Separate Staff Lifecycle Authorities

Context

Starting an import, accepting its result and destroying a workspace are different decisions. Permission boundaries should reflect those consequences.

Decision

Separate staff authority for construction, inspection, import, activation and deletion decisions, while keeping application lifecycle calls internal.

Alternatives Considered

One administrative permission for everything: One key would collapse distinct import, activation and destruction authority. Customer-administrator lifecycle actions: Customer administration does not authorize staff lifecycle operations.

Consequences

The route authorizer rejects customer administrators before staff handlers run. Import authority alone cannot activate, and hold authority alone cannot cancel. Security retains the role-to-key distribution.