refused their own document rather than answered an empty one
03must prove
Confirmed
Workspace permissions expand current catalog keys through effective grants with deny precedence, exclude staff-only and platform-scope authority, and list record grants without treating them as workspace-wide permission.
origin: services-platform:docs/security/console-authentication.md#Acceptance checkpoints (2026-10-10 Final acceptance)
no proof recorded yet
calculationservicetest
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#takes the denied key out of the allowed keys, though another grant allows it
04must prove
Confirmed
Staff context includes a separate HQ permission collection, which can be empty when staff grants have expired; non-staff context contains no HQ collection.
origin: services-platform:docs/hq/rhythm-hq-plan.md#D1
no proof recorded yet
policyservicetest
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#expands the wildcard to every concrete key of the catalog in Rhythm HQ, the staff-only one included
05must prove
Confirmed
Context presents operational workspaces reached by the caller’s customer grants and, for staff, live customer-access grants, excluding unavailable workspaces from ordinary customer choices.
origin: services-platform:docs/security/console-authentication.md#Acceptance checkpoints (2026-10-10 Final acceptance)
no proof recorded yet
calculationservicetest
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#offers the customer’s own person only the tenants they can work in
06must prove
Confirmed
A strict workspace selection returns that workspace’s context or an access-denied/not-found response; an unavailable remembered preference instead falls back, and strict and preferred parameters cannot be combined.
origin: services-platform:docs/tenants/tenant-identity.md#The rules (Andrew, 2026-10-17)
no proof recorded yet
validationapi, servicetest
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses the same tenant named strictly by tenant_id, the console URL never falling back
07must prove
Confirmed
An application requires workspace licensing and the caller’s application-access permission; Platform and HQ are exempt from those application gates.
origin: services-platform:docs/security/application-access.md#The application access step, enforced everywhere
no proof recorded yet
calculationservice, consoletest
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the application that follows from those keys
08must prove
Confirmed
The console waits for context before rendering application work or requesting its data, offers retry after a non-authorization failure and can renew an expired token before retrying.
origin: services-platform:docs/security/console-authentication.md#Acceptance checkpoints (2026-10-10 Final acceptance)
no proof recorded yet
policyconsoletest
react-console:e2e/controlled/security-context.controlled.spec.ts#will not open the console when the Platform cannot say what somebody may do, and opens it on the retry
09must prove
Confirmed
Console navigation and actions omit unavailable permissions, and protected page access fails even when the user enters the address directly.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
permissionconsoletest
react-console:e2e/dev/permissions.dev.spec.ts#denies a page whose permission nobody holds, when its URL is typed
10must prove
Confirmed
The access document presents active and pending assignments, including derivation details, excludes revoked assignments and does not derive access from pending assignments.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
no proof recorded yet
policyserviceobserved
services-platform:modules/security/services/access/access-document.ts:getAccessDocument
11must prove
Confirmed
Console name lookup accepts 1–100 requested identities and returns only identifiers, display names and pictures for the customer’s console users, relevant portal members and Rhythm staff; other identities are omitted and portal callers are refused.
origin: services-platform:docs/security/security-administration.md#Naming the people a record mentions (approved by Andrew 2026-10-14)
no proof recorded yet
policyapi, servicetest
services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#leaves out another customer's user and an id that names nobody, rather than nulling or refusing them
12
Confirmed
When a remembered workspace is unavailable, the console explains its fallback to the default; a staff deep link without customer-access authority returns to HQ with guidance.
policyconsoletest
react-console:e2e/controlled/tenant-unavailable.controlled.spec.ts#falls back to the default tenant, with a word of explanation, rather than refusing access
13must prove
Confirmed
A successful interactive context read records recent authentication at most once per minute without changing membership status or version; unattended jobs skip the stamp and stamp failure is logged without failing the context read.
no proof recorded yet
policyserviceobserved
services-platform:modules/security/services/access/security-context.ts:noteAuthentication

Scenarios

IdGivenWhenThenProvenance
01An active member has no assigned access.The member signs in and loads context.The console presents No Access and a sign-out option without returning repeatedly to sign-in.test
react-console:e2e/dev/permissions.dev.spec.ts#shows a person with no role the No Access screen, and does not loop back to the login screen
02A workspace lacks an application licence.The member views navigation or follows that application’s deep link.Navigation omits the application and the deep link explains its unavailability.test
react-console:e2e/mock/application-access.mock.spec.ts#a deep link into one of them says the application isn't available

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software