Skip to content

CAP-PFM-TNL-004Prepare the customer’s first access and sender

Markdown

CAP-PFM-TNL-004

Prepare the customer’s first access and sender

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

KindCapabilityProduct areaPlatformModuleWorkspace Lifecycle Across ApplicationsRevision2

Read atservices-platform ad3f6a65

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
A named first administrator for a new customer receives one customer-level invitation.Sender setup proceeds while DNS verification remains pending.Portal interest is retained for later onboarding.
Surfaces
consoleapijob
Intent sources
services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.3services-platform:docs/hq/rhythm-hq-plan.md#§K decision record K3, K5

Controls

32 controls apply, from the corpus control catalogue.

TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.tenants.provisionapiglobal

Business Rules

9 rules, 8 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Provisioning invites a named first administrator only when the request also creates the customer.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.3 platform.security (approved 2026-10-09)
no proof recorded yet
policyservicetest
02must prove
Proposed
The invitation gives a console user the built-in Administrator role at customer scope, pending acceptance.
no proof recorded yet
policyservicetest
services-platform:modules/tenants/tests/integration/services/lifecycle/first-administrator.integration.spec.js#grants that user the Administrator role at the customer, waiting on their acceptance
03must prove
Proposed
Retry adopts a compatible existing administrator or invitation instead of sending a second invitation.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.3 seed key first-administrator-invitation (approved 2026-10-09)
no proof recorded yet
invariantservicetest
04must prove
Proposed
An existing person without usable customer administration authority causes refusal, including suspension, the wrong role or scope, or an ineffective grant period.
no proof recorded yet
validationservicetest
services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses a SUSPENDED user, whatever they hold: an administrator nobody can use is none
05must prove
Proposed
Sender validation rejects unsupported strategies, invalid domain hostnames, domains on address-only strategies and addresses outside the chosen domain before request writes.
origin: services-platform:docs/hq/rhythm-hq-plan.md#§D5 option A (K3, Andrew 2026-10-11)
no proof recorded yet
validationservicetest
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#refuses an address outside the domain, because an identity proved for one domain may not send as another
06must prove
Proposed
A domain sender request can use the workspace’s hostname identifier when no domain is supplied.
no proof recorded yet
calculationservicetest
07must prove
Proposed
Provisioning creates sender identities and opens without DNS verification; pending identities leave mail using Rhythm’s shared sender.
origin: services-platform:docs/hq/rhythm-hq-plan.md#§D5 option A (K3, Andrew 2026-10-11)
no proof recorded yet
policyservicetest
08
Proposed
Without a sender strategy, provisioning creates no sender identity and retains shared sending.
policyservicetest
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#writes no sender identity, because the shared Rhythm sender is the answer for most tenants
09must prove
Proposed
Provisioning records a portal request without building a portal sign-in pool.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.3 security.portal-pool (Andrew, 2026-10-16); services-platform:docs/hq/rhythm-hq-plan.md#§D6 (K5)
no proof recorded yet
policyservicetest
services-platform:modules/tenants/tests/unit/services/lifecycle/participants.spec.js#creates nothing when a tenant is provisioned, because the pool is built when Websites is enabled

Scenarios

IdGivenWhenThenProvenance
01A new association names its first administrator and requests a domain sender.Provisioning completes.The person has one invitation, the workspace opens and sender setup supplies the DNS records still needed.test

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.