Your account
HOL-D098Story implementation: In progress

Confirm or remove a professional affiliation

people · Proposed launch phase 2

Start from Home

Review as Guide

User story

As a guide, I want to agree an organization affiliation with both sides so our public profiles accurately reflect the relationship.

Draft requirements for review · Updated 2026-10-19

What the app should do

  • A person with a professional profile or an organization owner/manager may propose a labeled person–organization affiliation using stable IDs.
  • Require agreement from both the person and the organization before public display; an authorized owner or manager may confirm for the organization.
  • Keep proposed/pending/declined affiliations private to the parties; publish one confirmed relationship reciprocally on the same person and organization pages.
  • Either side may remove the affiliation; remove both public links and cached discovery references together. Reinstatement needs renewed mutual agreement.
  • An affiliation is independent of verified qualifications, endorsements, sponsorship, paid membership, staff authority and organization ownership. Deny confirmations by unrelated people or former managers.

What to check in the demo

Follow these steps from the role’s landing page through navigation and feature checks.

Review asStart here: Home

Begin on Professional Home using Maya Hart (Guide) or your own verified account with that professional label. Use the account/workspace menu → Professional. Professional labels do not include paid reader access.

Navigation from sign-in

  1. 01Open the fictional Guide account through the connected sign-in service. Seeded Home review opens directly. Real HOL staff access and protected actions require an authenticator check.
  2. 02From Professional Home select Affiliations. The feature starts at Propose or renew a relationship, where Person, Organization and both relationship wordings are shown.

Feature checks start here

Confirm or remove a professional affiliation

Connected in dev; full acceptance remains In progress. Affiliations stay private until both agree. Removal cleared both public pages; renewal waits for the other side and cannot self-confirm it. Further stale/concurrent browser cases remain open.

  1. 03At Affiliations select the organization and enter both Relationship on the person’s page and Relationship on the organization’s page, then Propose relationship.
  2. 04In the authorized organization session select Affiliations and review the exact request. Confirm using the opposite side, then open View public profile / View public page to compare the reciprocal relationship.
  3. 05Use dedicated examples for decline/removal/renewal. If the same account represents both sides the form explicitly confirms both capacities; do not use that example as proof of a separate second-person consent.
  4. 06Do not expect affiliations to verify professional credentials, activate membership or approve sponsorship.

Backend work for this feature

Backend development authorized · Dev only

What needs to be supported

  • Persist one typed person/org relation with proposer, person consent, authorized org consent, expected relation revision, public activation and either-party withdrawal. Require fresh bilateral consent after withdrawal.
  • Use one trusted account ID; keep email verification, professional labels, reader entitlement, organization-scoped access and internal HOL staff assignments independent.
  • Validate actor, organization/person IDs, current access and expected revision at the trusted boundary. Remembered workspace, URL, fixture choice and client flags never grant permissions.
  • Persist only the records needed for this outcome, including owner-scoped drafts and decision/assignment/consent audit where applicable. Keep private evidence and contacts out of public projections.
  • Enforce the selected requirements above in database/API policies, with idempotent transitions, concurrent-update handling and denied cross-account writes.
  • Use isolated local synthetic data only; no hosted migration, public service connection, real credentials/recipients, live payment or deployment.
  • Represent both party consents and revocation on one relation/version; publish only when both are current, and remove reciprocal projections atomically on either-side withdrawal.

How to verify in dev

  1. Exercise person-initiated and org-initiated cases, manager removal before confirmation, unilateral pending state and either-side withdrawal; verify both public endpoints/search results agree with the same relation state.
  2. Test owner, manager, unrelated account, unverified account and permitted HOL staff where relevant; deny self-grants and cross-organization access.
  3. Exercise success, interrupted/repeated requests, expiry/revocation and stale/concurrent updates; verify stable identity, correct public visibility and preserved unrelated account data.

Before this can work

  • Begin on Professional Home using Maya Hart (Guide) or your own verified account with that professional label. Use the account/workspace menu → Professional. Professional labels do not include paid reader access.
  • Use a fictional guide account and begin at its Home with its actual permitted context.
  • Use actual local provider sessions and persisted state; record connected UI and direct permission checks separately.

Connected stories