# Design review and permission matrix

Completed example — all product names, people, evidence IDs and results below are synthetic teaching data. They are not test results from this website or an assessment of a real product.

## Scope and invariant

Product LedgerDesk, candidate r42, staging. Design owner: Mira, invoices team. Operation: create and download an invoice export. Ordinary users may export their own invoices in their active tenant; tenant finance-admins may export all invoices of that tenant. Support impersonation and mobile offline copies are excluded and need separate reviews.

## Data flow and authority

| Hop | Input / output | Trusted identity source | Sensitive action | Enforcing component | Open assumption |
| --- | --- | --- | --- | --- | --- |
| Browser→API | Export format | Verified session plus current tenant membership | Queue request | Export service | Membership service failure must deny |
| API→worker | Server-created actor, tenant and operation ID | Authenticated queue producer; rechecked membership | Read invoice rows | Worker query and policy | Revocation during queued work tested in T-05 |
| Worker→store→download | Private export object | Bound export audience; current requester policy | Return bytes | Download service | Expired export deletion tested separately |

## Permission matrix

| Actor | Tenant / object relation | Action | Expected | Fact source | Test ID |
| --- | --- | --- | --- | --- | --- |
| Ana ordinary | north / owns n1 | Export n1 | Allow | Session, membership store, invoice owner | T-01 |
| Ben ordinary | north / does not own n1 | Export n1 | Deny | Same sources | T-02 |
| Cy ordinary | south / does not own n1 | Download north export | Deny | Same sources plus export audience | T-03 |
| Dee finance-admin | north / n1,n2 | Export north rows | Allow | Current role and row tenant | T-04 |
| Ana removed | Former north member | Execute queued export | Deny | Current membership at execution | T-05 |

## Decision

The proposed shared cache keyed only by format is rejected: a later requester can receive another audience's bytes. Owner Mira will remove shared caching for private exports in r43 and retain private objects with explicit audience checks. Acceptance requires T-01 through T-05 plus request-order reversal and direct download tests on r43's artifact. The worker must reject forged actor/tenant job fields. Decision: blocked pending those results; security reviewer Noor verifies, Mira owns remediation. Reopen on queue producer, finance-admin role or download storage changes.