[User Story] Bestow an organization function through governed grant workflows #9

New Issue

2026-07-31T15:05:48+02:00

zemion commented

2026-07-31 15:05:48 +02:00

User Story

As an effective function holder or designated authority, I want to bestow a function on an eligible identity through the configured grant process, so that responsibility changes are timely, accepted where required, and fully auditable.

Supported Grant Profiles

holder_grant: an effective holder may initiate and grant within Policy ceilings.
holder_with_authority_clearance: a holder proposes and the designated authority clears.
authority_only: only the authority may initiate and approve.
Recipient acceptance can be required; waiving it requires an explicit Policy decision and provenance.

Journey

Select the function and an eligible identity/account.
See the effective grant profile, authority, conflicts, validity/delegation limits, and required evidence.
Submit the grant and complete holder, authority, quorum, and recipient steps required by the pinned workflow.
IDM applies the assignment exactly once and exposes its effective dates and source provenance.

Acceptance Criteria

Initiator/approver eligibility is rechecked at every action.
A holder who no longer holds the source function cannot continue unless Policy explicitly preserves authority for the open change.
Vacancy, unavailable authority, conflict, duplicate assignment, and separation-of-duty failures block with explanations.
Recipient acceptance, expiry, maximum validity, delegation, quorum, and escalation are profile-controlled.
Direct emergency assignment is either disabled or recorded as an explicit override with reason and equivalent Audit evidence.
IDM owns the grant record and assignment; Workflow Engine owns orchestration; Organizations and Policy own definitions/decisions.
Notifications and Audit integrations remain optional and capability-based.
Historical grant workflow and assignment evidence remains available after function, holder, or workflow revisions change.

Architecture: Function assignment request and grant workflows. Depends on GovOPlaN/govoplan-workflow#12/#13.

## User Story As an effective function holder or designated authority, I want to bestow a function on an eligible identity through the configured grant process, so that responsibility changes are timely, accepted where required, and fully auditable. ## Supported Grant Profiles - `holder_grant`: an effective holder may initiate and grant within Policy ceilings. - `holder_with_authority_clearance`: a holder proposes and the designated authority clears. - `authority_only`: only the authority may initiate and approve. - Recipient acceptance can be required; waiving it requires an explicit Policy decision and provenance. ## Journey 1. Select the function and an eligible identity/account. 2. See the effective grant profile, authority, conflicts, validity/delegation limits, and required evidence. 3. Submit the grant and complete holder, authority, quorum, and recipient steps required by the pinned workflow. 4. IDM applies the assignment exactly once and exposes its effective dates and source provenance. ## Acceptance Criteria - Initiator/approver eligibility is rechecked at every action. - A holder who no longer holds the source function cannot continue unless Policy explicitly preserves authority for the open change. - Vacancy, unavailable authority, conflict, duplicate assignment, and separation-of-duty failures block with explanations. - Recipient acceptance, expiry, maximum validity, delegation, quorum, and escalation are profile-controlled. - Direct emergency assignment is either disabled or recorded as an explicit override with reason and equivalent Audit evidence. - IDM owns the grant record and assignment; Workflow Engine owns orchestration; Organizations and Policy own definitions/decisions. - Notifications and Audit integrations remain optional and capability-based. - Historical grant workflow and assignment evidence remains available after function, holder, or workflow revisions change. Architecture: [Function assignment request and grant workflows](https://git.add-ideas.de/GovOPlaN/govoplan-idm/src/branch/main/docs/FUNCTION_ASSIGNMENT_WORKFLOWS.md). Depends on GovOPlaN/govoplan-workflow#12/#13.

zemion added the

type

user-story

module/notifications module/audit module/policy module/access area/webui module/idm module/organizations area/api area/security codex/ready area/db area/governance module/workflow

labels 2026-07-31 15:05:48 +02:00

zemion referenced this issue

2026-07-31 15:06:34 +02:00

[Feature] Expose effective function-assignment resolution and lifecycle events for consumers #5

zemion commented

2026-07-31 19:43:34 +02:00

Implemented and pushed together with #8.

The grant path now supports holder grant, holder plus authority clearance, and authority-only profiles; optional recipient acceptance; current incumbent/authority/candidate rechecks; evidence, quorum, separation, expiry and maximum validity; exact-once effective assignment; durable blocked/manual-review outcomes; explicit emergency direct-write override provenance; Notifications; Audit; and a complete authoring/review UI.

Historical grants retain the pinned policy decision, workflow revision/hash, actor/evidence trail and resulting assignment even when live definitions change or disappear.

Advanced delegation-chain ceilings and timed escalation are separated into #10 so those semantics remain explicit rather than being implied by the base grant journey.

Commits: govoplan-core 6ebb299, govoplan-organizations daeaa4b, govoplan-policy e061f23, govoplan-idm c14719d, govoplan-workflow-engine 43c1f3f.

Verification: IDM 22 tests, Policy 42 tests, Workflow Engine 56 tests, migration-to-head check and Core WebUI TypeScript check passed.

Implemented and pushed together with #8. The grant path now supports holder grant, holder plus authority clearance, and authority-only profiles; optional recipient acceptance; current incumbent/authority/candidate rechecks; evidence, quorum, separation, expiry and maximum validity; exact-once effective assignment; durable blocked/manual-review outcomes; explicit emergency direct-write override provenance; Notifications; Audit; and a complete authoring/review UI. Historical grants retain the pinned policy decision, workflow revision/hash, actor/evidence trail and resulting assignment even when live definitions change or disappear. Advanced delegation-chain ceilings and timed escalation are separated into #10 so those semantics remain explicit rather than being implied by the base grant journey. Commits: govoplan-core `6ebb299`, govoplan-organizations `daeaa4b`, govoplan-policy `e061f23`, govoplan-idm `c14719d`, govoplan-workflow-engine `43c1f3f`. Verification: IDM 22 tests, Policy 42 tests, Workflow Engine 56 tests, migration-to-head check and Core WebUI TypeScript check passed.

zemion removed the codex/ready

status

ready

labels 2026-07-31 19:43:36 +02:00

zemion closed this issue

2026-07-31 19:43:37 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-idm#9