Your account
HOL-D080Story implementation: Planned

Resolve an account or membership support exception

membership · Proposed launch phase 1

Start from Home

Review as Platform administrator · Full workflow planned

User story

As a platform administrator, I want to handle an assigned account or membership exception with verified evidence so a person gets the right outcome without exposing or misgranting access.

Draft requirements for review · Updated 2026-10-19

What the app should do

  • Open an assigned support case with a stable account/issue reference, verification evidence and only the information needed to investigate.
  • Distinguish sign-in recovery, professional verification, subscription linkage and paid entitlement; each uses its own trusted decision path.
  • Record a resolution or escalation with a reason and customer-visible next step. An email claim or screenshot alone cannot grant paid access or reset credentials.
  • Any exceptional entitlement change requires separately approved authority, account ownership evidence and the D069 trusted grant/revoke process; never use support to bypass access rules.
  • Support ownership and least-privilege policy remain undecided. Do not add a new support-role account or send a message/change a real credential from this demo.

What to check in the demo

Follow these steps from the role’s landing page through navigation and feature checks.

Review as

Platform administrator

Start here: Home

Choose the Robin Park dummy account and open its assigned Platform administrator Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.

Navigation from sign-in

  1. 01Open the fictional Platform administrator account through the connected sign-in service. Seeded Home review opens directly. Real HOL staff access and protected actions require an authenticator check.
  2. 02On Platform administrator Home, select Roles + membership access, then inspect Decision history. These are sample access records, not a full support console.

Feature checks start here

Resolve an account or membership support exception · Full workflow planned

Planned full workflow. Existing workspace samples, where present, demonstrate only isolated controls. Backend implementation is on hold; no completed end-to-end outcome or stakeholder approval is claimed.

  1. 03Inspect the sample membership exception and the separate professional-attribute record.
  2. 04Once built, open a fictional assigned support case, verify account ownership using the agreed evidence and inspect the permitted account state.
  3. 05Resolve through the appropriate recovery, subscription-linkage or entitlement path; decline an unsupported request with a clear next step.
  4. 06Compare the case history and customer-visible result; confirm there is no automatic paid grant, credential change or unrelated-data access.

Backend work for this feature

Requirements only · Backend implementation on hold

What needs to be supported

  • Store private case/account references, assignment, verification outcome, requested action, decision and customer-visible status; separate internal evidence from public replies.
  • Enforce case assignment, minimum account-field visibility and an explicit action capability. Recovery/credential operations and entitlement exceptions need their own authorization.
  • Use D058 identity recovery and D069 trusted entitlement contracts; bind any approved exception to the verified target account and retain actor/time/reason.
  • Reject forged identity evidence, cross-account targets, duplicate grants and requests without a valid assignment; keep sensitive evidence out of logs/ordinary public fields.
  • Prepare retention, escalation and communication status without creating credentials, linking a real subscription, sending a message or changing a hosted account.

How to verify when implementation is approved

  1. Use a case reviewer, unrelated operator and two synthetic customers to verify least-privilege reads and target-account binding.
  2. Attempt an unverified subscription claim or unsupported exception, then an authorized test case; confirm only the correct trusted action changes access.
  3. Repeat the request and inspect audit/customer outcomes after reload; no duplicate grant, exposed private evidence or real credential operation.

Before this can work

  • Choose the Robin Park dummy account and open its assigned Platform administrator Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.
  • Confirm support owner, ownership-verification standard, recovery/escalation route and exception-grant authority. No blanket administrator access or real credential operation is approved.
  • Use fictional role-preview records. Frontend prototypes may simulate the workflow; no backend implementation or real service operation is authorized.

Connected stories