Protect application operations
Last updated:
Protect organization-scoped product and framework operations at the server-side execution boundary. UI visibility is not sufficient.
Warning
The WS-005 evaluator and policy implementation remain in progress. Use this structure as integration guidance, not as a readiness claim.
Prerequisites
- Resolve an authoritative account and validated organization context.
- Identify the exact policy required by the operation.
- Keep consumer-owned persistence and transactions separate from Helium internals.
Enforce the operation boundary
- Validate structural input without loading foreign organization data.
- Evaluate the required framework or consumer policy.
- Load the target through an organization-scoped query.
- Apply capability-specific ownership, version, entitlement, and transition invariants.
- Perform the mutation in the owning transaction.
- Record consumer-owned durable work or lifecycle reactions using stable idempotency identities.
Do not authorize from submitted roles, cached UI state, route values, or a previously positive decision from another request.
Handle denial
Return a bounded authorization or not-found-equivalent result according to the disclosure model. Preserve correlation identifiers for diagnostics but omit protected resource state and raw exceptions.
Verify the result
Test Owner, Administrator, Member, removed membership, foreign organization, stale version, dependency outage, and concurrent state-change cases. Confirm that denied paths do not read or mutate cross-organization records.
Next steps
Review Organization isolation and Define consumer policies.