Review workflow permission inventory — 2 October 2026¶

Latest 3 October planning update: LC1 readiness/admin-confirmed reopening, UA1 optional blanks, PM2 owner-granted group delegation, ODIR1 single measure direction and MIG1/IP1 authorized planning supersede earlier open/deferred wording below. Review the implementation plan and its linked matrix/migration/settings proposals. No runtime execution is authorized.

This inventory tracks actions discussed during design finalisation. The owner decision ledger supplies the authoritative confirmed behavior; the review-step handoff supplies the flows. Capability names below are requirements or existing mapping candidates, not invented roles, new implemented permission identifiers or automatic grants. This is planning only.

Existing permission basis¶

The existing resource catalogue includes stage Review, Reconcile, Design, and project Design, AssignPermissions, ViewStudies, ExportData and other actions. Project/stage grants already support project groups and stage-specific member grants; use those contracts rather than adding personas. A catalogue entry is not proof a new endpoint or permission check exists. Project membership or ViewStudies alone does not prove accepted-answer visibility. Map reads to the actual answer visibility/access policy and existing resource grants.

The earlier reconciliation plan maps configuration to admin authority and ordinary reconciliation to eligible reconcilers/admins. Its assignment discussion supports pool selection; the later owner overlay permits explicit individual assignment as well. Those earlier role labels are shorthand, not permission to bypass eligibility or a newly specified action capability. Use effective capabilities at admission, read and submit time.

Action-to-capability inventory¶

Action	Required capability / eligibility	Status and existing mapping	Remaining grant detail
Create/configure project membership groups	Explicit group-administration authority	PM1 confirms configurable groups under project membership/groups; reuse existing group architecture	Map existing group-management action; decide whether separate from membership or grant administration; not implied by possessing Review/Reconcile
Assign/remove project group members	Explicit membership/group-management authority	PM1 confirmed; preserve existing active/disabled membership constraints	Verify existing membership/group action scope and whether separate grant needed
Configure/grant group project-scoped capabilities	Explicit project permission-administration authority	PM1 confirmed project grants; catalogue AssignPermissions currently owner-allowed only in inspected entry	Reconcile admin delegation with existing authority; exact grant/default matrix, no implicit right to grant possessed capabilities
Configure/grant group stage-scoped capabilities	Explicit scoped permission-administration authority	PM1 confirms stage-scoped grants, using existing project groups	Verify stage administration/membership scopes; do not infer all-stage authority from one stage grant
Transfer project ownership	Existing owner-only action authority	PM1 explicitly excludes ownership transfer from ordinary-admin blanket defaults; inspected ChangeOwner allows owner with no group/member/user allowances	Verify endpoint/owner constraints before implementation; no new transfer grant/default expansion approved
View pool, held/correction work context	Relevant explicit scoped context-view capability and dataset visibility/blinding	PM1 confirms scoped permissions govern non-admin context; no universal answer visibility	Determine separate grants versus suitable existing context-view permissions; distinguish context summaries, candidates and accepted-answer reads
Open, autosave, Save, Complete or correct own form session	Review access to that stage/workflow and applicable ownership/admission requirements	Existing stage `Review` mapping; confirmed shared session and latest explicit Save/Complete semantics	Exact concurrency/command gates; do not infer access from previous completion alone
Configure form questions, versions and reviewer guidance	Authorised project question/form design	Map to existing project `Design`; confirmed optional reason/guidance and admin transition choices	Exact existing action coverage to verify; no duplicate form-designer role
Publish form/question version and choose impact handling	Authorised design/publish action, current statistics gate and recorded admin choices	Admin-controlled baseline; project `Design` is a mapping candidate, not a newly approved grant	Publish action coverage, scope and confirmation enforcement
Configure stage bindings, step overrides and visibility	Authorised stage design/configuration	Existing stage `Design` mapping candidate; versioned stage settings confirmed	Exact command coverage; no independent form-owned EW1 control
Configure saved-work-after-exclusion default	Authorised stage configuration	Confirmed EW1: stage default Allow; advanced per-step override	Reuse stage design authority; exact finer delegation not decided
Configure reconciliation identity blinding	Authorised stage reconciliation configuration	Confirmed BL1: stage-owned across workspace; existing stage `Design` mapping candidate	Exact configuration action coverage; no competing form/profile identity grants
Receive/start ordinary pool reconciliation and submit resolution	Reconcile capability plus initial reconciler eligibility and active-work admission	Existing stage `Reconcile`; shared pool default, RE1 optional explanation and RE2 final form acceptance confirmed	Existing active-work tracking integration/atomic guards; no individual-assignment expiry applied
Assign a specific study to an eligible reconciler	Authorised individual assigner; recipient eligible for that study/stage	Confirmed small admin feature; existing admin/configuration authority is the baseline	Exact mapping to existing admin actions or finer delegated assignment grant/scope remains open; `Reconcile` alone is not an assignment grant
Set stage default assignment expiry	Authorised stage configuration	Confirmed stage default for explicitly assigned unstarted work	Map existing stage design/admin authority; finer granularity open
Override expiry for one explicit assignment	Authorised assigner, with audit	Confirmed override; changed defaults apply only to new assignments	Whether same admin action covers override or a finer delegated grant is needed remains open; do not invent permission identifier
Release a started explicit assignment to pool	Authorised admin release capability	Confirmed release with saved-work preservation; started work never auto-expires	Exact existing admin authority/action mapping versus finer release grant remains open; not granted by mere reconciler status
Submit after assignment release	Reacquire work plus current Reconcile eligibility/admission	Confirmed original reconciler must reacquire before further submission; earlier history/work preserved	Atomic release/reacquisition and stale-submit guards
Request one additional independent review after target	Specific Request an additional review capability; requested reviewer must be independently eligible	Explicit confirmed capability; not implied by Reconcile, admin label or ordinary reviewer status	Machine identifier, resource scope and assignment of grants still to design; check for compatible existing action before adding identifier
Receive/complete requested independent additional review	Review capability and independent eligibility; no other candidate answers visible	Confirmed assessment returns to reconciler; normal form target unchanged and gold not automatically changed	Allocation, request identity/idempotency and return flow; do not invent default grants
View accepted reconciled answer	Existing effective answer-view access plus visibility policy	Confirmed VS1/QY7; own answers available, other candidate answers isolated	Map to actual existing readers; no new blanket viewer role
Raise query on accepted answer	Existing permission to view that answer	Confirmed QY7; no additional candidate/reconciler prerequisite and no expanded visibility	Enforce exact accepted-version reference and access; do not require new query-raiser role
Resolve/approve/reject an accepted-answer query	Query-review permission	Confirmed QY4/QY7; prefer different authorised person, but permitted self-review is audited	Map to existing suitable authority or introduce finer grant only if necessary; do not assume every Reconcile grant authorises queries
Prepare/publish query-approved replacement gold	Query-review approval authority plus applicable authoritative-snapshot publication checks	Confirmed gold remains effective pending valid replacement; affected children resolved first	Exact snapshot publisher action/transaction and grant mapping; no ordinary candidate promotion
View agreement statistics	Separate agreement-statistics view capability; not admin control or implicit Reconcile grant	Confirmed AG1; existing stage ViewAnnotationProgressGraph / project statistics-view actions are mapping candidates only	Verify suitable scope/identifier and grants; no individual candidate-answer access or identity-blinding bypass
Download current/historical/as-of review data	Existing export authority plus current dataset visibility/access policy	Confirmed EX1 selection direction; reuse existing project ExportData and merged #3243 authorization	Historical/temporal implementation and cutoff consistency not verified; no new viewer/exporter role or visibility expansion
Receive query resolution notification	Person raised concern, with content filtered to current permissions	Confirmed per-concern outcome plus optional explanation; no other candidates' answers/reasons leaked	Delivery mechanics and permission-aware payload; no permission to send messages now
Grant/delegate project or stage capabilities	Existing permission administration authority	Existing project `AssignPermissions` is a mapping basis; PM1 confirms configurable admin group/grant design, while exact grant-administration authority/default mapping must be reconciled with owner-only catalogue checks	Verify stage delegation rules and scope; no auto-grant from assignment or notification

Confirmed current and historical downloads (EX1)¶

Chris, 2 October 2026: current answers are the default download, including accepted/gold and candidate answers as applicable. Previous versions must be downloadable for reproducibility, including review-data state as of a particular date. The earlier undecided export note is superseded. Reuse and compare the recovered temporal/version work first; see the read-only investigation. Open #2461/#2574 reserve historical modes but currently support only CurrentState; merged #2398 is a plan. Do not claim that arbitrary-date retrieval already ships or invent a second export architecture. Existing export authority and answer visibility apply; cutoff/consistency details need comparison.

Confirmed agreement-statistics access (AG1)¶

Chris, 2 October 2026: viewing agreement statistics requires a separate capability so administrators can grant access without granting admin control. Reconcile does not implicitly grant it. It does not expose individual candidate answers or bypass stage identity blinding. Reuse an existing suitable statistics-view permission if its scope matches; exact technical mapping remains to verify, not a decision to invent a duplicate permission or new role.

Confirmed reconciled-answer explanations (RE1)¶

Chris, 2 October 2026: explanations for reconciled annotation answers are optional, including when an authorised reconciler chooses an answer different from every candidate. A non-blocking reminder may encourage an explanation; absence never becomes a completion or publication gate. Reconcile authority and Request an additional review remain separate capabilities. This does not waive answer validity or affected-child validation. Current/historical download direction is now confirmed under EX1.

Assignment boundary and audit¶

Expiry applies only to explicit, unstarted assignments. Normal pool work instead uses existing active-work tracking to prevent simultaneous reconciliation editing. Started explicit work does not auto-expire; authorised admin release returns it to the pool, retains drafts and immutable Save/Complete history, and requires reacquisition before another submission. Stage-default changes affect new assignments; preserve each assignment's chosen expiry and audit overrides.

Record who assigned, overrode expiry, released, requested extra review, raised a query and resolved it. Self-review in an authorised query is visible in audit. These are action audit requirements; exact record/event representations and the start boundary remain engineering design. Do not treat a capability grant as evidence someone performed the action.

Genuine permission gaps and recommendations¶

Existing admin authority is the baseline for assignment/configuration/release, but exact existing action mappings and finer delegation for individual assignment, expiry override and release need design. Do not invent three permission identifiers by default.
Request an additional review is a settled specific capability requirement; its technical identifier, scope and grant defaults remain to specify. It does not raise the form target.
AG1 agreement-statistics viewing is a settled separate capability, not implicit Reconcile. Verify suitable existing stats-view scope before introducing a new identifier; it grants neither admin control nor candidate-answer/identity access. EX1 download direction is confirmed, while historical retrieval/cutoff implementation remains to compare with recovered work.
Query-review approval capability is settled; its mapping to existing authority and snapshot publication enforcement need design. The self-review exception applies only to authorised query review, not ordinary initial candidate-versus-reconciler eligibility.
Stale accepted-version/concurrent query resolution, assignment start detection and atomic release/reacquire gates remain open. No automatic retarget/close policy has been selected.
Publish-pause queued retries and reviewer notification UX remain recommendations, not approved permission grants. All reads/writes still enforce existing admission and visibility contracts.

Reviewable prototype acceptance¶

Show each administrative action with its required capability, not only a role name. A person with Reconcile but without Request an additional review cannot invoke the extra-review action. An eligible pool reconciler uses active-work tracking without explicit-assignment expiry. An unstarted explicit assignment can expire; a started one stays until authorised release, keeps saved work and refuses further submission until reacquisition. Stage expiry changes leave existing assignments unchanged; overrides identify their actor. Identity blinding stays consistent across the workspace. Query raise/resolution examples enforce viewer/query-review capabilities and audit authorised self-review. These are later slice acceptance requirements, not an instruction to implement them in this planning task.

Confirmed project groups and scoped capability design (PM1; narrows P12/RD8/OD6)¶

Chris, 3 October 2026: workflow actions, including assignment, release and expiry, should be grouped into specific permissions. Inventory every proposed capability, refine the matrix and explicitly determine which actions merit separate grants; do not imply them from role labels. Project membership groups are configurable: administrators can create project groups, assign members and grant groups specific permissions, some project-scoped and some stage-scoped. Present this under project membership/groups with permissions subsections. Reuse the existing documented group/grant architecture; configurable groups are not unresolved.

Non-admin pool/held/correction context follows the relevant explicitly granted scoped permissions, not universal answer visibility. Having a capability is distinct from configuring or granting capabilities; permission-administration authority must be checked independently. Ordinary administrators should have most/all ordinary project permissions by default, but ownership transfer is expressly excluded from a blanket admin default. Verify existing owner-only actions before defining the exact default set; that complete set is not approved.

Read-only catalogue check: inspected ResourceSecurity.json ChangeOwner (lines 52–57) permits the project owner, with empty allowed project/application group lists and no all-member or all-user allowance. Its AssignPermissions entry likewise permits the owner in the inspected catalogue. This is evidence to map safely, not proof ordinary admins already have every proposed administration action. Do not silently expand owner-only actions through a default-admin label. Precise grants/scopes/default matrix and technical mappings still need refinement; generic configurable-group existence, placement and explicit-grant direction are settled.

Latest confirmed direction and concrete approval proposals — 3 October 2026¶

This section supersedes earlier deferred/open wording for P9–P14 where stated; original source prototype and historical discussion are retained, not rewritten as implemented behavior.

LC1 / P11: automatic completion requires no unresolved applicable work, including drafts and outstanding corrections. Alert project admin and obtain confirmation before admitting a change that would reopen a Completed stage. Commit approved change then auto transition in automatic mode; manual mode requires explicit reopen/switch-off. Preserve new-study auto reopening under this gate, current Complete counting until actual incomplete-version action, autosave/draft distinction and history. Precise approval/concurrency/draft routing is proposed, not a newly approved permission or spontaneous reopening.
UA1 / P14: required applicable questions cannot be omitted in completed candidates; optional unanswered questions can be decided by the reconciler. Blank is not N/A. Configurable all-applicable-gold completeness was suggested; project/form scope/default and statistical missing/Unknown comparisons/denominators remain approval proposals. AG3 N/A/version and EX2 available-history decisions stay settled; Complete anyway never waives answer validation.
PM2 / P12: project owner can assign permission administration to a membership group; authorized members administer/delegate within approved scope. This deliberately extends currently owner-only AssignPermissions. Ownership transfer remains owner-only. Proposed owner-reserved delegation-envelope administration/non-recursive delegation boundaries are explicit recommendations. Possessing a grant never means administering it. Group template names/bundles are implementer discretion after complete action inventory, not owner blockers.
ODIR1 / P10: one versioned outcome-measure direction across cohorts in a paper/population; no context override. Genuinely different meanings require separate measures. Earlier open override proposal is superseded; retained conflicting legacy values require reviewed mapping.
MIG1 / P9: drafting outcome migration/adoption plan is now authorized, superseding deferred planning status. Execution, activation and live migration remain unauthorized.
IP1: concrete implementation planning authorized, not runtime code. Major product choices are covered; review remaining exact proposals before implementation instead of reopening them.

Reviewable standalone documents:

All are planning deliverables. Approval choices are marked; no default/grant, data conversion, statistical formula, production lifecycle behavior or source-prototype update is claimed.