40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
# Mandates Domain
|
|
|
|
## Ownership
|
|
|
|
Mandates owns stable mandate identities and immutable revisions. A revision
|
|
states effective time, task and authority types, constrained organization
|
|
units/functions, jurisdiction, subject scope, authority ceiling, legal bases,
|
|
evidence, lifecycle state, and explicit conflicts.
|
|
|
|
It does not own organization structures, function incumbency, accounts,
|
|
application permissions, policy rules, cases, or formal decisions.
|
|
|
|
## Resolution
|
|
|
|
Resolution is tenant-bound and deterministic. It evaluates the requested time,
|
|
task, authority, unit, function, jurisdiction, and subject against the latest
|
|
effective revision of each mandate. Conflicting effective mandates fail closed
|
|
and return their conflict/evidence references.
|
|
|
|
Consumers must freeze the exact mandate reference and evidence used for a
|
|
consequential action. A later mandate correction does not rewrite historical
|
|
decisions or effects.
|
|
|
|
Catalogue reads follow the platform temporal-data context, independently
|
|
selecting valid time and the system's recorded-state cutoff. A resolver's
|
|
explicit effective instant takes precedence. Competence and authorization for
|
|
a new action are never recovered merely by browsing historical data.
|
|
|
|
## Revision And Recovery
|
|
|
|
Creation and revision use optimistic concurrency. Every new revision has a new
|
|
revision identifier, `recorded_at`, and change reason. Lifecycle transitions
|
|
follow the shared Core contract. Rows are append-only apart from marking the
|
|
previous row superseded; destructive retirement requires the platform database
|
|
snapshot and module-retirement preflight.
|
|
|
|
Database restore is the recovery unit. Replaying a request with the same
|
|
tenant, mandate identity, and revision is idempotent; a different payload under
|
|
an existing revision is rejected.
|