Your account
HOL-D103Story implementation: In progress

Set up and manage HOL staff access

account · Proposed launch phase 1

Start from Home

Review as Platform administrator

User story

As a platform administrator, I want to provision and revoke scoped HOL staff access so only the assigned people can use internal tools.

Draft requirements for review · Updated 2026-10-19

What the app should do

  • Provide a separate internal staff-access workflow for an already authorized Platform administrator with required MFA. Public registration and organization ownership never grant internal HOL responsibilities.
  • Invite a fictional staff recipient or assign an approved internal responsibility to an existing verified account, with explicit role/resource scope. Use local captured invitation messages and the recipient’s own account; no shared password or public staff-grant endpoint.
  • Track invitation pending, accepted, expired/revoked and current assignment state. Bind acceptance to the intended verified account, require current issuer authority, and preserve one account with existing personal/professional/org data.
  • Accepted staff must enroll/complete actual provider MFA before privileged operations. Invitation acceptance, email verification and workspace choice do not satisfy MFA or create unrelated role scope.
  • Allow the authorized administrator to change/revoke the specific assignment; deny protected requests after removal and record actor, target, scope, state, reason and time without secrets. Preserve unrelated assignments, reader membership and org ownership.
  • Reuse the existing trusted scoped assignment/MFA foundation. Bootstrap only isolated synthetic administrative fixtures through controlled local setup; selecting a fixture cannot grant or self-escalate staff authority.
  • Keep optional professional evidence/badges in D029/D071, external organization invitations in D094 and real-tester lost-email/factor recovery policy in deferred D080. Do not define those recovery decisions here.

What to check in the demo

Follow these steps from the role’s landing page through navigation and feature checks.

Review asStart here: Home

Choose the Robin Park dummy account and open its assigned Platform administrator Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.

Navigation from sign-in

  1. 01Open the fictional Platform administrator account through the connected sign-in service. Seeded Home review opens directly. Real HOL staff access and protected actions require an authenticator check.
  2. 02From Platform administrator Home after the required authenticator check select HOL staff access. The feature starts at the recipient and staff-responsibility form.

Feature checks start here

Set up and manage HOL staff access

Connected in dev; full acceptance remains In progress. Real local staff invite, scope, recipient acceptance, revoke, invitation history and audit forms are wired to tested services. Staff enters at ordinary assurance and must complete real MFA; qualified browser lifecycle review remains open.

  1. 03After required MFA, use HOL staff access to inspect existing scoped assignments and prepare a dedicated invitation with recipient, responsibility and scope.
  2. 04The intended recipient opens Invitations & requests, confirms their authenticator before acceptance, then uses Accept scoped invitation. Verify the assigned workspace separately.
  3. 05Do not change existing staff grants as routine walkthrough setup. Wrong-recipient, expiry, revoke/replay and scope-change cases need dedicated fixtures and remain lifecycle acceptance.

Backend work for this feature

Backend development authorized · Dev only

What needs to be supported

  • Reuse trusted scoped staff assignments and required-MFA checks; expose no public client/service-key staff-grant path. Separate org owner/manager records from HOL internal assignments.
  • Require a currently authorized Platform administrator and sufficient MFA for local invitation/grant/change/revoke commands, with exact responsibility/resource scope. Bootstrap the isolated synthetic first administrator through controlled setup only.
  • Persist intended recipient, invitation status/expiry/single-use proof, inviter authority, accepted assignment and versioned scope/audit. Recheck current inviter authority and recipient verification at acceptance.
  • Use genuine local provider accounts and local captured invitation messages. Pending invite, accepted assignment and verified MFA assurance are separate states; enforce current assignment plus sufficient assurance on every privileged operation.
  • Audit actor/subject/scope/decision/reason/time and test revocation directly while keeping membership, professional labels, org ownership and unrelated assignments unchanged. No real-tester recovery or hosted operational grant issuer is defined here.

How to verify in dev

  1. Test administrator with/without required MFA, unrelated member, org owner/manager, each invited recipient and wrong recipient; deny forged role/scope and self-grants.
  2. Accept, expire, revoke and replay invitations; remove/change the inviter’s authority before acceptance and verify current-authority enforcement and no duplicated grants.
  3. Use direct local API/database requests for exact-scope internal work before/after MFA and assignment revocation; preserve unrelated personal, professional and organization access.

Before this can work

  • Choose the Robin Park dummy account and open its assigned Platform administrator Home without a password or authenticator prompt. This dev-only Home review does not verify MFA or unlock protected staff actions. Use your own provisioned staff account and authenticator when reviewing those actions.
  • Use my own verified local synthetic account and its currently assigned scope; satisfy required MFA without a preview bypass.

Connected stories