Your account
HOL-D100Story implementation: Planned

Review Commercial Partner applications

commercial · Proposed launch phase 4

Start from Home

Review as Commercial manager · Full workflow planned

User story

As a HOL commercial manager, I want to review organization applications so approved commercial relationships have a clear recorded decision.

Draft requirements for review · Updated 2026-10-19

What the app should do

  • FOLLOW-UP ONLY: assigned HOL Commercial manager reviews applications, requests information and approves or declines with a reason.
  • Check current owner submission and accepted terms/version; managers cannot submit or accept for the organization. Keep application data and contacts private.
  • Record reviewer, organization, exact application revision, evidence references, time and reason; expose the appropriate result to the owner and permitted managers.
  • Organization partner status is separate from person membership, ownership claims, organization manager rights and internal HOL staff roles.
  • Individual sponsorships, placements and content retain their separate approval processes. Vetting criteria, commercials and activation/expiry rules must be defined before implementation.

What to check in the demo

Follow these steps from the role’s landing page through navigation and feature checks.

Review as

Commercial manager

Start here: Home

Choose the Avery Chen dummy account and open its assigned Commercial manager Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.

Navigation from sign-in

  1. 01Open the fictional Commercial manager account through the connected sign-in service. Seeded Home review opens directly. Real HOL staff access and protected actions require an authenticator check.
  2. 02Follow-up review begins from HOL Commercial Home, then Partner applications. The application queue is not part of the first build.

Feature checks start here

Review Commercial Partner applications · Full workflow planned

Follow-up Planned; implementation is on hold. No application, live payment or partner activation is built.

  1. 03Current UI review: follow the navigation as far as the explicitly available screen; the complete feature below is not built. Stop when the named control is absent.
  2. 04Planned acceptance — When authorized later, request more information and approve/decline a fictional application with an exact revision and visible owner outcome.
  3. 05Planned acceptance — Attempt self-review, unassigned review, stale/repeated decisions and unauthorized status grants; confirm no automatic content publication.

Backend work for this feature

Requirements only · Backend implementation on hold

What needs to be supported

  • When later authorized, bind assigned Commercial review/request-information/approve/decline to an exact submitted organization application and terms version, retaining decision actor/reason/history without publishing a sponsorship.
  • Use one trusted account ID; keep email verification, professional labels, reader entitlement, organization-scoped access and internal HOL staff assignments independent.
  • Validate actor, organization/person IDs, current access and expected revision at the trusted boundary. Remembered workspace, URL, fixture choice and client flags never grant permissions.
  • Persist only the records needed for this outcome, including owner-scoped drafts and decision/assignment/consent audit where applicable. Keep private evidence and contacts out of public projections.
  • Enforce the selected requirements above in database/API policies, with idempotent transitions, concurrent-update handling and denied cross-account writes.
  • Keep this workflow unimplemented until the follow-up receives authorization and its vetting/activation rules are defined.

How to verify when implementation is approved

  1. Follow-up checks must deny unassigned/stale/self-issued partner grants and verify distinct organization-application approval versus content/placement decisions.
  2. Test owner, manager, unrelated account, unverified account and permitted HOL staff where relevant; deny self-grants and cross-organization access.
  3. Exercise success, interrupted/repeated requests, expiry/revocation and stale/concurrent updates; verify stable identity, correct public visibility and preserved unrelated account data.

Before this can work

  • Choose the Avery Chen dummy account and open its assigned Commercial manager Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.
  • Use a fictional HOL commercial manager account and begin at its Home with its actual permitted context.
  • Keep simulated outcomes separate from real account/backend evidence.

Connected stories