Informational Fresh jira_story: GOV-103

Lesson 3 of 3 — Resolve and enforce workspace role

Foundations & Tenancy · Source: Jira Story GOV-103 (5 pts) · Authority: Informational (the Jira story is authoritative).

Purpose

Enforce workspace roles at both API and UI layers.

Why it matters

Defence-in-depth: the API blocks and the UI hides — roles must hold at every layer.

Where this lives

Runs in the Customer AI Governance platform (components: platform). Role resolution gates write endpoints (403) and scopes row visibility; the UI mirrors it. Learn teaches this read-only.

Workflow

Given an auditor
When a write endpoint is called
Then it returns 403 and the UI hides edit, while an owner sees only their own rows

Worked example

The UI hides the edit button for an auditor, but the write API still accepts their request. Is that acceptable?

No — the API must also return 403; UI hiding alone is not enforcement.

Acceptance criteria (authoritative — GOV-103)

Given an auditor, when a write endpoint is called, then it returns 403 and the UI hides edit, while an owner sees only their own rows.

Common pitfalls

Hiding controls in the UI but leaving the write API open.

Knowledge check

Scenario: The UI hides the edit button for an auditor, but the write API still accepts their request. Is that acceptable?
Look for: No — the API must also return 403; UI hiding alone is not enforcement.

Key concepts

workspace roles
API 403
defence-in-depth

For the AI Tutor

Summary: Enforce workspace roles at both API and UI layers.
When to use: teaching or answering questions about "resolve and enforce workspace role".
When NOT to use: the SoD validation rule (that is GOV-133).
Key concepts: workspace roles, API 403, defence-in-depth.

Completion criteria

Learner passes the scenario knowledge check and can point to the system state that satisfies GOV-103's acceptance criterion.

Module: LEARN-MOD-002 (Foundations & Tenancy)
Provenance: LEARN-MAP-001 · Generation standard: LEARN-STD-002
Next: (module complete)