Skip to content
LQMS
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
Table of contents
Context
Decision
1. The Project Administrator's permission set is UNCHANGED — no standing content rights
2. Refusals become doors
3. Permission closure — the door must lead somewhere
4. Timed self-staffing — the window is declared, the expiry is enforced by the predicate
5. The marker — a persistent header chip while any timed staffing is active
6. Sequencing
Rejected: standing content rights on the Project Administrator
The dissolved misconception
Consequences
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" > <div class="md-nav__link md-nav__container"> <a href="../../requirements/" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../requirements/stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/gap-analysis/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" > <div class="md-nav__link md-nav__container"> <a href="../../validation/" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../validation/templates/ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/tool-risk-assessment/" class="md-nav__link"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#context" class="md-nav__link"> <span class="md-ellipsis"> Context </span> </a> </li> <li class="md-nav__item"> <a href="#decision" class="md-nav__link"> <span class="md-ellipsis"> Decision </span> </a> <nav class="md-nav" aria-label="Decision"> <ul class="md-nav__list"> <li class="md-nav__item"> <a href="#1-the-project-administrators-permission-set-is-unchanged--no-standing-content-rights" class="md-nav__link"> <span class="md-ellipsis"> 1. The Project Administrator's permission set is UNCHANGED — no standing content rights </span> </a> </li> <li class="md-nav__item"> <a href="#2-refusals-become-doors" class="md-nav__link"> <span class="md-ellipsis"> 2. Refusals become doors </span> </a> </li> <li class="md-nav__item"> <a href="#3-permission-closure--the-door-must-lead-somewhere" class="md-nav__link"> <span class="md-ellipsis"> 3. Permission closure — the door must lead somewhere </span> </a> </li> <li class="md-nav__item"> <a href="#4-timed-self-staffing--the-window-is-declared-the-expiry-is-enforced-by-the-predicate" class="md-nav__link"> <span class="md-ellipsis"> 4. Timed self-staffing — the window is declared, the expiry is enforced by the predicate </span> </a> </li> <li class="md-nav__item"> <a href="#5-the-marker--a-persistent-header-chip-while-any-timed-staffing-is-active" class="md-nav__link"> <span class="md-ellipsis"> 5. The marker — a persistent header chip while any timed staffing is active </span> </a> </li> <li class="md-nav__item"> <a href="#6-sequencing" class="md-nav__link"> <span class="md-ellipsis"> 6. Sequencing </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="#rejected-standing-content-rights-on-the-project-administrator" class="md-nav__link"> <span class="md-ellipsis"> Rejected: standing content rights on the Project Administrator </span> </a> </li> <li class="md-nav__item"> <a href="#the-dissolved-misconception" class="md-nav__link"> <span class="md-ellipsis"> The dissolved misconception </span> </a> </li> <li class="md-nav__item"> <a href="#consequences" class="md-nav__link"> <span class="md-ellipsis"> Consequences </span> </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/decisions/adr-0130-break-glass-escalation.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id="adr-0130-break-glass--the-project-administrators-escalation-is-a-first-class-witnessed-self-expiring-act">ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act<a class="headerlink" href="#adr-0130-break-glass--the-project-administrators-escalation-is-a-first-class-witnessed-self-expiring-act" title="Permanent link">¶</a></h1> <ul> <li><strong>Status:</strong> accepted (2026-09-01 — register row 48, layers ii + iii. He opened with the opposite proposal — the project administrator as <em>"the 'oh shit I have a problem' person with all rights"</em> — was argued out of standing content rights and ruled: <em>"I concede :) Your chain of arguments is convincing and I like your proposal"</em>. He then extended the design twice, both adopted: <em>"make a temporary function so that the additional staffing gets removed after a specified time (30 min, 60 min, 1 day)"</em> and <em>"a visual indicator if one or more temporary roles are active on the user, e.g. as a marker at the top of the screen"</em>.)</li> <li><strong>Date:</strong> 2026-09-01</li> <li><strong>Deciders:</strong> Nicolas Burri</li> <li><strong>Relates to:</strong> ADR-0012 (admin ≠ content — the boundary this ADR keeps rather than bends), ADR-0121 (the Project Administrator's permission cut — <strong>unchanged</strong> by this decision), ADR-0117 (substitution rejected; <strong>time-boxed staffing named as the sanctioned shape</strong> should the refusal ever prove insufficient — this ADR is that trigger firing, for a different reason than the one anticipated), ADR-0129 / V122 (<code>lqms_role_identity_reaches</code> and the resolver family the expiry filter must respect), ADR-0128 (the permission classification that makes "content act" a structural fact), ADR-0114 (the arrival import's role-mapping step §3 extends), ADR-0124 / V106 (the setup-status dead-end pattern §3 follows), ADR-0064 (workflow role bindings — why neither model can bypass four-eyes), ADR-0110 (the trail is written by every act), open decision 48 (this ADR realizes its ruling).</li> </ul> <h2 id="context">Context<a class="headerlink" href="#context" title="Permanent link">¶</a></h2> <p>Row 48 began as a bug report with no bug in it. In one customer project nobody could move a document or set its language: the act's gate (<code>ORGANIZE_DOCUMENTS</code>, the folder-move class) is correct, but the arrival import's role mapping landed an operating model in which <strong>no staffed role held that permission</strong> — the Project Administrator holds administration plus read, the QMB holds create/edit, the reader roles hold reads. A permission existed that belonged to nobody, and nothing said so. The immediate remedy was his own act on his own instance (layer i: grant <code>ORGANIZE_DOCUMENTS</code> to the QMB in that project, done by him as project administrator).</p> <p>What the incident actually exposed is a doctrine question. His instinct — <em>the project admin has all rights on project files</em> — is the natural reading of "administrator", and it collides with the ruled boundary: organizing is classified a CONTENT act, and the Project Administrator holds no content acts (ADR-0121). The question is not whether the administrator can rescue a stuck project. He can, today, because <code>ASSIGN_ROLES</code> is already the master key. The question is <strong>whether that rescue looks ordinary or exceptional in the record.</strong></p> <h2 id="decision">Decision<a class="headerlink" href="#decision" title="Permanent link">¶</a></h2> <h3 id="1-the-project-administrators-permission-set-is-unchanged--no-standing-content-rights">1. The Project Administrator's permission set is UNCHANGED — no standing content rights<a class="headerlink" href="#1-the-project-administrators-permission-set-is-unchanged--no-standing-content-rights" title="Permanent link">¶</a></h3> <p>The permission cut of ADR-0121 stands exactly as it is: administration, staffing, observation, <code>VIEW</code>, <code>VIEW_TRACEABILITY</code>. Escalation happens by a deliberate, recorded act — not by a standing grant. Four arguments carried it, and they are recorded because the instinct they overruled was a good one:</p> <ul> <li><strong>(a) Capability was never in question.</strong> A holder of <code>ASSIGN_ROLES</code> can staff himself into any activated role in his scope. Whatever the boundary is, it is not a limit on what he <em>can</em> do — so no argument for standing rights can be made from "he must be able to fix things". He must, and he can.</li> <li><strong>(b) Break-glass makes the intervention visible AS exceptional.</strong> The record then carries an act with a name, a moment and an end, instead of a document quietly moved by the administrator as if that were his ordinary work. The J1 precedent is the same shape at instance scale: the library's revocation wave ran under a staffing taken for the act, and the trail shows precisely that.</li> <li><strong>© Standing rights would permanently pair self-granting with acting.</strong> The holder of <code>ASSIGN_ROLES</code> who also holds the content permissions is the one combination access auditors dislike most — the ability to grant and the ability to use, resident in one role, indistinguishable in the trail. Break-glass separates them in TIME, which is the only separation available once the same person holds both keys.</li> <li><strong>(d) Neither model bypasses reviews.</strong> Four-eyes and release discipline live in the per-document workflow role BINDINGS (ADR-0064) and the review policies, not in the permission set. So the choice between the two models is not about safety of the approval chain at all: it is purely <strong>capability surface plus trail honesty</strong>, and on both axes break-glass wins.</li> </ul> <h3 id="2-refusals-become-doors">2. Refusals become doors<a class="headerlink" href="#2-refusals-become-doors" title="Permanent link">¶</a></h3> <p>A permission refusal stops being a wall and becomes the first step of the remedy.</p> <ul> <li><strong>For a caller holding <code>ASSIGN_ROLES</code> in the target scope</strong>: the refusal names the missing permission, names which ACTIVATED roles in that scope hold it, and offers the audited self-staffing act inline — <em>"Staff yourself as QMB — this will be recorded"</em>. One click, one audited act, then the original act proceeds.</li> <li><strong>For every other caller</strong>: the refusal still names the permission and its holding roles, in human terms — role names and the scope's CODE/name, never permission constants, never scope UUIDs — so the person knows whom to ask. This ties into the queued refusal-presentation fix; the presentation rule is the same one, and this ADR is where the requirement becomes binding.</li> </ul> <p>The refusal thereby carries its own remedy, which is the process-dead-end principle applied to the authorization layer: every gate ships the derived answer to "then what?".</p> <h3 id="3-permission-closure--the-door-must-lead-somewhere">3. Permission closure — the door must lead somewhere<a class="headerlink" href="#3-permission-closure--the-door-must-lead-somewhere" title="Permanent link">¶</a></h3> <p>A remedy that names roles is worthless when the permission is held by no role at all, which is exactly the state that project was in. Two structural additions close it:</p> <ul> <li><strong>The arrival import's role-mapping step surfaces the closure</strong>: before the operating model lands, the preview states which permissions would end up <strong>held by NO role</strong> in the target scope. The mapping is the moment the model is still cheap to change (ADR-0114).</li> <li><strong>Setup-status gains a dead-end check</strong>: <em>permission held by no STAFFED role</em> — a WARN finding in the established shape (<code>SetupStatusService</code>, the V106/ADR-0124 pattern: state, not paths), sibling to <code>UNSTAFFED_WORKFLOW_ROLE</code> and <code>NO_ACTIVATED_ROLE</code>, so a scope that has drifted into the same hole says so before someone hits the wall.</li> </ul> <p>This is the structural half of row 48 (layer ii) and the reason the row closes with an ADR rather than a grant.</p> <h3 id="4-timed-self-staffing--the-window-is-declared-the-expiry-is-enforced-by-the-predicate">4. Timed self-staffing — the window is declared, the expiry is enforced by the predicate<a class="headerlink" href="#4-timed-self-staffing--the-window-is-declared-the-expiry-is-enforced-by-the-predicate" title="Permanent link">¶</a></h3> <p>The break-glass staffing carries a <strong>duration</strong>, declared at the moment of the act: presets 30 minutes, 60 minutes, 1 day; <strong>default 60 minutes</strong>. The window is his design, adopted whole.</p> <ul> <li><strong>Enforcement is in the authorization predicate, never in a job.</strong> The assignment row carries <code>expires_at</code>, and every read that resolves authority filters it live. If the janitor never runs, nothing is over-granted — expiry is a property of the read, not of a sweep.</li> <li><strong>Implementation caution, recorded because it is easy to get wrong:</strong> the ADR-0129 resolver family is built FOR INLINING. <code>lqms_role_identity_reaches</code> is <code>IMMUTABLE</code>, plain SQL, no <code>SET</code> clause, precisely so PostgreSQL folds it into every caller's plan. The clock must <strong>not</strong> go inside it: <code>now()</code> is <code>STABLE</code>, so pushing it down would demote the function, cost the inlining and — worse — make an immutable predicate lie about its own contract. <strong>The expiry filter belongs on the assignment READS</strong> (<code>lqms_effective_roles</code>, <code>lqms_scope_users</code>, <code>lqms_role_holders</code>, <code>lqms_primary_role_holders</code>, the fan-out bodies, the permission/authorized-scope resolution and the Kotlin repositories that answer the same question) — one filter written identically everywhere, the same lockstep discipline ADR-0128/-0129 established. Pure predicates stay pure; immutable functions stay immutable.</li> <li><strong>A janitor only tidies.</strong> A scheduler sweep (the ADR-0037 tick) removes expired rows and writes the expiry audit event. It is bookkeeping and legibility, never enforcement.</li> <li><strong>The trail distinguishes three endings</strong>, because they are three different facts about a person: <strong>removed by a person</strong> (<code>ROLE_UNASSIGNED</code>, an actor), <strong>expired per the declared window</strong> (its own event, no actor — the system honouring what was declared), and <strong>extended</strong> — which is a FRESH AUDITED ACT with its own window, never a silent edit of the original row. The staffing act itself records the declared duration and what was being attempted when the door opened.</li> <li><strong>Ordinary staffing is untouched</strong>: staffing other people, long-term, stays permanent and unchanged. Generalizing timed staffing to other cases — external auditors given a review window, per-round reviewers, absence deputization (ADR-0117's original trigger) — is a named possible widening, <strong>not built here</strong>. The mechanism is deliberately introduced through the one case that argued for it.</li> </ul> <h3 id="5-the-marker--a-persistent-header-chip-while-any-timed-staffing-is-active">5. The marker — a persistent header chip while any timed staffing is active<a class="headerlink" href="#5-the-marker--a-persistent-header-chip-while-any-timed-staffing-is-active" title="Permanent link">¶</a></h3> <p>His second extension, adopted whole. While a person holds any unexpired timed staffing, the application header shows a persistent chip: <em>"Acting as QMB — 42 min left"</em>, <strong>one chip per active role</strong>, turning amber near expiry, carrying <strong>Extend</strong> and <strong>End now</strong> as actions on the chip itself.</p> <ul> <li><strong>Server truth, cosmetic countdown.</strong> The chip's existence and its remaining time are derived from the same assignment read the resolvers use. The client's ticking number is presentation; it never decides anything.</li> <li><strong>A personal surface.</strong> The marker is shown to the person who is escalated. Others do not see a badge on him — they read the trail, which is where the fact belongs.</li> <li><strong>It doubles as the graceful pre-expiry warning.</strong> Nobody is ambushed mid-act: the amber state arrives before the window closes, Extend is one click away on the same chip, and the editor never lets a save bounce as a surprise. Expiry is a declared ending, not a trap.</li> </ul> <blockquote> <p><strong>Amendment 2 (2026-09-07, first live use — row 77):</strong> §2's doors open only from refusals, and the surfaces (correctly) never offer acts the caller lacks — so the canonical persona could never reach the door from the UI. Ruled: the hiding is the desired state ("the UI should not tease functions that the user does not have"); the remedy is a <strong>deliberate entry</strong> — a "Break glass…" action visible only to genuine door-holders — and the escalation <strong>reason is mandatory</strong> on every take (his extension: "forcing them to give a reason"), enforced in the dialog AND at the API; the refusal path auto-fills it from the refused act, the deliberate path demands the human's own words. Lock-marked affordances are rejected by the same no-tease rule. <strong>Aligned 2026-09-08 ("fully agree"):</strong> §1(a)'s master key was never a capability limit, but the personal doors listing offers CONTENT-class roles only (ADR-0131 §3's argument, one surface over) while the <code>ASSIGN_ROLES</code> door of the act accepted any activated role — so the offer and the act asked different questions by one edge case. <strong>The ACT now carries the constraint on both doors</strong>: an administrative target is refused whichever way the caller came in, and <code>extend</code> inherits it through the same door check. Administrative authority stays a deliberate, permanent staffing act; break glass witnesses stepping into CONTENT work. His maxim, recorded with it: <em>"filtering to only show allowed selections from the start is preferrable"</em> — offer equals act, one server-side question.</p> </blockquote> <h3 id="6-sequencing">6. Sequencing<a class="headerlink" href="#6-sequencing" title="Permanent link">¶</a></h3> <p>Implementation lands <strong>after</strong> the 1.0-blocking fix waves; nothing here is a 1.0 gate. The ADR itself is the deliverable for now: it is the November-audit story artifact — the written answer to "how does your administrator intervene, and how would we know?".</p> <blockquote> <p><strong>Amendment (2026-09-01, same day — ADR-0131):</strong> "nothing here is a 1.0 gate" no longer holds. His substitution-edges ruling (<em>"I'd like to have it in 1.0"</em>) stands on this ADR's timed-staffing mechanism, so the mechanism moves <strong>into the 1.0 runway</strong>. Ordering within 1.0 is unchanged: after the 1.0-blocking fix waves, mechanism first, the ADR-0131 matrix on top — one arc.</p> </blockquote> <h2 id="rejected-standing-content-rights-on-the-project-administrator">Rejected: standing content rights on the Project Administrator<a class="headerlink" href="#rejected-standing-content-rights-on-the-project-administrator" title="Permanent link">¶</a></h2> <p>His opening proposal — the administrator simply holds the content permissions — was rejected with its costs recorded, since it is the option any reviewer will reach for again:</p> <ul> <li>It makes the exceptional intervention <strong>indistinguishable from ordinary work</strong> in the trail. The audit question "who moved this, and under what authority?" gets the answer "the administrator, as usual", which is no answer.</li> <li>It permanently resident-pairs self-granting (<code>ASSIGN_ROLES</code>) with acting — argument © above.</li> <li>It would be the <strong>first content permission handed to the Project Administrator</strong>, breaking the classification that ADR-0121 argued and ADR-0128 made structural, and inviting the next one.</li> <li>It buys <strong>nothing in capability</strong>: everything it enables is already reachable via <code>ASSIGN_ROLES</code> in one recorded step.</li> </ul> <p>Also rejected: reclassifying organizing as an ADMINISTRATIVE act. That would move the boundary to make one incident disappear, and the boundary is load-bearing in three other places (ADR-0128's cascade, the GLOBAL cross-tenant line, the classification guard). If it is ever wanted, it deserves its own argument and its own ADR — not a side effect of this one.</p> <h2 id="the-dissolved-misconception">The dissolved misconception<a class="headerlink" href="#the-dissolved-misconception" title="Permanent link">¶</a></h2> <p>The boundary between administration and content was never a <strong>capability limit</strong>. It could not be: the master key sits in the administrator's own hand. It is a <strong>witness</strong> — the thing that makes an administrator stepping into content work a visible, bounded, self-ending event rather than an unremarkable Tuesday. Once the boundary is read that way, his instinct and the ruled doctrine stop disagreeing: the administrator <em>is</em> the "oh shit I have a problem" person with all rights, and the system's job is to hold the glass, not the key.</p> <h2 id="consequences">Consequences<a class="headerlink" href="#consequences" title="Permanent link">¶</a></h2> <ul> <li>Row 48 closes across all three layers: (i) his grant on the affected project, (ii) closure surfacing at import + the setup-status dead-end check, (iii) this doctrine and its mechanism.</li> <li><code>role_assignment</code> gains a nullable <code>expires_at</code>; a null window means permanent, so every existing row keeps its meaning and no migration rewrites history. The new column joins the schema-extension lifecycle sweep (RLS inventory, export/import bundle shape, dissolution's delete set).</li> <li>The resolver family gains one more thing that must be written identically in every member. The V122 comment's inventory is the checklist; the guard test family grows a case that fails when a sibling forgets the filter — an expired assignment must never show up in a roster the gate would refuse, which is the same divergence ADR-0129 pinned.</li> <li>Two new audit event kinds sit beside <code>ROLE_ASSIGNED</code> / <code>ROLE_UNASSIGNED</code>: the expiry (actorless) and the extension (a fresh act). Reports that count staffing must read windows, not row existence.</li> <li>ADR-0117's named trigger has fired. Its refusal of acting-as/impersonation is untouched and remains the reason this is STAFFING with own-name authority: the trail says "he held QMB, from then until then", never "acting for someone".</li> <li>The refusal-presentation work gains a binding requirement (§2) and a second caller class, so it should be built once, for both.</li> </ul> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../adr-0129-global-role-identity/" class="md-footer__link md-footer__link--prev" aria-label="Previous: ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone </div> </div> </a> <a href="../adr-0131-role-substitution-edges/" class="md-footer__link md-footer__link--next" aria-label="Next: ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "../..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>