Skip to content

CAP-PFM-SEC-016Administer Rhythm staff memberships

Markdown

CAP-PFM-SEC-016

Administer Rhythm staff memberships

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

KindCapabilityProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
HQ provides a separate administration surface for Rhythm memberships.Founding-staff reconciliation supports initial environment administration.Administrator safety checks preserve a remaining active Rhythm Administrator.
Surfaces
consoleapi
Intent sources
services-platform:docs/hq/rhythm-hq-plan.md#H1services-platform:docs/hq/rhythm-hq-plan.md#H2services-platform:docs/hq/rhythm-hq-plan.md#H3services-platform:docs/hq/rhythm-hq-plan.md#Acceptance checkpoints (2026-10-12 Final acceptance: phase 1)services-platform:docs/security/invitation-lifecycle.md#Founding staff (Andrew, 2026-10-12)

Controls

41 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-CHG-001 TC-CHG-002 TC-CHG-003 TC-CHG-004 TC-CHG-005 TC-CHG-006 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-001 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-001 TC-LOG-005 TC-MON-001 TC-MON-003 TC-PI-001 TC-PI-003 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.staff.readapiglobal
hq.staff.inviteapiglobal
hq.staff.disableapiglobal
hq.staff.updateapiglobal
hq.roles.readapiglobal
hq.roles.manageapiglobal

Business Rules

11 rules, 7 to be proved before approval. A rule's product intent is derived from its origin: 11 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
HQ staff operations require staff status and the permission declared by that operation. Customer Administrator authority is insufficient; staff status alone does not supply a missing key.
no proof recorded yet
permissionapitest
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses an administrator of a customer, holding every key at that customer, as 403
02
Confirmed
The staff list returns only members of Rhythm’s customer, with case-insensitive name and email search, HQ-role filtering and last-authentication information.
policyapi, servicetest
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#never answers a console user of another customer, whose people are that customer's own
03must prove
Confirmed
A staff invitation targets Rhythm’s customer and assigns one of the three built-in staff roles at platform scope. Other role choices are rejected by name; assigning Rhythm Administrator also requires role-management authority.
no proof recorded yet
permissionserviceobserved
04must prove
Confirmed
HQ can replace the outstanding invitation for a still-invited staff member. Accepted memberships cannot be reinvited, and a person outside Rhythm’s staff returns not found without a message being sent.
origin: services-platform:docs/security/security-administration.md#15 (resending a staff invitation, 2026-10-12)
no proof recorded yet
lifecycleservicetest
05must prove
Confirmed
Staff suspension withdraws outstanding invitations and attempts to disable pool sign-in after the membership change. Revocation ends the membership and its grants and invitations; pool failures must not be described as rollback of committed membership changes.
no proof recorded yet
lifecycleserviceobserved
06must prove
Confirmed
An operation that would remove the last active Rhythm Administrator must reject and roll back its change, whether it changes the role, suspends, revokes or deletes the membership.
no proof recorded yet
invariantservicetest
07must prove
Confirmed
The shared catalog supplies Rhythm Administrator with HQ administration, Support Representative with HQ reading and deletion hold authority, and Software Engineer with HQ reading and custom-query-table authoring. The HQ and lifecycle plans differ on Support’s deletion authority.
no proof recorded yet
policyservicetest
services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives Support Representative the HQ reader and the deletion hold, at platform scope, and no customer app; services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives Software Engineer the same HQ reader, the deletion request to read, and the custom query tables to author
08must prove
Confirmed
Deployment reconciles a configured founding-staff list into active memberships and roles without invitation acceptance. Existing suspended or revoked founders remain unchanged, and removing a configured name does not remove its membership. Eligible founders can begin with Google sign-in.
origin: services-platform:docs/security/invitation-lifecycle.md#Founding staff (Andrew, 2026-10-12)
no proof recorded yet
lifecycleservicetest
services-platform:modules/security/tests/integration/services/provisioning/ensure-founding-staff.integration.spec.js#leaves exactly one assignment: Rhythm Administrator at platform scope, active
09
Confirmed
HQ staff detail returns profile information, last authentication and customer-workspace access grants. A console membership belonging to another customer is answered as not found.
policyapi, servicetest
services-platform:modules/security/tests/e2e/hq-staff-detail.e2e.spec.js#answers a console user of another customer 404, as an unknown id
10
Confirmed
The accepted phase-one scope defers a requirement for staff multi-factor authentication.
policyservicedocumented
11
Confirmed
The staff-update and role-reading permission keys need an explicit product decision: attach them to operations or remove unused declarations.
policyapiunknown

Scenarios

IdGivenWhenThenProvenance
01A support recruit needs access to HQ.An authorized administrator invites the person with the Support role.Their staff role supplies HQ reading rather than staff administration. Customer workspace entry requires separate staff-access authority.test
react-console:e2e/mock/hq-ops.mock.spec.ts#the invite dialog takes a Rhythm address, a role, and offers to resend an invitation already sent

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.