01must proveConfirmed | HQ staff operations require staff status and the permission declared by that operation. Customer Administrator authority is insufficient; staff status alone does not supply a missing key. no proof recorded yet | permission | api | test |
02Confirmed | The staff list returns only members of Rhythm’s customer, with case-insensitive name and email search, HQ-role filtering and last-authentication information. | policy | api, service | test |
03must proveConfirmed | A staff invitation targets Rhythm’s customer and assigns one of the three built-in staff roles at platform scope. Other role choices are rejected by name; assigning Rhythm Administrator also requires role-management authority. no proof recorded yet | permission | service | observed |
04must proveConfirmed | HQ can replace the outstanding invitation for a still-invited staff member. Accepted memberships cannot be reinvited, and a person outside Rhythm’s staff returns not found without a message being sent. no proof recorded yet | lifecycle | service | test |
05must proveConfirmed | Staff suspension withdraws outstanding invitations and attempts to disable pool sign-in after the membership change. Revocation ends the membership and its grants and invitations; pool failures must not be described as rollback of committed membership changes. no proof recorded yet | lifecycle | service | observed |
06must proveConfirmed | An operation that would remove the last active Rhythm Administrator must reject and roll back its change, whether it changes the role, suspends, revokes or deletes the membership. no proof recorded yet | invariant | service | test |
07must proveConfirmed | The shared catalog supplies Rhythm Administrator with HQ administration, Support Representative with HQ reading and deletion hold authority, and Software Engineer with HQ reading and custom-query-table authoring. The HQ and lifecycle plans differ on Support’s deletion authority. no proof recorded yet | policy | service | test |
08must proveConfirmed | Deployment reconciles a configured founding-staff list into active memberships and roles without invitation acceptance. Existing suspended or revoked founders remain unchanged, and removing a configured name does not remove its membership. Eligible founders can begin with Google sign-in. no proof recorded yet | lifecycle | service | test |
09Confirmed | HQ staff detail returns profile information, last authentication and customer-workspace access grants. A console membership belonging to another customer is answered as not found. | policy | api, service | test |
10Confirmed | The accepted phase-one scope defers a requirement for staff multi-factor authentication. | policy | service | documented |
11Confirmed | The staff-update and role-reading permission keys need an explicit product decision: attach them to operations or remove unused declarations. | policy | api | unknown |