This is an internal working record, not an everyday instruction. It was written while the system was being rebuilt, for whoever maintains it. If you are here to do today's work, use the everyday documents instead: Procedures · Processes · Runbooks · The working day, step by step
Platform Authorization — Current Operational Action Matrix — 2026-08-08¶
- Status:
CURRENT STATIC ACTION MATRIX / ENVIRONMENT ACCEPTANCE REQUIRED - Review ref:
qa/master@2c0dd0bfadde7633337ec4357be1cbf9835c5c8b - Source refresh:
PLATFORM_AUTHORIZATION_CURRENT_SURFACE_REFRESH_2026-08-08.md - Previous policy:
PLATFORM_AUTHORIZATION_ACCESS_POLICY_AND_SEQUENCE.md - Evidence package:
RBR-ACCESS-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md - Phase implementation:
USER HOLD
1. Matrix Rule¶
For each current action, preserve all layers independently.
Page/menu findability
API route availability
Module availability
Actor permission
Tenant/record relation
Record-state eligibility
Effect eligibility
Authoritative result readback
A blank route-role column means no dedicated role metadata was found at route registration. It does not mean anonymous or cross-tenant access because authentication, module and tenant-scoped handlers still apply.
A handler role predicate does not replace the record/state predicate.
2. Loader Work Assignment¶
| Action | Page/UI | Route | Route guard | Handler actor predicate | Record/state predicate | Effect | Current disposition |
|---|---|---|---|---|---|---|---|
| Read own current/next | inbound-loader |
GET /tms/transloads/work-assignments/current |
tms.transload; no dedicated route role |
effective staff user | tenant; own loader queue; Work Assignment rows | none | source mapped; role/page evidence required |
| Manager list | inbound-planning |
GET /tms/transloads/work-assignments |
tms.transload; no dedicated route role |
role name contains Administrator/Office Manager/Manager | tenant; Work Assignment rows | none | UI numeric gate and API role-name gate require parity evidence |
| Manager create | inbound-planning |
POST /tms/transloads/work-assignments |
tms.transload; no dedicated route role |
same manager predicate | Loader clocked in; no queued Clock Out; tenant; type validation | DB row, Telegram attempt | action role not represented at router |
| Start | inbound-loader |
POST /.../{id}/start |
tms.transload; no dedicated route role |
assigned Loader or manager | tenant; exact planner; SCHEDULED; clocked in; no break/competing job |
DB + Staff Time; external time sync after commit | self/manager relation is handler-owned |
| Complete work | inbound-loader |
POST /.../{id}/complete |
tms.transload; no dedicated route role |
assigned Loader or manager | exact active non-Clock-Out row; STARTED |
DB + Staff Time; external time sync after commit | source mapped |
| Cleaning complete | inbound-loader |
POST /.../{id}/advance-clock-out |
tms.transload; no dedicated route role |
assigned Loader or manager | active Clock Out; cleaning required; current prerequisite | DB and optional Final Break planner | source mapped; current dual-contract issue remains separate |
| Workflow Clock Out | inbound-loader |
POST /.../{id}/clock-out |
tms.transload; no dedicated route role |
assigned Loader or manager | active Clock Out; cleaning/final-break prerequisites | DB + Staff Time + external time sync | source mapped; general Clock Out bypass evidence remains required |
| Cancel scheduled | inbound-planning |
DELETE /.../{id} |
tms.transload; no dedicated route role |
manager predicate | exact SCHEDULED row |
DB | source mapped |
2.1 Page/API parity questions¶
Does every intended manager role satisfy both the numeric page gate and role-name handler gate?
Does a role satisfy one but not the other?
Can a Loader access only own current/start/complete actions?
Can a manager act on another Loader only through intended UI?
Do hidden direct requests return denial without mutation?
3. Street Turn¶
| Action | Page/UI | Route | Route guard | Handler actor predicate | Record/state predicate | Effect | Current disposition |
|---|---|---|---|---|---|---|---|
| Search matching export Booking | Import Dispatch Street Turn modal | GET /tms/bookings/search |
tms.booking; no dedicated route role |
none beyond route/session found | tenant; EXPORT; shipping line; size quantity; cutoff | none | read access inherited from Booking module |
| Create Street Turn | import-dispatch / container editor |
POST /yms/containers/street-turn |
yms.container-tracking; no dedicated route role |
no explicit action-role predicate located | tenant; exact EMPTY load/equipment; matching active Booking; supported size | source load update + generated load + equipment update | action permission not explicit |
| Revert Street Turn | export empty container views | POST /tms/export-containers/revert |
tms.booking; no dedicated route role |
no explicit action-role predicate located | exact generated load; AVAILABLE; no Delivery/Transload; matched prior RETURNED load | generated load soft-delete + prior load restore + equipment update | action permission not explicit; separate module from create |
3.1 Cross-module question¶
Create module = yms.container-tracking
Revert module = tms.booking
The accepted actor set for create and revert must be documented separately. Access to one module cannot be treated as proof that both actions are authorized.
4. Final Loading Review¶
| Action | Page/UI | Route | Route guard | Handler actor predicate | Record/state predicate | Effect | Current disposition |
|---|---|---|---|---|---|---|---|
| Read review queue | inventory-adjustment |
GET /wms/inventory/bale-reviews |
wms.inventory; no dedicated route role |
no action role predicate | tenant; query filters | none | page/menu/role evidence required |
| Update outbound | same | POST /.../update-outbound |
wms.inventory; no dedicated route role |
Client 1 numeric roles 1/2/3; other tenants no equivalent explicit role predicate in helper | Pending; expected old values; transloaded/spare eligibility | DB correction and state recalculation | numeric tenant asymmetry |
| Apply inbound weight | same | POST /.../apply-weight |
wms.inventory; no dedicated route role |
same helper | expected action and current review state | DB correction | numeric tenant asymmetry |
| Source/leftover adjustments | same | owner-specific inventory routes | wms.inventory |
current office/helper rules vary | Lot/Ledger/state predicates | DB inventory effects | must be evaluated per owner route |
| Confirm | same | POST /.../confirm |
wms.inventory; no dedicated route role |
same helper | Ready state and domain checks | DB confirmation | numeric tenant asymmetry |
| Bulk confirm | same | POST /.../bulk-confirm |
wms.inventory; no dedicated route role |
same helper | per-row eligibility | DB multi-row confirmation | partial/rollback semantics owner-specific |
| Reopen | same | POST /.../reopen |
wms.inventory; no dedicated route role |
same helper | confirmed/reopen eligibility | DB state reversal | numeric tenant asymmetry |
4.1 Current policy question¶
Client 1 has a numeric office-role guard. Other tenants do not receive that exact restriction from this helper. The target policy must be based on operating profile and named action capability, not copied customer IDs.
5. Billing And QBO¶
| Action | Page/UI | Route | Route guard | Handler actor predicate | Record/state predicate | Effect | Current disposition |
|---|---|---|---|---|---|---|---|
| Read workbench/options | ar-billing |
GET /bms/ar-billing/{options,workbench} |
bms.transaction; no dedicated route role |
no explicit action-role predicate located | tenant; schema/source filters | none | current menu/role data required |
| Read presets/rates | billing-presets / ar-billing |
GET preset/rate routes | same | no explicit action-role predicate located | tenant | none | current menu/role data required |
| Create/update/delete preset | Billing Presets | POST/PATCH/DELETE preset routes | same | no explicit action-role predicate located | tenant; preset/company validation | DB configuration/business policy | high-impact action role unresolved |
| Edit company rates | Billing Presets | PATCH /bms/ar-billing/rates/form |
same | no explicit action-role predicate located | tenant; default-rate protections | DB rate mutation | high-impact action role unresolved |
| Preview | AR Billing | POST /bms/ar-billing/preview |
same | no explicit action-role predicate located | source/preset/rate validation | none | write-like request without durable result |
| Confirm local AR | AR Billing | POST /bms/ar-billing/confirm |
same | no explicit action-role predicate located | tenant; source; current QBO state; transaction rules | DB local AR header/lines | high-impact action role unresolved |
| Deliver QBO invoice | AR Billing | POST /bms/ar-billing/qbo-sync |
same | no explicit action-role predicate located | tenant; READY/ERROR claim and provider config | QBO create + local result save | finance/provider role unresolved |
5.1 Current menu evidence limitation¶
Historical migration text contains broad numeric menu roles, but current installed T_MENU, T_ROLE, T_USER, T_TENANT_MODULE and page behavior have not been read. Repository migration text is not current authorization evidence.
6. Document Email Actions¶
| Action | Page/UI | Route | Route guard | Handler actor predicate | Record/state predicate | Effect | Current disposition |
|---|---|---|---|---|---|---|---|
| Send BOL | Transload UI | POST /tms/transloads/{id}/bol-email |
tms.transload; no dedicated route role |
no explicit action-role predicate located | tenant Transload; recipient; file/scale attachment readiness | Gmail send | intended sender roles unresolved |
| Send Packing List | Packing List | POST /tms/bookings/{id}/packing-list/email |
tms.booking; no dedicated route role |
no explicit action-role predicate located | tenant Booking; report mode; recipient; output prerequisites | one or more Gmail sends | intended sender roles unresolved |
| Update Packing equipment values | Packing List | PATCH /.../packing-list/equipment-loads |
tms.booking; route roles 1–6 |
numeric route role | tenant Booking/equipment relation | DB | role metadata exists but semantic acceptance remains unverified |
| Update Packing rates | Packing List | PATCH /.../packing-list/rates |
tms.booking; route roles 1–6 |
numeric route role | tenant Booking/Sales Order Item relation | DB rate change | broad numeric role set requires field evidence |
7. Candidate Target Action Taxonomy¶
Documentation-only names:
| Candidate action | Current owner | Required record/state owner |
|---|---|---|
tms.work-assignment.manage |
TMS Workforce | Work Assignment application |
tms.work-assignment.self |
TMS Workforce | assigned Loader/self relation |
yms.street-turn.create |
YMS Container | Street Turn create application |
tms.street-turn.reverse |
TMS/Container compensation | Street Turn reversal application |
wms.final-review.read |
WMS Final Review | Review query |
wms.final-review.correct |
WMS Final Review | Pending correction |
wms.final-review.confirm |
WMS Final Review | Confirm transition |
wms.final-review.reopen |
WMS Final Review | Reopen transition |
bms.ar-billing.read |
BMS AR Billing | Billing query |
bms.ar-billing.manage |
BMS AR Billing | preset/rate/confirm command owners |
bms.qbo.deliver |
BMS QBO | provider effect owner |
tms.bol.send |
TMS Transload | BOL email effect owner |
tms.packing-list.send |
TMS Booking | Packing email effect owner |
These names must not be added to Runtime until current role evidence and policy approval exist.
8. Required Evidence Matrix¶
For every row above, capture:
tenant/profile
actor account
physical actor/effective subject
role IDs and role names
menu/page result
initial GET API result
control visibility
route metadata
handler actor result
record tenant/relation
record state
expected allow/deny
actual allow/deny
mutation count or no-mutation proof
provider effect or no-effect proof
recovery owner
Current evidence package:
RBR-ACCESS-001
9. Current Classification¶
Static matrix:
COMPLETE FOR NAMED SURFACES
Current environment role/menu/account state:
UNKNOWN
Client 1 page/API/action parity:
NOT RUN
Selected Client 2 expected parity:
NOT RUN
Foreign-tenant negative evidence:
NOT RUN
Implementation:
USER HOLD
M3:
NO
M4:
NO
---¶
Source:
docs/processes/PLATFORM_AUTHORIZATION_CURRENT_ACTION_MATRIX_2026-08-08.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.