Your account
HOL-D097Story implementation: In progress

Review and resolve organization ownership claims

organizations · Proposed launch phase 2

Start from Home

Review as Commercial manager

User story

As a HOL commercial manager, I want to resolve organization ownership claims so the appropriate representative can manage the page.

Draft requirements for review · Updated 2026-10-19

What the app should do

  • HOL Commercial manager handles normal ownership claims for both unpaid organizations and Commercial Partners. Request evidence, approve or decline with reason within assigned scope.
  • Platform administrator handles disputed/exceptional cases. Escalation must preserve the same claim, evidence, decision history and organization identity.
  • Treat reviewed staff recovery as the explicit exception to owner-only self-service transfers. An unopposed evidence-backed claim may recover an unclaimed/former-owner-unavailable page; contested overrides require administrator escalation.
  • Bind each decision to the exact claim/version and current authority. Apply approved assignment changes atomically; record actor, subject, evidence reference, reason, time and old/new access.
  • Revoke only the affected organization access selected in the recovery decision. Do not change personal passwords, reader membership, other org access, professional labels or unrelated staff assignments.
  • Use synthetic evidence and outcomes for the initial dev review; the evidence standard and operational service expectations need HOL confirmation before real-world use.

What to check in the demo

Follow these steps from the role’s landing page through navigation and feature checks.

Review asStart here: Home

Choose the Avery Chen dummy account and open its assigned Commercial manager Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.

Navigation from sign-in

  1. 01Open the fictional Commercial manager account through the connected sign-in service. Seeded Home review opens directly. Real HOL staff access and protected actions require an authenticator check.
  2. 02From authorized HOL Commercial or Platform administrator Home, after the required authenticator check, select Ownership claims. The feature starts at the queue; the administrator handles assigned escalations within it.

Feature checks start here

Review and resolve organization ownership claims

Connected in dev; full acceptance remains In progress. Actual scope/MFA-protected review forms use the tested local decision service. Qualified-reviewer browser completion requires tester MFA handoff; backend decision checks are separate evidence.

  1. 03Request information and approve/decline a fictional ordinary claim; confirm evidence/history and exact org assignment changes.
  2. 04Escalate a disputed case, review it as Platform administrator, then attempt unauthorized manager/unrelated-user/self-approval and stale/replayed decisions.

Backend work for this feature

Backend development authorized · Dev only

What needs to be supported

  • Persist assigned claim reviewer/scope, exact evidence/application revision, normal versus escalated case, decision reason and resulting org assignment changes. Staff recovery must be a separately audited command from self-service owner transfer.
  • Use one trusted account ID; keep email verification, professional labels, reader entitlement, organization-scoped access and internal HOL staff assignments independent.
  • Validate actor, organization/person IDs, current access and expected revision at the trusted boundary. Remembered workspace, URL, fixture choice and client flags never grant permissions.
  • Persist only the records needed for this outcome, including owner-scoped drafts and decision/assignment/consent audit where applicable. Keep private evidence and contacts out of public projections.
  • Enforce the selected requirements above in database/API policies, with idempotent transitions, concurrent-update handling and denied cross-account writes.
  • Use isolated local synthetic data only; no hosted migration, public service connection, real credentials/recipients, live payment or deployment.
  • Use organization-scoped owner/manager records rather than the internal staff-assignment table. Require verified email for organization creation, claims, management and invite acceptance.
  • Ordinary owner transfer and reviewed staff recovery are distinct audited commands; Commercial handles normal unopposed recovery while contested/exceptional override requires Platform administrator scope.

How to verify in dev

  1. Have Commercial resolve an ordinary unopposed fictional claim and escalate contradictory ownership; deny Commercial contested override, nonassigned staff action and replayed/stale decisions. Verify an administrator resolves only the escalated org scope.
  2. Test owner, manager, unrelated account, unverified account and permitted HOL staff where relevant; deny self-grants and cross-organization access.
  3. Exercise success, interrupted/repeated requests, expiry/revocation and stale/concurrent updates; verify stable identity, correct public visibility and preserved unrelated account data.

Before this can work

  • Choose the Avery Chen dummy account and open its assigned Commercial manager Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.
  • Use a fictional HOL commercial manager account and begin at its Home with its actual permitted context.
  • Use actual local provider sessions and persisted state; record connected UI and direct permission checks separately.

Connected stories