Skip to content

CAP-PFM-SEC-014Derive member access from appointments and eligibility

Markdown

CAP-PFM-SEC-014

Derive member access from appointments and eligibility

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationPartially observed

KindCapabilityProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1

Read atservices-platform ad3f6a65

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Derived assignments remain attributable to their source.Reconciliation preserves manual grants while updating rule-based access.Sign-in and scheduled work provide additional opportunities to refresh eligibility-derived grants.
Surfaces
apijobportal
Intent sources
services-platform:docs/security/security-administration.md#4a. Derived assignments (D-31, D-32, Andrew 2026-10-17)services-platform:docs/milestones/PLAT-M13-eligibility-roles-and-permissions.md#Scope in one paragraph

Controls

44 controls apply, from the corpus control catalogue.

TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-006 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-MON-003 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-SEC-001 TC-SEC-002 TC-SEC-003 TC-SEC-004 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.security-roles.manageapitenant
platform.eligibility.reconcileapiglobal

Business Rules

13 rules, 11 to be proved before approval. A rule's product intent is derived from its origin: 6 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Derived assignments attach to contacts before portal login exists and authorize only the workspace’s portal membership linked to that contact, never console memberships.
origin: services-platform:docs/security/security-administration.md#4a. Derived assignments (D-31, D-32, Andrew 2026-10-17)
invariantservice, databasetest
services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js#is refused once the member is no longer linked to the contact, so the link is what carries the grant
02must prove
Confirmed
The system synchronization path accepts only listed derivation sources and valid workspace/resource scopes and active roles within the customer; invalid source, scope or role rejects the desired set without partial insertion.
origin: services-platform:docs/security/security-administration.md#4a. Derived assignments (D-31, D-32, Andrew 2026-10-17)
validationservice, databasetest
services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a whole desired set when one entry is refused, inserting none of the others
03must prove
Confirmed
Synchronization updates validity in place, revokes undesired grants and audits changes as system work, while an unchanged desired set produces no mutations.
origin: services-platform:docs/security/security-administration.md#4a. Derived assignments (D-31, D-32, Andrew 2026-10-17)
lifecycleservicetest
services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#revokes by omission: a row of the key that is no longer desired is revoked, by the actor, and audited
04must prove
Confirmed
Ordinary assignment management refuses derived-grant edits and withdrawal and directs administrators to the originating appointment or rule.
origin: services-platform:docs/security/security-administration.md#4a. Derived assignments (D-31, D-32, Andrew 2026-10-17)
permissionservicetest
05must prove
Confirmed
Request-time evaluation applies a derived grant’s stored validity boundary even when the signed authorization context predates its expiry.
origin: services-platform:docs/security/security-administration.md#4a. Derived assignments (D-31, D-32, Andrew 2026-10-17)
policyservicetest
services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js#refuses the same still-unexpired context once valid_until has passed, because validity is read per request
06
Confirmed
The member’s access document identifies derived assignments and their source.
origin: services-platform:docs/security/security-administration.md#4a. Derived assignments (D-31, D-32, Andrew 2026-10-17)
policyservicetest
services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js#lists the derived grant in the member’s own access document, saying it is derived by committees from its key
07must prove
Proposed
An editable customer role can reference one workspace eligibility binding with a five-minute to thirty-day refresh interval and one-day default; built-ins, wrong binding kinds and duplicate role bindings fail.
validationapi, service, databasetest
services-platform:modules/security/tests/e2e/role-eligibility.e2e.spec.js#refuses a built-in role as a conflict, because no tenant’s rule may assign Rhythm’s role
08must prove
Proposed
Eligibility reconciliation creates or reconfirms contact grants for eligible subjects, revokes ineligible grants, preserves indeterminate results and manual grants, and does not derive organization access.
calculationservicetest
services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#never touches the manual assignment: no derivation, no window, its first version
09must prove
Proposed
Portal password sign-in reconciles the linked member’s eligibility roles before returning tokens; evaluator failure is logged without blocking sign-in.
policyservicetest
10
Proposed
Nightly reconciliation uses one job identity per workspace and night to avoid duplicate submissions.
lifecycleservicetest
services-platform:modules/security/tests/integration/lifecycle/derived-assignment-nightly/nightly-reconcile.integration.spec.js#submits one job for the tenant, under the tenant and the night, and the same job when the schedule fires again
11must prove
Proposed
Staff-requested reconciliation accepts at most 100 contacts, queues pending subjects once and handles redelivery without duplicate assignments.
policyapi, servicetest
12must prove
Proposed
Eligibility-conditioned policy rules must reference assignment-condition bindings from the owning customer’s workspaces.
validationservicetest
services-platform:modules/security/tests/integration/services/definitions/eligibility-conditions.integration.spec.js#refuses a binding of another customer’s tenant, naming it, and stores no policy
13must prove
Proposed
The product should complete the role editor’s automatic-assignment control and settle contact-versus-login ownership before accepting the proposed milestone.
no proof recorded yet
policyconsoleunknown

Scenarios

IdGivenWhenThenProvenance
01Dana holds a dated board appointment represented by a contact.The appointment owner synchronizes the corresponding authority.Dana’s linked portal membership can use the resulting scoped role within its validity window.test
services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js#serves the protected route for the unit the grant names, inside its validity

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.