Authentication + authorization control loop

Trusted operator continuity

Both required operators can recover or authenticate, explicitly enter an authorised non-personal organisation, do useful work, switch or exit, and return safely—without permanent membership or ambient superadmin privilege.

Read left to right for the authority path. Read the feedback controls for every fail-closed return.

One explicit authority context, never ambient privilege

The instruments separate identity, visibility, assumption, audit, tenant resolution, permission, proof, and revocation so no line silently implies authority.

Explicit authority across authentication and tenant boundaries

implementation-proof

A platform operator may enter a non-personal organisation only through one active, matching, audited assumption. Superadmin status exposes the option; it never grants tenant permission by itself.

Source: docs/products/story-specs/platform-admin-organisation-access/story-spec.md

AUTH-G01Recover or authenticate[FC]
HAHA[L3] Required platform operator[L3]●
identityhigh risk

A valid session must resolve to the existing identity. Failed recovery creates no duplicate identity and reveals no account existence.

[P]verified identity
NAV-S01Expose eligible workspaces[FC]
OAOA[L2] Auth + tenant orchestrator[L2]●
visibility

Memberships and authorised non-personal organisations appear. Personal workspaces never appear.

[E:explicit-selection]exact target
AUTH-G02Explicitly assume workspace[FC]
HAHA[L3] Required platform operator[L3]●
authorityhigh risk

The operator must choose the exact target. Superadmin eligibility alone cannot cross the tenant boundary.

[P]bounded authority
AUTH-R01Persist state + audit[FC]
OAOA[L2] Auth + tenant orchestrator[L2]●
receipt-before-authority

The active assumption and allow audit are durable before the signed cookie can carry authority.

[E:receipt]issue signed context
NAV-S02Resolve requested tenant[FC]
OAOA[L2] Auth + tenant orchestrator[L2]●
tenant-scope

The URL tenant, stored target, cookie, actor, and active state must agree. Any mismatch denies before data access.

[P]matching tenant
AUTH-G03Authorize feature or action[FC]
OAOA[L2] Auth + tenant orchestrator[L2]●
permissionhigh risk

A matching active assumption may form the principal without a target-organisation profile. Ambient superadmin authority remains forbidden.

[P]explicit assumption
VFL-V01Prove useful read + write
DADA[L1] Isolation proof checker[L1]●
production-proof2/2 + 100% deny

Dashboard authority and one representative operation must succeed in the selected tenant; URL or banner arrival is insufficient.

[E:operator-choice]continue or leave
AUTH-C01Switch, exit, or logout[FR]
HAHA[L3] Required platform operator[L3]●
context-lifecycle

Changing context revokes the prior assumption before selecting the next member or assumed workspace.

[E:exit-or-switch]revoke + clear
AUTH-G04Deny stale authority[FC]
DADA[L1] Isolation proof checker[L1]●
next-request-proofhigh risk

Exit, logout, expiry, revocation, malformed cookie, or operator removal must deny the next request.

Feedback controls

authorization-gate
[F]deny before data access
workspace-selector
revocation-gate
[P]re-enter explicitly
workspace-selector
revocation-gate
[E:logout]authenticate again
authenticate
  • Superadmin status exposes eligible workspaces; it is never tenant permission.
  • Only one active assumption whose target matches the resolved tenant can replace a missing member profile.
  • Revocation closes the loop: no authority survives exit, logout, expiry, malformed state, or operator removal.

Equivalent operating readback

The same logic in sequence for readers who do not use the A&ID symbol key.

  1. 01

    Identity is continuity, not replacement

    Recovery or authentication resolves the existing human identity before any organisation is exposed.

  2. 02

    Visibility is not authority

    Platform-operator status allows the selector to show eligible non-personal workspaces. It does not bypass membership or permission checks.

  3. 03

    Selection creates a bounded authority context

    The exact target is rechecked, then assumption state and its audit receipt are persisted before a signed cookie is issued.

  4. 04

    Tenant and assumption must agree

    The requested organisation, cookie, stored assumption, actor, and active state must match before feature authorization or data access.

  5. 05

    The fix is assumption-aware, not superadmin-aware

    Feature access accepts a principal without a member profile only when an active assumption targets the resolved organisation.

  6. 06

    Useful work is the receipt

    The journey proves dashboard authority plus a representative read and write; reaching a URL or seeing a banner is not enough.

  7. 07

    Leaving destroys authority

    Switching revokes the prior context first. Exit, logout, expiry, revocation, malformed state, and operator removal deny the next request.

Commissioning gauge

The loop is not commissioned until production evidence satisfies every gauge at once.

2/2

required operators

Complete recovery or sign-in, assumption, useful work, switching, exit, logout, and safe return.

100%

isolation negatives deny

  • — ordinary non-member
  • — personal workspace
  • — missing assumption
  • — mismatched tenant
  • — revoked assumption
  • — audit or persistence failure

0

ambient or surviving authority

No membership or governance mutation. No authority survives exit, logout, revocation, or operator removal.