[User Story] Request assignment to an organization function #8

New Issue

2026-07-31T15:05:48+02:00

zemion commented

2026-07-31 15:05:48 +02:00

User Story

As an eligible user, I want to request assignment to an organization function and follow its governed decision process, so that responsibility can be obtained transparently without an administrator directly editing an assignment.

Journey

Find a function and see whether requesting it is allowed, unavailable, or requires conditions, with an explanation.
Enter justification, requested validity, and required evidence.
Submit into the function policy workflow: holder decision, authority clearance, both in sequence, or authority-only/unavailable.
Inspect durable status, respond to questions, and withdraw while permitted.
Receive the decision; IDM creates the effective assignment exactly once only after all required steps complete.

Acceptance Criteria

Organizations/Policy determines requestability, eligible clearer(s), separation of duties, evidence, expiry, and validity ceilings.
IDM owns the request record and resulting assignment; Workflow Engine owns only orchestration.
States distinguish awaiting holder, authority, and final application; blocked/vacant routes are visible.
Every approval rechecks current holder/authority/function/Policy facts.
Rejection, withdrawal, expiry, cancellation, and outcome-unknown application are durable and explained.
Notifications announce durable waiting states and outcomes when installed.
Audit records actor, represented function, Policy decision, pinned workflow revision, evidence references, and resulting assignment.
The assignment does not itself grant generic application permissions; Access mappings remain explicit.
Without Workflow Engine, the governed request action is unavailable with an explanation while IDM direct administration remains independently deployable.

Architecture: Function assignment request and grant workflows. Depends on GovOPlaN/govoplan-workflow#12/#13.

## User Story As an eligible user, I want to request assignment to an organization function and follow its governed decision process, so that responsibility can be obtained transparently without an administrator directly editing an assignment. ## Journey 1. Find a function and see whether requesting it is allowed, unavailable, or requires conditions, with an explanation. 2. Enter justification, requested validity, and required evidence. 3. Submit into the function policy workflow: holder decision, authority clearance, both in sequence, or authority-only/unavailable. 4. Inspect durable status, respond to questions, and withdraw while permitted. 5. Receive the decision; IDM creates the effective assignment exactly once only after all required steps complete. ## Acceptance Criteria - Organizations/Policy determines requestability, eligible clearer(s), separation of duties, evidence, expiry, and validity ceilings. - IDM owns the request record and resulting assignment; Workflow Engine owns only orchestration. - States distinguish awaiting holder, authority, and final application; blocked/vacant routes are visible. - Every approval rechecks current holder/authority/function/Policy facts. - Rejection, withdrawal, expiry, cancellation, and outcome-unknown application are durable and explained. - Notifications announce durable waiting states and outcomes when installed. - Audit records actor, represented function, Policy decision, pinned workflow revision, evidence references, and resulting assignment. - The assignment does not itself grant generic application permissions; Access mappings remain explicit. - Without Workflow Engine, the governed request action is unavailable with an explanation while IDM direct administration remains independently deployable. Architecture: [Function assignment request and grant workflows](https://git.add-ideas.de/GovOPlaN/govoplan-idm/src/branch/main/docs/FUNCTION_ASSIGNMENT_WORKFLOWS.md). Depends on GovOPlaN/govoplan-workflow#12/#13.

zemion added the

type

user-story

module/notifications module/audit module/policy module/access area/webui module/idm module/organizations area/api area/security codex/ready area/db area/governance module/workflow

labels 2026-07-31 15:05:48 +02:00

zemion referenced this issue

2026-07-31 15:06:34 +02:00

[Feature] Expose effective function-assignment resolution and lifecycle events for consumers #5

zemion commented

2026-07-31 19:42:53 +02:00

Implemented and pushed as the governed function-assignment aggregate and request UI.

Delivered:

explained request capability/preflight with fail-closed optional Policy and Workflow Engine integrations
durable request state, strong ETag/OCC, idempotent submission, pinned workflow revision/hash, append-only history, evidence and validity
holder/authority/recipient steps, change requests/responses, withdrawal, rejection, expiry, blocked vacancy, recovery and exact-once assignment application
current-fact rechecks, separation of duties, quorum, evidence requirements and validity ceilings
optional Notifications and same-transaction Audit records with policy/workflow/actor/result provenance
participant-limited visibility and UI deep links from notifications
historical records remain readable when their live function is removed

Commits: govoplan-core 6ebb299, govoplan-organizations daeaa4b, govoplan-policy e061f23, govoplan-idm c14719d, with Workflow Engine baseline support in 43c1f3f.

Verification: IDM 22 tests, Policy 42 tests, Workflow Engine 56 tests, migration-to-head check and Core WebUI TypeScript check passed.

Implemented and pushed as the governed function-assignment aggregate and request UI. Delivered: - explained request capability/preflight with fail-closed optional Policy and Workflow Engine integrations - durable request state, strong ETag/OCC, idempotent submission, pinned workflow revision/hash, append-only history, evidence and validity - holder/authority/recipient steps, change requests/responses, withdrawal, rejection, expiry, blocked vacancy, recovery and exact-once assignment application - current-fact rechecks, separation of duties, quorum, evidence requirements and validity ceilings - optional Notifications and same-transaction Audit records with policy/workflow/actor/result provenance - participant-limited visibility and UI deep links from notifications - historical records remain readable when their live function is removed Commits: govoplan-core `6ebb299`, govoplan-organizations `daeaa4b`, govoplan-policy `e061f23`, govoplan-idm `c14719d`, with Workflow Engine baseline support in `43c1f3f`. Verification: IDM 22 tests, Policy 42 tests, Workflow Engine 56 tests, migration-to-head check and Core WebUI TypeScript check passed.

zemion removed the codex/ready

status

ready

labels 2026-07-31 19:42:55 +02:00

zemion closed this issue

2026-07-31 19:42:55 +02:00

zemion referenced this issue

2026-07-31 19:43:34 +02:00

[User Story] Bestow an organization function through governed grant workflows #9

Sign in to join this conversation.