Rhythm 2.0 Specifications

Appearance

CAP-PFM-SEC-009Maintain console memberships

Markdown

CAP-PFM-SEC-009

Maintain console memberships

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-SEC-03
Exercised by
FAS-PFM-SEC-03-01, FAS-PFM-SEC-03-02, FAS-PFM-SEC-03-03, FAS-PFM-SEC-03-04, FAS-PFM-SEC-03-05
Key concepts
CON-PFM-SEC-003
Actors
ACT-PFM-001, ACT-PFM-006
Journeys
JNY-PFM-SEC-003
Related
CAP-PFM-SEC-008, CAP-PFM-SEC-010, CAP-PFM-SEC-011, CAP-PFM-SEC-016
Proved by
ATS-PFM-SEC-009

Implementation

Executable suites
TST-PFM-SEC-035, TST-PFM-SEC-051, TST-PFM-SEC-060, TST-PFM-SEC-069, TST-PFM-SEC-114, TST-PFM-SEC-117, TST-PFM-SEC-121, TST-PFM-SEC-128, TST-PFM-SEC-204, TST-PFM-SEC-212

KindCapabilityProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Maintain console memberships ​

Purpose ​

Administrators keep the customer’s colleagues recognizable and manage access as people’s responsibilities change. The membership record connects those actions to the identity and history staff will need later.

How It Works ​

The administrator finds a colleague through the user list and opens the person’s record. The view brings together profile information, roles, access explanation and history. Editing profile information uses a separate page and can fail if the saved version has changed. Lifecycle actions appear alongside that profile work but express different decisions. Deactivation supports a temporary interruption; revocation ends membership until a new invitation. The result can report a pool problem even though the membership change has committed, which staff need to investigate rather than assume the database action failed. Deletion is reserved for an unwanted record and remains subject to references and administrator safeguards. Background pool-account work can continue after the response. Staff consult security history when they need to explain why a colleague lost access or why an attempted change was refused.

Relationships ​

  • Invitation handling establishes and restores memberships.
  • Scoped role management changes the held assignments.
  • Security history preserves lifecycle decisions and refusals.
  • HQ provides the corresponding administration surface for Rhythm staff.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Administrators find memberships and inspect profile, roles, access and history.Lifecycle actions distinguish temporary suspension, membership revocation and record deletion.Refused changes preserve the customer’s remaining security administration.
Surfaces
consoleapijob
Intent sources
services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-13/14 Final acceptance)services-platform:docs/security/security-administration.md#16 (Andrew accepted the delete, 2026-10-12)services-platform:docs/security/security-administration.md#2. Capability checklist (U1 to U7)

Controls

35 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-DAT-001 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-003 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.users.readapitenant
platform.security-access.manageapitenant
platform.users.createapitenant
platform.users.updateapitenant
platform.users.deleteapitenant
platform.users.bulkapitenant
platform.users.manage-identitiesapitenant

Business Rules

12 rules, 10 to be proved before approval. A rule's product intent is derived from its origin: 12 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Customer user lists contain that customer’s console memberships with roles, surname ordering, name/e-mail search, status, role and invitation filters and pages of at most 100; revoked memberships are hidden by default, and platform staff authority alone cannot access another customer’s list.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-13/14 Final acceptance)
proved by ATS-PFM-SEC-009-01, TST-PFM-SEC-051
policyapi, servicetest
services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#refuses a platform-scope caller the users of a customer they are not of, because this route is console
02
Confirmed
Membership detail includes profile, assignments with role and grantor, and the latest invitation’s delivery information; missing and outside-customer identities share the refusal.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-13/14 Final acceptance)
policyservicetest
services-platform:modules/security/tests/integration/services/membership/console-users.integration.spec.js#answers the person, the grant with the role it names and who granted it, the roles they hold, and their invitation
03must prove
Confirmed
Versioned profile edits change only first name, last name, display name, time zone and locale, preserving e-mail, status and customer ownership.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
proved by ATS-PFM-SEC-006-13, ATS-PFM-SEC-009-02, TST-PFM-SEC-051
validationapi, servicetest
services-platform:modules/security/tests/integration/services/membership/console-users.integration.spec.js#leaves the e-mail address, the status and the wall exactly as they were
04must prove
Confirmed
Deactivation commits suspended membership and withdrawn invitations, then attempts pool disablement and flush submission; fresh membership reads refuse it, cached decisions can persist, pool failure is reported without reversing suspension, and self-suspension or revocation fails.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
proved by ATS-PFM-SEC-009-03, ATS-PFM-SEC-009-12, ATS-PFM-SEC-009-16, TST-PFM-SEC-035, TST-PFM-SEC-060, TST-PFM-SEC-212
lifecycleserviceobserved
services-platform:modules/security/services/invitations/suspend-user.ts:suspendUser
05must prove
Confirmed
Reactivation applies only to suspended memberships, requires widening authority over their retained grants and attempts pool enablement without reviving withdrawn invitations; an enablement failure is reported while the membership change remains committed.
origin: services-platform:docs/security/security-administration.md#Phase 6 (reinstatement is judged as widening)
proved by ATS-PFM-SEC-008-21, ATS-PFM-SEC-009-04, ATS-PFM-SEC-009-13, ATS-PFM-SEC-009-17, TST-PFM-SEC-212
permissionserviceobserved
services-platform:modules/security/services/invitations/suspend-user.ts:reinstateUser
06must prove
Confirmed
Revocation ends membership, outstanding invitations and held assignments; returning requires a fresh invitation rather than reinstatement.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-11 Final acceptance)
proved by ATS-PFM-SEC-009-05, ATS-PFM-SEC-009-14, ATS-PFM-SEC-009-15, TST-PFM-SEC-060, TST-PFM-SEC-212
lifecycleservicetest
services-platform:modules/security/tests/unit/services/invitations/suspend-revoke.spec.js#ends the membership, its invitations and every assignment it held in one transaction
07must prove
Confirmed
A guarded write that would reduce a non-Rhythm customer from one or more qualifying administrators to none rolls back; qualifying administrators are active customer console users with active, unconditional customer-wide roles containing the security-administrator policy, and an already-zero count does not trigger refusal.
origin: services-platform:docs/security/security-administration.md#4. Delegation, escalation and lockout
proved by ATS-PFM-SEC-009-06, ATS-PFM-SEC-009-18, ATS-PFM-SEC-009-20, ATS-PFM-SEC-010-20, ATS-PFM-SEC-016-08, TST-PFM-SEC-035, TST-PFM-SEC-117, TST-PFM-SEC-121, TST-PFM-SEC-128, TST-PFM-SEC-212
invariantserviceobserved
services-platform:modules/security/services/membership/lockout.ts:assertNotLockedOut
08must prove
Confirmed
Deletion requires delete and access-management authority, preserves name attribution and refuses referenced identities, self-deletion, loss of the customer’s last qualifying administrator or loss of Rhythm’s last Rhythm Administrator.
origin: services-platform:docs/security/security-administration.md#16 (Andrew accepted the delete, 2026-10-12)
proved by ATS-PFM-SEC-009-07, ATS-PFM-SEC-009-19, ATS-PFM-SEC-011-08, TST-PFM-SEC-069
lifecycleapi, service, databasetest
services-platform:modules/security/tests/unit/services/invitations/user-deletion.spec.js#refuses a delete that would leave the customer with nobody who can administer its security
09must prove
Confirmed
Revocation and deletion commit durable pool-account work for retried background disablement or removal; the response can precede completion of that work.
origin: services-platform:docs/security/security-administration.md#16 (Andrew accepted the delete, 2026-10-12)
proved by ATS-PFM-SEC-009-08, TST-PFM-SEC-114
policyservicetest
services-platform:modules/security/tests/integration/services/dispatch/pool-account-removals.integration.spec.js#removes the account on the second delivery, and tells SQS the item is done
10must prove
Confirmed
Console memberships belong to one customer and portal memberships to one workspace; the same address can identify distinct memberships across those boundaries, same-boundary duplicates fail and ordinary edits cannot move lifecycle.
origin: services-platform:docs/security/security-administration.md#1. What the area is for (decision U7)
proved by ATS-PFM-SEC-009-09, TST-PFM-SEC-069
invariantapi, service, databasetest
services-platform:modules/security/tests/e2e/users.e2e.spec.js#refuses a duplicate e-mail in the same wall (400) and a wall the access type does not allow (400)
11must prove
Confirmed
Canonical sign-in linking requires identity-management authority and a pool account that exists, is enabled and carries the membership’s verified matching address.
proved by ATS-PFM-SEC-009-10, TST-PFM-SEC-069, TST-PFM-SEC-204
validationservicetest
services-platform:modules/security/tests/unit/services/identity/link-cognito-identity.spec.js#never links on the request's say-so: the pool user must exist, be enabled, and carry the user's verified e-mail
12
Confirmed
The user view separates Profile, Roles, Access and History, keeps editing on a separate page and hides Edit when user-management permission is absent.
origin: services-platform:docs/security/security-administration.md#14 Acceptance checkpoints (2026-10-13/14 Final acceptance)
policyconsoletest
react-console:e2e/mock/security-view-edit.mock.spec.ts#somebody who may not manage users gets no Edit, and the edit page sends them to the view

Scenarios

IdGivenWhenThenProvenance
01The customer has one qualifying security administrator.An administrator tries to remove that person’s Administrator assignment.The change is refused because it would remove the customer’s remaining security administration.test
react-console:e2e/security/users.spec.ts#refuses to remove the Administrator role from the last person who holds it
02A colleague should temporarily lose membership access.An administrator deactivates the colleague.Fresh membership checks refuse the suspended account; cached authorization has its existing freshness limit, and later reinstatement is available.test
react-console:e2e/security/users.spec.ts#deactivating really shuts somebody out, and reactivating lets them back in

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software