Submissions Authorization Model

Authorization Boundary

Protected Submissions operations use Platform identity and scoped authorization. Application access, workspace availability and the operation’s declared authority establish whether the request can proceed; record guards then determine the available view and action. Licensing constrains authorization when its enforcement mode is enabled. Public health reads require no role permission. Contributor link operations are also publicly reachable, but require a valid credential for one contribution request.

Customer staff authority differs from Rhythm platform authority. Platform controls staff entry into customer work through recorded access grants. Reporting uses the shared query service and its dataset keys. Trusted owning applications and scheduled work use machine execution paths rather than the customer policy bundles. The engine’s staff-only external requirement operation remains separate from the trusted intake and status invokes.

Scopes

Platform assigns authority at customer, workspace or resource scope. Submissions declares the process as a narrower resource for its process-scoped keys; service checks use that process when evaluating staff reach. The record keeps the unresolved gateway resource-declaration gap visible, so service filtering alone does not establish deployed enforcement for every configuration route.

Organizational-unit information on a process is not evidence of an organizational-unit permission boundary. Within a workspace, an applicant’s participation, a reviewer’s assignment or a contributor’s request provides narrower record reach. These relationships permit particular actions and views rather than granting general staff authority. Cached gateway decisions and signed context can retain earlier grants within the Platform validity window; withdrawal is not promised to take effect immediately.

Roles

The engine supplies administrator, coordinator, staff-reviewer and reader policies. The profiles below describe those policy bundles as area roles; Platform role assignments make them effective. A policy definition by itself grants no access. A custom role can combine several policies, and explicit denies and scope conditions still apply.

The engine administrator carries all customer-assignable engine keys, including sensitive interventions and confidential reading. The coordinator combines ordinary reading with configuration preparation and daily operational writes. The staff reviewer carries application access, assignment reading and contribution metadata reading; their assigned work provides the record reach. The reader carries ordinary inspection and eight dataset keys. The confidential contribution-response dataset belongs only to the administrator among these four bundles.

Platform’s Portal Member role adds four Submissions keys while the active catalogue declares them assignable. Its reading keys open participant routes, whose service guards restrict the person to their own work. Contributor link holders, owning applications and schedulers are actors with request or machine authority, rather than additional customer roles. Platform also generates read-only, user and administrator tier policies and composes shared customer roles from them. Those tier policies differ from the engine’s named bundles, especially the coordinator’s configuration writes and the reviewer’s limited reach.

Permission Catalogue

Each permission row identifies a declared entitlement and its engine operations. The structured catalogue also records surfaces and the existing rule references for additional guards. Dataset keys belong to shared Platform query execution. CRM applicant lookup requires separate CRM authority. Published layout, application-deletion and review-export entitlements do not establish implemented engine commands.

Permission	Purpose	Engine operations
crm.contacts.read	Find applicants in CRM while entering an application.	CRM owns the lookup operation; no engine operation grants CRM access.
submissions.application.access	Open Submissions and use assignment-based reviewer operations.	requestInformationForReview, listMyReviewAssignments, getReviewAssignment, acceptReviewAssignment, declineReviewAssignment, recuseReviewAssignment, delegateReviewAssignment, saveReviewResponse, submitReviewResponse, amendReviewResponse, declareReviewConflict
submissions.assignments.manage	Assign, reassign, revoke or refresh reviewer selection on a stage.	reassignReviewAssignment, revokeReviewAssignment, assignStageRunReviewers, reResolveStageRun
submissions.assignments.read	BR-CAP-SUB-SUB-010-01,BR-CAP-SUB-SUB-020-06	No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command.
submissions.conflicts.declare	Declare a conflict on behalf of a reviewer.	declareSubmissionConflict
submissions.conflicts.resolve	Clear or waive a declared conflict with a recorded explanation.	clearReviewConflict, waiveReviewConflict
submissions.contribution-requests.query	Query contribution request metadata through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.contribution-responses.query	Query confidential contribution response metadata through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.contributions.manage	Create and administer contribution requests as staff.	listContributionRequirements, createContributionRequest, getContributionRequest, resendContributionRequest, remindContributor, replaceContributor, cancelContributionRequest, revokeContributionRequest
submissions.contributions.read	Inspect contribution requests and permitted response content.	listContributionRequirements, createContributionRequest, listContributionRequests, getContributionRequest, resendContributionRequest, remindContributor, replaceContributor, cancelContributionRequest, getContributionResponse
submissions.contributions.read-confidential	Read confidential contribution content outside an assigned-reviewer projection.	getSubmission, getSubmissionRevision, downloadSubmissionAttachment, getContributionRequest, getContributionResponse
submissions.decisions.override	Replace a recorded decision while retaining the earlier result.	supersedeSubmissionDecision
submissions.decisions.record	Record a staff outcome or report acknowledgement of a decision.	recordSubmissionDecision, acknowledgeSubmissionDecision
submissions.definitions.create	Create or copy processes and create shared reasons.	createSubmissionDefinition, cloneSubmissionDefinition, createStatusReason, createDeclineReason
submissions.definitions.delete	Remove or archive processes and retire shared reasons.	removeSubmissionDefinition, removeStatusReason, removeDeclineReason
submissions.definitions.read	Inspect processes, their versions and stages, and shared reason lists.	listSubjectKinds, listSubmissionDefinitions, listOpenSubmissionDefinitions, getSubmissionDefinition, listSubmissionDefinitionVersions, getSubmissionDefinitionVersion, listWorkflowStages, dryRunSubmissionDefinitionVersionActions, listStatusReasons, getStatusReason, listDeclineReasons, getDeclineReason
submissions.definitions.update	Edit process drafts and reasons, replace stages and publish a prepared process version.	updateSubmissionDefinition, createSubmissionDefinitionVersion, updateSubmissionDefinitionVersion, publishSubmissionDefinitionVersion, replaceWorkflowStages, updateStatusReason, updateDeclineReason
submissions.engine.resolve-actions	Retry or skip failed follow-up work or retry a blocked timer with a recorded explanation.	retrySubmissionActionRun, skipSubmissionActionRun, retrySubmissionTimer
submissions.review-assignments.query	Query reviewer assignments through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.review-responses.query	Query assessment metadata through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.reviewer-rules.create	Create or copy reviewer rules and teams.	createReviewerRule, createReviewTeam, copyReviewTeam
submissions.reviewer-rules.delete	Remove or archive reviewer rules and teams.	removeReviewerRule, archiveReviewTeam
submissions.reviewer-rules.read	Inspect reviewer rules and teams.	listReviewerRules, getReviewerRule, listReviewTeams, getReviewTeam
submissions.reviewer-rules.update	Edit reviewer rules and teams.	updateReviewerRule, updateReviewTeam, replaceReviewTeamMembers
submissions.reviews.export	Carry the declared review-export entitlement, whose engine export route is absent.	No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command.
submissions.reviews.read-confidential	Read reviewer notes excluded from ordinary staff response views.	listSubmissionReviewResponses
submissions.rubrics.create	Create or copy scoring sheets.	createReviewRubric, copyReviewRubric
submissions.rubrics.delete	Remove or archive scoring sheets.	archiveReviewRubric
submissions.rubrics.read	Inspect scoring sheets.	listReviewRubrics, getReviewRubric, listRubricVersions, getRubricVersion
submissions.rubrics.update	Edit scoring sheets.	updateReviewRubric, createRubricVersion, updateRubricVersion, publishRubricVersion
submissions.stage-runs.query	Query stage progress through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.stages.complete	Report an external requirement completed through the staff-only system operation.	completeStageRunRequirement
submissions.stages.override	Close a stage early or waive a requirement with a recorded explanation.	closeStageRun, waiveStageRunRequirement
submissions.submission-decisions.query	Query outcomes through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.submission-layouts.create	Create or copy intake and review layouts, as a declared entitlement without an engine route.	No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command.
submissions.submission-layouts.delete	Remove or archive intake and review layouts, as a declared entitlement without an engine route.	No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command.
submissions.submission-layouts.read	Inspect intake and review layouts, as a declared entitlement without an engine route.	No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command.
submissions.submission-layouts.update	Edit intake and review layouts, as a declared entitlement without an engine route.	No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command.
submissions.submissions.create	Start an application under a published process.	startSubmission
submissions.submissions.delete	Carry the declared application-deletion entitlement, which has no engine route.	No engine HTTP operation requires this key; its declared policy or screen use does not establish a backend command.
submissions.submissions.manage	Close, reopen or correct an application administratively.	closeSubmission, reopenSubmission, correctSubmissionPayload
submissions.submissions.query	Query applications through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.submissions.read	Enter application-reading routes and inspect records through the caller’s allowed staff or participant view.	getSubmissionDefinitionProgress, startSubmission, listSubmissions, listOwnSubmissions, getSubmission, saveSubmissionPayload, addSubmissionAttachment, removeSubmissionAttachment, inviteSubmissionParticipant, submitSubmission, withdrawSubmission, closeSubmission, reopenSubmission, correctSubmissionPayload, getSubmissionRevision, downloadSubmissionAttachment, listOwnInformationRequests, respondToInformationRequest, listSubmissionActionRuns, listSubmissionTimers, listSubmissionConflicts, listContributionRequirements, createContributionRequest, listOwnContributionRequests, getContributionRequest, resendContributionRequest, remindContributor, replaceContributor, cancelContributionRequest, readContributionSignedIn, saveContributionDraftSignedIn, addContributionFileSignedIn, removeContributionFileSignedIn, submitContributionSignedIn, declineContributionSignedIn, withdrawContributionSignedIn, amendContributionSignedIn, readContributionReceiptSignedIn, listSubmissionDecisions, listSubmissionDecisionDeliveries, listReviewAssignments, listReviewerWorkload, listStageRuns, getStageRun, getReviewAssignmentForStaff, listSubmissionReviewResponses, listSubmissionEvents
submissions.submissions.update	Edit application content or perform permitted application writes as staff.	saveSubmissionPayload, addSubmissionAttachment, removeSubmissionAttachment, inviteSubmissionParticipant, submitSubmission, withdrawSubmission, respondToInformationRequest, requestInformationForReview
submissions.workflow-action-runs.query	Query follow-up runs through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.
submissions.workflow-timers.query	Query follow-up timers through Platform’s governed dataset service.	The shared Platform query service evaluates the dataset key; the engine declares no HTTP operation for it.

The structured catalogue preserves the service contracts’ compound permission labels and public-access markers as references. These entries are explicitly marked as expressions or access markers, have no role grants, and introduce no additional permission. An additionally evaluated key supports the handler’s access choice; it is not automatically a second permission that every participant must hold.

Role Entitlement Matrix

The matrix shows each profile’s declared Submissions keys. A conditional Portal Member entry depends on the active permission catalogue. Actual access also depends on assignments, scope, explicit denies, application availability and record guards. CRM lookup remains an independently assigned entitlement. No customer profile includes the staff-only external requirement key.

Permission	Engine administrator	Coordinator	Staff reviewer	Reader	Portal member
crm.contacts.read	—	—	—	—	—
submissions.application.access	Yes	Yes	Yes	Yes	Conditional
submissions.assignments.manage	Yes	Yes	—	—	—
submissions.assignments.read	Yes	Yes	Yes	Yes	—
submissions.conflicts.declare	Yes	Yes	—	—	—
submissions.conflicts.resolve	Yes	—	—	—	—
submissions.contribution-requests.query	Yes	Yes	—	Yes	—
submissions.contribution-responses.query	Yes	—	—	—	—
submissions.contributions.manage	Yes	Yes	—	—	—
submissions.contributions.read	Yes	Yes	Yes	Yes	—
submissions.contributions.read-confidential	Yes	—	—	—	—
submissions.decisions.override	Yes	—	—	—	—
submissions.decisions.record	Yes	Yes	—	—	—
submissions.definitions.create	Yes	Yes	—	—	—
submissions.definitions.delete	Yes	—	—	—	—
submissions.definitions.read	Yes	Yes	—	Yes	Conditional
submissions.definitions.update	Yes	Yes	—	—	—
submissions.engine.resolve-actions	Yes	—	—	—	—
submissions.review-assignments.query	Yes	Yes	—	Yes	—
submissions.review-responses.query	Yes	Yes	—	Yes	—
submissions.reviewer-rules.create	Yes	Yes	—	—	—
submissions.reviewer-rules.delete	Yes	—	—	—	—
submissions.reviewer-rules.read	Yes	Yes	—	Yes	—
submissions.reviewer-rules.update	Yes	Yes	—	—	—
submissions.reviews.export	Yes	Yes	—	—	—
submissions.reviews.read-confidential	Yes	—	—	—	—
submissions.rubrics.create	Yes	Yes	—	—	—
submissions.rubrics.delete	Yes	—	—	—	—
submissions.rubrics.read	Yes	Yes	—	Yes	—
submissions.rubrics.update	Yes	Yes	—	—	—
submissions.stage-runs.query	Yes	Yes	—	Yes	—
submissions.stages.complete	—	—	—	—	—
submissions.stages.override	Yes	—	—	—	—
submissions.submission-decisions.query	Yes	Yes	—	Yes	—
submissions.submission-layouts.create	Yes	Yes	—	—	—
submissions.submission-layouts.delete	Yes	—	—	—	—
submissions.submission-layouts.read	Yes	Yes	—	Yes	—
submissions.submission-layouts.update	Yes	Yes	—	—	—
submissions.submissions.create	Yes	Yes	—	—	Conditional
submissions.submissions.delete	Yes	Yes	—	—	—
submissions.submissions.manage	Yes	Yes	—	—	—
submissions.submissions.query	Yes	Yes	—	Yes	—
submissions.submissions.read	Yes	Yes	—	Yes	Conditional
submissions.submissions.update	Yes	Yes	—	—	—
submissions.workflow-action-runs.query	Yes	Yes	—	Yes	—
submissions.workflow-timers.query	Yes	Yes	—	Yes	—

Protected Actions

Early stage closure, requirement waiver, conflict clearance or waiver, corrected decisions and recovery of failed follow-up require their exceptional permissions and an explanation retained by the engine. Confidential response reading uses separate keys; contribution confidentiality also depends on the permitted view, and confidential staff contribution reads are recorded. Ordinary staff decision recording is constrained by the process’s declared outcomes and the state of review work.

Reviewer writes require the caller’s own eligible assignment and a permitted assignment or run state. Applicant writes require the relevant participation rights and an editable application. Contributor commands require a live request and a permitted response transition; a private link grants reach to that request alone. External requirement completion requires staff platform authority at the system boundary. Owner acknowledgement records the caller’s reported handling outcome, while the trusted owner acknowledgement integration remains an existing gap.

Guards Distinguished From Permissions

A permission names an authority that Platform can assign. A guard checks the record or the circumstances under which that authority can act. Workspace and process reach, participation, assignment identity, conflicts, blind projection, frozen publication, lifecycle status and optimistic versions are guards. They do not become additional permission keys. Holding general staff read authority selects a broader staff view; a reviewer policy alone does not do so.

The assigned-reviewer screen checks assignment-reading authority, while its review operations declare application access and verify participation. The redirect screens can attempt a staff lookup or fall back to assigned work; they do not establish an additional hard page gate. An unavailable or refused dependency does not grant broader record reach.

What People See When Refused

Protected requests reject missing security context or insufficient authority. A caller with no reach to an application receives an absent-record response, just as for an unknown record; a caller who can see it but lacks the requested action receives a permission refusal. The contributor link API response gives the same explanation for an invalid, expired or otherwise unusable link and asks the recipient to request a replacement. It does not disclose which condition caused refusal.

The console uses its permission checks to limit offered actions, while the server remains responsible for enforcement. When CRM refuses applicant search, the picker explains that the person needs CRM read access and should ask their administrator for the CRM read-only role. Publication, invalid fields and concurrent changes have their own errors; those messages describe failed guards rather than a missing role.