1.7 KiB
Mandates Domain
Ownership
Mandates owns stable mandate identities and immutable revisions. A revision states effective time, task and authority types, constrained organization units/functions, jurisdiction, subject scope, authority ceiling, legal bases, evidence, lifecycle state, and explicit conflicts.
It does not own organization structures, function incumbency, accounts, application permissions, policy rules, cases, or formal decisions.
Resolution
Resolution is tenant-bound and deterministic. It evaluates the requested time, task, authority, unit, function, jurisdiction, and subject against the latest effective revision of each mandate. Conflicting effective mandates fail closed and return their conflict/evidence references.
Consumers must freeze the exact mandate reference and evidence used for a consequential action. A later mandate correction does not rewrite historical decisions or effects.
Catalogue reads follow the platform temporal-data context, independently selecting valid time and the system's recorded-state cutoff. A resolver's explicit effective instant takes precedence. Competence and authorization for a new action are never recovered merely by browsing historical data.
Revision And Recovery
Creation and revision use optimistic concurrency. Every new revision has a new
revision identifier, recorded_at, and change reason. Lifecycle transitions
follow the shared Core contract. Rows are append-only apart from marking the
previous row superseded; destructive retirement requires the platform database
snapshot and module-retirement preflight.
Database restore is the recovery unit. Replaying a request with the same tenant, mandate identity, and revision is idempotent; a different payload under an existing revision is rejected.