This is an internal working record, not an everyday instruction.
It was written while the system was being rebuilt, for whoever maintains it. If you are here to do
today's work, use the everyday documents instead:
Procedures · Processes · Runbooks
· The working day, step by step
- Status:
POLICY RECOMMENDATIONS AND OPEN DECISIONS / NO IMPLEMENTATION AUTHORIZATION
- Source authority:
PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_SOURCE_AUTHORITY.md
- Reconciliation:
PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_RECONCILIATION.md
- Current source baseline:
qa@4f6165bc4c53a7d98b0c246392dd9ed5bd75c21c
- Important: recommendations do not activate P4-003 or change current behavior.
Status vocabulary
RECOMMENDED
CURRENT COMPATIBILITY — PRESERVE
OPEN PRODUCT DECISION
OPEN TECHNICAL DECISION
RUNTIME EVIDENCE REQUIRED
CONTROL-PLANE EVIDENCE REQUIRED
BLOCKS WRITE MIGRATION
DEFERRED
1. Tenant Identity And Context
| ID |
Question |
Current behavior |
Recommendation |
Status / owner |
TPC-POL-010 |
What is the Runtime query key? |
local numeric CLIENT_ID |
retain as deployment-local DB key until DB migration; never treat as portable Product identity |
RECOMMENDED / P4-002 + DB |
TPC-POL-020 |
What is the portable tenant identity? |
optional UUID/mapping, broadly unavailable |
trusted published global UUID mapped to one local ID per deployment |
RECOMMENDED / Control Tower + P4 |
TPC-POL-030 |
Can a new write use deployment fallback tenant? |
legacy callers may use Config::CLIENT_ID |
no; new write requires strict explicit tenant context |
RECOMMENDED / P4-002/P5 |
TPC-POL-040 |
How does impersonation work? |
effective target tenant/user with original admin session fields |
actor and subject remain distinct; every effect records both |
RECOMMENDED / Auth/P4 |
TPC-POL-050 |
Can WEB/API use all-tenants context? |
typed adapter rejects it |
keep prohibited; fan-out creates strict per-tenant child contexts |
RECOMMENDED |
TPC-POL-060 |
Can admin override tenant from header/body? |
selected API routes allow explicit super-admin override |
only allowlisted route + explicit target + authorization reference |
RECOMMENDED / P4/P2 |
TPC-POL-070 |
When is LEGACY_LOCAL_ONLY acceptable? |
common where global mapping absent |
reads/compatibility diagnostics only; migration/deployment portability remains incomplete |
RECOMMENDED |
2. Operating Profile
| ID |
Question |
Recommendation |
Status / owner |
TPC-POL-110 |
Initial profile keys |
ctc-execution, mk-order |
RECOMMENDED / Product + P6 |
TPC-POL-120 |
Is profile a customer alias? |
no; profile represents operating model/value streams/terminology/default definitions |
RECOMMENDED |
TPC-POL-130 |
Profile cardinality |
one primary profile plus optional named capability composition is the preferred starting model |
OPEN PRODUCT DECISION |
TPC-POL-140 |
Assignment storage |
Control Tower published assignment with local applied snapshot; exact persistence must follow publish/apply design |
OPEN TECHNICAL DECISION |
TPC-POL-150 |
Can profile enable modules/actions? |
no automatic grant; profile supplies applicability/default definitions only |
RECOMMENDED |
TPC-POL-160 |
Missing profile behavior |
return unavailable for target strict caller; compatibility inference only when explicitly declared |
RECOMMENDED / BLOCKS NEW PROFILE-SELECTED WRITE |
TPC-POL-170 |
Profile version changes |
versioned, reviewed, backward-compatible or explicit migration |
RECOMMENDED |
TPC-POL-180 |
Numeric branch retirement |
replace only after explicit profile/capability/config parity and caller acceptance |
RECOMMENDED |
3. Module Enablement
| ID |
Question |
Current behavior |
Recommendation |
Status / owner |
TPC-POL-210 |
Missing tenant-module row |
compatibility allow |
preserve for existing callers until explicit parity seed; strict new callers default disabled |
CURRENT COMPATIBILITY — PRESERVE / RECOMMENDED TARGET |
TPC-POL-220 |
Module source/DB error |
compatibility allow |
target strict caller returns unavailable/error; existing fail-open retired caller-by-caller |
RECOMMENDED / RUNTIME EVIDENCE REQUIRED |
TPC-POL-230 |
Explicit disabled row |
deny |
preserve |
RECOMMENDED |
TPC-POL-240 |
Is module permission? |
no; module availability is separate from menu/role/action/record access |
RECOMMENDED |
|
TPC-POL-250 |
Any/all module page mapping |
preserve current page semantics until page inventory review; target definitions must be explicit |
RECOMMENDED / P2/P7 |
|
TPC-POL-260 |
Unmapped page |
current allow/unknown compatibility |
inventory and classify before any deny change |
CURRENT COMPATIBILITY — PRESERVE / P2-007 |
TPC-POL-270 |
Module tier |
do not treat as entitlement without Product contract |
OPEN PRODUCT DECISION |
|
TPC-POL-280 |
Explicit parity seed |
required before strict missing-row behavior |
RECOMMENDED / BLOCKS FAIL-CLOSED MIGRATION |
|
4. Named Process Capability
| ID |
Question |
Recommendation |
Status / owner |
TPC-POL-310 |
Capability granularity |
one consequential business action/behavior, not page or whole module |
RECOMMENDED / P4/P5/P6 |
TPC-POL-320 |
Capability key naming |
stable semantic namespace: <profile/domain>.<capability>.<action> |
OPEN TECHNICAL DECISION |
TPC-POL-330 |
Capability definition owner |
platform registry with owning module/process references; Process owns business meaning |
RECOMMENDED |
TPC-POL-340 |
Missing capability definition |
target new caller unavailable/disabled; never infer from module alone |
RECOMMENDED |
TPC-POL-350 |
Compatibility default enabled |
permitted only when definition explicitly records current parity and retirement owner |
RECOMMENDED |
TPC-POL-360 |
Prerequisites |
profile applicability + modules + config + optional credential, independently reported |
RECOMMENDED |
TPC-POL-370 |
Capability versus authorization |
capability does not grant user/action/record permission |
RECOMMENDED |
TPC-POL-380 |
Current first activation |
read-only, low-risk capability diagnostics before transactional actions |
RECOMMENDED / P4-003 activation needed |
5. Package / Entitlement
| ID |
Question |
Recommendation |
Status / owner |
TPC-POL-410 |
Is current package selection authoritative? |
not proven; treat as onboarding/advisory metadata until Product defines entitlement |
OPEN PRODUCT DECISION |
TPC-POL-420 |
Can package auto-toggle modules? |
only as reviewed onboarding seed; resulting module rows remain explicit applied state |
RECOMMENDED |
TPC-POL-430 |
Can package deny current tenant access? |
not before explicit entitlement, billing, current parity and rollback |
BLOCKS ENFORCEMENT |
TPC-POL-440 |
Tier changes |
must expose affected modules/capabilities and preserve explicit overrides |
OPEN PRODUCT/TECHNICAL DECISION |
6. Configuration Definitions
| ID |
Question |
Current behavior |
Recommendation |
Status / owner |
TPC-POL-510 |
Type authority |
provider definitions + key-name heuristic |
registered config definition outranks heuristic |
RECOMMENDED / P4-003 |
TPC-POL-520 |
Empty value semantics |
caller-specific default |
definition declares MISSING, VALID_EMPTY or DISABLED |
RECOMMENDED |
TPC-POL-530 |
Invalid value |
often falls back |
target returns invalid plus explicit typed fallback only when definition permits |
RECOMMENDED |
TPC-POL-540 |
Source error |
often falls back |
preserve provenance/error and use only declared fallback |
RECOMMENDED |
TPC-POL-550 |
JSON validation |
nonempty string/decoding varies |
definition requires object/list shape and optional field schema |
RECOMMENDED |
TPC-POL-560 |
Decimal type |
current heuristic lacks first-class decimal |
add typed decimal in target definition/repository where money/rate requires it |
RECOMMENDED / DB/P5 |
TPC-POL-570 |
Config caching |
request static cache |
definition declares cache policy; apply increments version and invalidates/rereads |
RECOMMENDED |
TPC-POL-580 |
Runtime env fallback |
caller-specific |
allowlisted definition only; label DEPLOYMENT_FALLBACK |
RECOMMENDED |
TPC-POL-590 |
Numeric MK document default |
Client 2 default-on |
preserve until explicit mk-order profile/capability/config parity; then retire |
CURRENT COMPATIBILITY — PRESERVE / BLOCKS BRANCH REMOVAL |
TPC-POL-600 |
Direct local emergency override |
needed operationally? |
define narrow audited break-glass path or prohibit; never silent |
OPEN OPERATIONS DECISION |
7. Secrets And Credentials
| ID |
Question |
Recommendation |
Status / owner |
TPC-POL-610 |
Secret storage |
tenant encrypted value, env fallback or external ref per definition |
RECOMMENDED |
TPC-POL-620 |
Secret diagnostics |
availability/source/owner match only; never value |
RECOMMENDED |
TPC-POL-630 |
Credential owner |
tenant-owned refs must match local/global tenant and module/key |
RECOMMENDED |
TPC-POL-640 |
Deployment fallback |
explicit DEPLOYMENT_FALLBACK; never report as tenant-owned |
RECOMMENDED |
TPC-POL-650 |
Valid credential and disabled module |
provider call denied |
RECOMMENDED |
TPC-POL-660 |
Rotation |
update reference/release, apply, provider verification and rollback; no plaintext audit |
RECOMMENDED / Provider + P4-005 |
TPC-POL-670 |
External secret manager |
optional future source; owner/reference contract must remain stable |
OPEN TECHNICAL DECISION |
8. Admin / Control Plane
| ID |
Question |
Current behavior |
Recommendation |
Status / owner |
TPC-POL-710 |
Current Admin writes |
direct applied-state module/config/tenant update |
preserve until versioned release replacement accepted |
CURRENT COMPATIBILITY — PRESERVE |
TPC-POL-720 |
Control Tower role |
draft/review/publish history and portable tenant identity |
RECOMMENDED / P3/P4 |
|
TPC-POL-730 |
Request-time dependency |
none |
Runtime never queries Control Tower on ordinary request |
RECOMMENDED |
TPC-POL-740 |
Apply identity |
release ID + target deployment + expected applied version |
RECOMMENDED |
|
TPC-POL-750 |
Apply atomicity |
bounded transaction where possible; per-child result otherwise |
RECOMMENDED |
|
TPC-POL-760 |
Apply completion |
local rows + applied version + effective resolution + selected caller readback |
RECOMMENDED |
|
TPC-POL-770 |
Partial apply |
explicit partial/drift and recovery owner |
RECOMMENDED |
|
TPC-POL-780 |
Rollback |
predecessor/superseding reviewed release, not ad hoc row reset |
RECOMMENDED |
|
TPC-POL-790 |
Dedicated deployment |
current read-only UI; target local apply authority must be explicit |
OPEN OPERATIONS/DEPLOYMENT DECISION |
|
TPC-POL-800 |
Emergency Production edit |
define break-glass audit/reconciliation or prohibit |
OPEN OPERATIONS DECISION |
|
9. Access Composition
| ID |
Question |
Recommendation |
Status / owner |
TPC-POL-810 |
Menu visibility versus page/API |
keep separate results but enforce reviewed parity per action |
RECOMMENDED / P2-007 |
TPC-POL-820 |
Numeric requiredRoleIds |
preserve current compatibility; target semantic capabilities/action matrix |
RECOMMENDED / P2/P4/P5 |
TPC-POL-830 |
Record authorization |
handler/query owner must enforce tenant and record predicate |
RECOMMENDED |
TPC-POL-840 |
Unknown access result |
cannot authorize consequential write |
RECOMMENDED |
TPC-POL-850 |
Super-admin bypass |
explicit platform/core or targeted authorized action only; impersonation preserves subject |
RECOMMENDED |
TPC-POL-860 |
Client 1 safety |
no broad default-deny or role shrink before caller/log/static evidence and rollback |
RECOMMENDED / BLOCKS BROAD ROLLOUT |
10. Migration Decisions
| ID |
Decision |
Recommendation |
Status |
TPC-POL-910 |
First caller cohort |
read-only diagnostics or low-risk projection |
RECOMMENDED |
TPC-POL-920 |
One authority |
old or target resolver owns one caller/cohort; shadow reads allowed, dual policy decisions forbidden |
RECOMMENDED |
TPC-POL-930 |
Numeric branch retirement |
one branch/caller at a time after profile/capability parity |
RECOMMENDED |
TPC-POL-940 |
Missing module strict conversion |
only after explicit tenant/module seeds and target-role tests |
RECOMMENDED |
TPC-POL-950 |
Current Admin write retirement |
after publish/apply/rollback replacement and emergency policy |
RECOMMENDED |
TPC-POL-960 |
PostgreSQL |
after React/Next.js/TypeScript/MySQL stabilization |
RECOMMENDED |
Before any new transactional resolver-selected behavior:
TPC-POL-130 profile composition
TPC-POL-140 profile assignment storage/publish owner
TPC-POL-280 explicit module parity seed
TPC-POL-330 capability definition owner
TPC-POL-510 config definition authority
TPC-POL-570 cache/version/readback
TPC-POL-740 applied release identity
TPC-POL-810 page/API/action parity
TPC-POL-860 Client 1 safety evidence
12. Current Disposition
Recommendations documented: YES
Product decisions accepted: NO
P4-003 activated: NO
Current helper behavior changed: NO
Runtime/DB/provider evidence run: NO
Wiki publication authorized: NO
Write migration ready: NO
---
Source: docs/processes/PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_POLICY_DECISION_MATRIX.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.