Rhythm 2.0 Specifications

Appearance

CAP-SUB-SUB-020Give staff and participants the authority their work requires

Markdown

CAP-SUB-SUB-020

Give staff and participants the authority their work requires

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

Planning

Feature
FEAT-SUB-SUB-06
Key concepts
CON-SUB-SUB-001, CON-SUB-SUB-002, CON-SUB-SUB-003
Actors
ACT-SUB-001, ACT-SUB-002, ACT-SUB-003, ACT-SUB-004, ACT-SUB-005, ACT-SUB-006, ACT-SUB-007
Related
CAP-SUB-SUB-010, CAP-SUB-SUB-017, CAP-SUB-SUB-019
Proved by
ATS-SUB-SUB-020

KindCapabilityProduct areaSubmissionsModuleSubmissions, Intake, Review and OutcomesRevision1

Read atservices-submissions 64236c19react-console baf6dae3

Give staff and participants the authority their work requires ​

Purpose ​

Role policies and participation access separate oversight, operation, judgment and exceptional intervention.

How It Works ​

The application gate establishes whether Submissions is available to the caller. Staff permissions then determine which configuration and operational actions are allowed. Reviewers use their assignments instead of general staff-reading rights. Applicants and contributors use their relevant participation or request access. Service filters and database policies constrain records to the allowed workspace and process scope. Console controls translate those powers into available actions. Published but unused keys and deployed authorization-cache behavior remain visible examination findings.

Relationships ​

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Built-in policies distinguish operational authorityReviewers reach assigned work through participationWorkspace and process boundaries constrain access
Surfaces
consoleapi
Intent sources
services-submissions:docs/milestones/plans/SUBM-M1-plan.md#D8services-submissions:docs/milestones/plans/SUBM-M1-plan.md#D9services-submissions:docs/milestones/plans/SUBM-M1-plan.md#S08services-submissions:docs/milestones/plans/SUBM-M1-plan.md#S13services-submissions:docs/milestones/SUBM-M1-staff-review-in-the-console.md#E1services-submissions:docs/milestones/SUBM-M1-staff-review-in-the-console.md#E2

Controls

25 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-CRY-001 TC-CRY-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-PI-001 TC-SEC-001 TC-SEC-002 TC-SEC-003 TC-SEC-004 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004

Permissions

KeyChecked atScope
submissions.application.accessapitenant
submissions.definitions.readapitenant
submissions.submissions.readapitenant
submissions.submission-layouts.readapitenant
submissions.submission-layouts.createapitenant
submissions.submission-layouts.updateapitenant
submissions.submission-layouts.deleteapitenant
submissions.submissions.deleteapitenant
submissions.assignments.readapitenant

Business Rules

13 rules, 9 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
The built-in administrator, coordinator, reviewer and reader policies separate comprehensive control, operational writes, assignment-only work and read access, with overrides and confidential access reserved to the administrator tier.
origin: services-submissions:docs/milestones/plans/SUBM-M1-plan.md#D8
no proof recorded yet
permissionapiobserved
services-submissions:aws/submissions.service.ts:SUBMISSIONS_BUILT_IN_POLICIES
02must prove
Proposed
Reviewers lack general application-reading permission and need additional reader authority for wider oversight.
origin: services-submissions:docs/milestones/plans/SUBM-M1-plan.md#D9
no proof recorded yet
permissionapitest
services-submissions:modules/review/tests/e2e/review.e2e.spec.js#does not hold the staff-wide read key
03must prove
Proposed
Protected requests enforce application access, licensing and the applicable record authority and reject absent security context.
origin: services-submissions:docs/milestones/plans/SUBM-M1-plan.md#SUBM-M1-S08
no proof recorded yet
permissionapitest
services-submissions:modules/definitions/tests/e2e/subject-kinds.e2e.spec.js#answers 403 app_not_permitted to a caller denied submissions.application.access
04must prove
Proposed
Users without Submissions authority do not receive its navigation entry and cannot use protected operations.
origin: services-submissions:docs/milestones/plans/SUBM-M1-plan.md#SUBM-M1-S08
no proof recorded yet
permissionapi, consoleobserved
react-console:components/console/nav-config.ts
05must prove
Proposed
Service access filters honor process-scoped grants and hide other processes, while deployed gateway scope enforcement remains a separately reported uncertainty.
origin: services-submissions:docs/milestones/plans/SUBM-M1-plan.md#A3
no proof recorded yet
permissionapi, serviceobserved
services-submissions:modules/intake/services/persistence/submissions.ts:definitionsReadable
06must prove
Proposed
Applicants, representatives, contributors and reviewers reach records through their participation, request access or assignment; outsiders receive an absent-record response.
no proof recorded yet
permissionservicetest
services-submissions:tests/unit/route-authorization.spec.ts#serve the reviewer’s own work as participation under submissions.application.access alone, and staff work under its own key
07must prove
Proposed
Service reads and database policies isolate workspace records and reject attempts to reach another workspace.
no proof recorded yet
permissionapi, databaseobserved
services-submissions:modules/intake/db/submissions.table.ts
08must prove
Proposed
External requirement completion is reserved to a staff-only permission omitted from built-in customer policies and unavailable for customer-role grants.
origin: DEF-SUB-0636 (SUBM-M1 run subm1api)
no proof recorded yet
permissionapitest
services-submissions:tests/unit/built-in-policies-staff-only.spec.ts#refuses a planted policy that carries submissions.stages.complete
09
Proposed
Staff reviewing uses workspace user identities, while staff application entry requires CRM applicant-lookup rights.
origin: services-submissions:docs/milestones/SUBM-M1-staff-review-in-the-console.md#E2
policyservice, consoledocumented
services-submissions:docs/milestones/SUBM-M1-staff-review-in-the-console.md#Decisions
10
Proposed
Console abilities translate engine permissions into administrator controls, coordinator creation and editing without configuration deletion and reader-only viewing.
origin: services-submissions:docs/milestones/plans/SUBM-M1-plan.md#D8
permissionconsoletest
react-console:lib/submissions/config/abilities.test.ts#${noun}: the coordinator can create and edit but is offered no Delete
11
Proposed
The inventory describes sixty-second warm-route caching plus another thirty seconds of signed-context validity, without independently establishing the current deployed revocation window.
permissionapidocumented
react-console:acceptance/submissions/journeys/security/SUB-ACC-0642.json
12must prove
Proposed
Assignment-read, review-export, application-delete and four layout permissions remain published despite having no route enforcement.
origin: services-submissions:docs/milestones/README.md#Questions carried to later plans (each to be written out in full for Andrew, R2-DEV-001 section 8.1)
no proof recorded yet
permissionapiobserved
services-submissions:aws/submissions.service.ts:SUBMISSIONS_PERMISSION_SETS
13
Proposed
Submissions records do not support custom fields, while owning applications retain their own field-bearing domain records.
origin: services-submissions:docs/milestones/plans/SUBM-M1-plan.md#7a. Entity capabilities (R2-ARCH-001)
policyservicedocumented
services-submissions:docs/milestones/plans/SUBM-M1-plan.md#7a. Entity capabilities (R2-ARCH-001)

Scenarios

IdGivenWhenThenProvenance
01The caller has reader authority over the award and an entry.They inspect configuration and attempt changes.The screens permit inspection while changes are denied.test
react-console:acceptance/submissions/playwright/journeys/security/SUB-ACC-0668.spec.ts#SUB-ACC-0668

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software