Roles and approvals
Choose a role
Each member has one role in a tenant. Roles are hierarchical:
| Role | Authority |
|---|---|
| Viewer | Read the tenant's rulesets and change evidence. |
| Editor | Viewer access, plus author working versions and fixtures and request activation. |
| Approver | Editor access, plus decide requests, roll back an active version and manage member roles and tenant settings. |
An approver changes roles on the Members page. A role change applies on the member's next action; the system refuses removal of the tenant's last approver.
Request and review a change
An editor or approver requests activation of an exact working revision. The request pins the document and fixture content. A later draft or fixture-content change invalidates the request; request the changed revision again.
The approver builds evidence for the request: a mechanical diff, modification rationales, fixture comparisons and an advisory change summary. Evidence is stored as an immutable snapshot, including the active version it compared against. Opening its sections reads that snapshot. Rebuilding creates a new snapshot; an interrupted, invalidated build stores no completed evidence.
Review every evidence section before approving or rejecting. Approval rechecks the requested revision, fixture content and active baseline, and validates activation requirements. If the active version has changed since the evidence was built, rebuild the evidence. A failing tenant fixture is evidence for the approver's decision; it does not by itself block activation. A template's separate publication gate requires passing fixtures.
The activation record retains the actor, decision comment, evidence reference and the comparison baseline so the decision can be inspected later.
Separation of duties
An approver controls the tenant's audited separation setting. It is off by default. When enabled, a person who requested the change or saved a ruleset revision or fixture adjustment since the active version cannot approve that change. The setting is checked at decision time, including for requests already pending. When separation is off, such an approval is allowed and explicitly flagged as approval by an editor of the change. The activation record retains the setting applied.
Active version and rollback
Jobs submitted through an integration use the active ruleset version. After approval or rollback, new submissions follow the new active pointer. An existing run retains its pinned version.
Only an approver can roll back. The approver acts alone, without a second approval request, selecting a previously active immutable version. The previous active version is the last-known-good reference. Rollback moves the pointer, creates no new version and writes its own activation record.
Activation policy and transition
The agreed policy is that every activation of new tenant rule content goes through a request and an approver's decision on stored evidence. Retirement of the legacy activation paths is prepared but awaits final integration verification. The exclusive-path guarantee applies when that transition is complete. Rollback and fixture-gated template publication have the distinct authority and evidence rules described above.