Janady13/missionmatch / docs/DIRECTIVE_AMENDMENT_6.md

1# DIRECTIVE AMENDMENT 6: IDENTITY, ROLES, AND THE OPERATOR PLANE 2 3Applies to docs/CLAUDE_CODE_BUILD_DIRECTIVE.md and the consolidated 4amendments. Generated 28 July 2026, triggered by live design partner 5feedback from FG Talent: a client superuser could not edit her own name, 6the Superuser tab rendered inactive for her, and there is no tenant 7facing user management. This amendment also establishes the platform 8level above superuser that Joseph operates from. 9 10-------------------------------------------------------------------------------- 110. HOW TO APPLY THIS AMENDMENT 12-------------------------------------------------------------------------------- 13 141. Record "amendment 6 accepted" in BUILD_STATE with the date. 152. This amendment creates two containers: TRACK U, an urgent, small, 16 production eligible track defined in Section 3, and PHASE 5A, 17 Identity and Access, inserted between Phase 5 and Phase 6. Track U 18 may begin immediately and runs in parallel with the current phase. 193. Acceptance items 36 through 40 append to directive Section 11. 204. Every directive rule stands except as explicitly adjusted by the 21 Track U guardrails in Section 2 item 8. The scoring engine stays 22 frozen. Role enum values are extended, never renamed, never removed. 23 24-------------------------------------------------------------------------------- 251. WHAT THE FEEDBACK REVEALED 26-------------------------------------------------------------------------------- 27 28Three product gaps, one design flaw: 29 301. No self service profile. A user cannot change their own name, so a 31 trivial personal edit escalates to the top of the ladder. 322. No tenant user management. A client admin has no screen to run their 33 own people: invite, rename, assign roles, deactivate. 343. The platform plane and the tenant ladder share one top role. 35 Superuser currently means both "Joseph's platform controls" and 36 "the client's top seat," which is why a client saw a platform tab 37 at all. 384. Roles below the top are not differentiated enough to hand a client 39 organization confidently. The matrix needs real, researched 40 entitlements per role. 41 42-------------------------------------------------------------------------------- 432. DECISIONS RECORDED 44-------------------------------------------------------------------------------- 45 461. OPERATOR. A new top level, operator, is added above and outside the 47 tenant ladder. It is the platform plane. Operator holds every 48 platform capability and every tenant capability in every tenant. 49 Every operator action is audited. Joseph's account becomes the first 50 operator. MFA by TOTP is mandatory for operator accounts from the 51 day the role exists, not waiting for Phase 6. An operator account 52 without enrolled MFA cannot log in. 532. SUPERUSER becomes the tenant top role, the client's seat, assignable 54 per tenant and created by an operator. Its existing rule, holds all 55 capabilities by rule rather than by matrix row, now reads "within 56 its tenant." The platform surfaces, Organizations, cross tenant 57 Users, Curation, Federation, and platform Metrics, move behind 58 operator and answer 404 to everyone else, including tenant 59 superusers. 603. MIGRATION. Audit every existing superuser grant. Tenant humans 61 holding superuser keep full power inside their own tenant and lose 62 only the platform surfaces they never should have seen. Joseph's 63 account moves to operator. The remap is one audited migration, with 64 each affected account listed in the ledger. 654. SELF SERVICE PROFILE, every role: edit own display name, title, and 66 phone, change own password, change own email with verification to 67 the new address. Changes propagate everywhere the identity renders 68 and are audited as identity change events. Nobody needs an 69 administrator to fix their own name. 705. TENANT USER MANAGEMENT, admin and above, tenant scoped: list users 71 with role and status, invite by email, assign role and per tool 72 entitlements, edit a user's display name, deactivate and 73 reactivate, resend invitations. Users are never deleted. 74 Deactivation blocks login and preserves ownership, activity, and 75 audit history in full. Grant ceiling, enforced at the API: nobody 76 assigns a role above their own; admin manages up through manager, 77 owner up through admin, superuser up through owner, operator 78 manages everything including creating superusers. 796. MATRIX REBUILD, Phase 5A. Capabilities become entity action pairs 80 carrying an ownership scope, own, team, or organization, in the 81 industry pattern, plus feature capabilities for export, bulk edit, 82 import commit, publish, and the existing approvals. The nineteen 83 current capability keys remain as aliases mapped forward, never 84 renamed destructively. The matrix stays exhaustively tested, 404 85 never 403 stands, and EEO compliance access remains a separate 86 explicit per user grant outside the ladder, grantable by operator 87 only, exactly as segregated as today. 887. FIELD SENSITIVITY CLASSES, Phase 5A, first class: rates. Pay rate 89 is visible to recruiter and above. Bill rate and margin are visible 90 to manager and above, and invisible below that everywhere, 91 screens, exports, feeds, and API responses alike. The class 92 mechanism is generic so future sensitive fields reuse it. 938. TRACK U PRODUCTION GUARDRAILS. The Gate 6 freeze was written to 94 protect production from the build, not to freeze client serving 95 fixes, and a design partner is using production today. Track U 96 items, and only Track U items, may deploy to production ahead of 97 Gate 6 under four conditions: verified on staging first, Joseph 98 approves each deploy explicitly and the approval is recorded in the 99 ledger, the deploy is recorded with commit hash and verification 100 evidence, and after every deploy the build feature routes are 101 re proven dark in production. Nothing else gains production 102 eligibility from this clause. 1039. TEAMS, light. Users gain an optional team assignment per tenant, 104 default single team, giving the team ownership scope meaning. 105 Nothing heavier than that in this build. 10610. ORGANIZATIONS PROVISIONING, Phase 5A, operator console: create a 107 tenant, set product entitlements per tool, configure the site 108 mapping, and invite the first superuser by email. This is the 109 productized path for onboarding the next client. 11011. IMPERSONATION, Phase 5A, operator only: view as a user with a 111 persistent on screen banner, read only by default, write access 112 only through an explicit escalation, auto expiry within the hour, 113 and every impersonated request audited with both identities. 11412. BY RULE EXTENDS TO TOOLS. Ratified by Joseph 28 July 2026, folded in 115 from the Track U diagnosis. A tenant superuser holds every product 116 tool ITS TENANT IS ENTITLED TO, by rule rather than by grant, exactly 117 as it holds every capability by rule within its tenant. Operator 118 holds all tools in every tenant. The consequence is the one that 119 matters to the design partner: the entitlement grid can never render 120 the top seat as broken, because the top seat is never missing a tool 121 its organization bought. Confer only what you hold continues to apply 122 unchanged to every role BELOW superuser, so the ceiling on spreading 123 access is untouched for the roles where it is load bearing. 12413. NO SILENT GREY. Ratified by Joseph 28 July 2026. A disabled 125 entitlement control must STATE ITS REASON, and the two reasons are 126 distinct and both legible: the organization is not entitled to that 127 product, or you do not personally hold that tool. A control that is 128 merely greyed with no explanation reads as a broken product, which is 129 precisely how this defect reached Joseph. This applies to every 130 disabled entitlement control on every surface, not only the Admin 131 screen. 132 133-------------------------------------------------------------------------------- 1343. TRACK U, URGENT AND PRODUCTION ELIGIBLE 135-------------------------------------------------------------------------------- 136 137Scope is exactly these six items, nothing more: 138 1391. Reproduce the reported path first, on staging, logged in with the 140 reporting user's actual role: the Superuser tab state, the user 141 list unreachable, the name not editable. Record the root cause in 142 the ledger before fixing. RATIFIED ADAPTATIONS, 28 July 2026: the 143 staging account provisioned for the repro MIRRORS the reporting 144 user's actual production role and tool grants, and what her 145 production account actually holds is recorded in the ledger. The 146 users column is full_name, so this amendment's display name wording 147 maps onto full_name rather than introducing a new column. The users 148 role CHECK constraint is EXTENDED by migration to admit operator, 149 never renamed and never narrowed. 1502. Self service profile screen per Section 2 item 4, all roles. 1513. Tenant user management per Section 2 item 5, admin and above, 152 including display name editing so the client can fix names today. 1534. Operator bootstrap: the role exists, Joseph's account holds it, MFA 154 enrollment enforced at login for operator, platform surfaces answer 155 404 to non operators. 1565. Superuser remap migration per Section 2 item 3, audited, accounts 157 listed in the ledger. 1586. Production deploys of the above under the Section 2 item 8 159 guardrails, one at a time, each recorded. 160 161TRACK U GATE: 162 1631. The reported repro passes end to end as the reporting user's role: 164 she edits her own name, it renders everywhere, and the platform tab 165 is simply absent rather than inactive. 1662. An admin invites a user, assigns recruiter, renames them, 167 deactivates them, and the deactivated user cannot log in while 168 every record they own remains intact and attributed. 1693. The grant ceiling refuses an admin minting an owner, at the API, 170 proven by test. 1714. An operator login without enrolled MFA is refused. A non operator 172 requesting any platform route receives 404. 1735. After the production deploy, the zero 5xx sweep passes and every 174 build feature route re proves dark, recorded with evidence. 175 176-------------------------------------------------------------------------------- 1774. PHASE 5A, IDENTITY AND ACCESS 178-------------------------------------------------------------------------------- 179 1801. Matrix rebuild per Section 2 items 6 and 7. Role defaults, tenant 181 scoped, each row building on the one before it: 182 183 viewer read only across organization records, no export, no 184 rates of any kind, no EEO ever. 185 member viewer plus notes, tasks, and activities on any record. 186 recruiter member plus full desk work: candidates create and edit, 187 applications and screenings, imports including commit 188 with attestation, pools and saved searches, clients and 189 orders read, pay rate visible, export limited to own and 190 team. 191 manager recruiter plus orders create and edit, publish and 192 unpublish, the existing approvals, requirement approval 193 and proposal submission, bill rate and margin visible, 194 organization wide export and bulk edit, fall off 195 reactivations. 196 admin manager plus user management, tenant settings, stage 197 templates, notice templates, import mappings, and 198 integration configuration. 199 owner admin plus billing and plan, retention settings, and 200 full data export. 201 superuser owner plus everything else tenant scoped, by rule, 202 within its tenant only. 203 operator everything everywhere, platform surfaces included, 204 always audited, MFA always. 205 2062. Ownership scopes implemented as an attribute of each entity action 207 capability, own, team, organization, with team defined by Section 2 208 item 9. 2093. Field sensitivity classes wired through the render, export, feed, 210 and API layers so a hidden class is absent from the payload, not 211 blanked in the UI. 2124. Impersonation per Section 2 item 11. 2135. Organizations provisioning per Section 2 item 10. 2146. The exhaustive capability matrix tests are regenerated for the new 215 shape and pass in full, including the alias mapping from the 216 nineteen legacy keys. 217 218GATE 5A: 219 2201. The regenerated matrix tests pass, every role, every tool, every 221 scope. 2222. A recruiter cannot obtain bill rate or margin through any surface: 223 screen, export file, feed, or raw API response, proven by fixture 224 inspection of the payloads. 2253. The grant ceiling holds at every rung, proven by attempting each 226 violation. 2274. Impersonation shows the banner, expires on schedule, defaults read 228 only, and writes both identities to every audit row it touches. 2295. Provisioning on staging creates a tenant, entitles products, 230 configures a site mapping, and delivers a working superuser 231 invitation end to end. 2326. A tenant superuser requesting any platform route receives 404, and 233 the operator with MFA reaches all of them. 234 235-------------------------------------------------------------------------------- 2365. ACCEPTANCE ADDITIONS TO SECTION 11 237-------------------------------------------------------------------------------- 238 23936. Every role can edit its own profile, and identity changes are 240 audited and propagate everywhere the identity renders. 24137. The role grant ceiling is enforced at the API for every rung of the 242 ladder. 24338. Rates above pay are invisible below manager on every surface, 244 including exports, feeds, and raw API payloads. 24539. Operator requires MFA without exception, platform surfaces answer 246 404 to everyone else, and every impersonated action carries both 247 identities in the audit trail. 24840. User accounts are never deleted; deactivation blocks login while 249 preserving ownership, activity, and audit history. 250