Plan: Multi-Jurisdictional Authorization

Name: craig.cache_invalidations

Type: topic

Durable: yes

Missed event (RabbitMQ blip) → TTL fallback (1h default) catches within window.

Bulk-fetch fails at boot → service bails fail-closed (analogous to encryption-mode-required boot guard).

RabbitMQ partition → existing cached rulesets continue serving; new policy changes don’t propagate until partition heals.

craig-rules outage during normal operation → cached rulesets continue serving.

cases service publishes case.assignment_changed { case_id, old_sub, new_sub, changed_at } event when cases.assigned_worker mutates (covers create + update).

Each consuming service has inbox handler bound to case.# topic with routing key case.assignment_changed. Handler executes UPDATE across its local tables that reference the case_id.

Failure semantics inherit from inbox three-state retry (platform-stab-2 §D3).

GET /v1/cases/cases/{id}/household → List on HouseholdMember (filtered by case_id)

POST /v1/cases/contacts/{id}/attachments → Create on ContactAttachment

L1 (engine unit tests, ~50-100 tests): full coverage of craig-authz crate. JDM expression shapes, scope outcomes, fail-closed branches, cache-miss behavior, RMQ invalidation handler. Self-contained; cargo nextest run -p craig-authz.

L2 (handler smoke tests, ~140 tests): one per handler verifying engine wiring. Generated via #[authz_smoke_test(handler = "get_case", resource = "Case", action = "Read")] macro. Asserts that an unauthorized JWT gets 403 and an authorized JWT gets 200, using a minimal hand-crafted policy.

L3 (fixture-driven regression tests, ~200 tests): per (resource_type, jurisdiction), representative scenarios from default fixtures. Generated via proc macro reading rulesets/{jurisdiction}/*.json. Catches "CRAIG change broke a fixture’s behavior" regressions.

Service-account JWTs carry a service-account claim (a custom claim, not a CRAIG role) AND the operational role(s) needed (e.g., caseworker).

Default policies include explicit entries for the service-account role:

# Default service-account policy in georgia-authz-{resource}.json
{ "in1": "contains 'service-account'", "in2": "*", "in3": "*", "out1": "true", "out2": "\"all\"" }

Documentation in crates/craig-authz/README.md and ADR-023 explicitly notes: "service-account claims are deployer-issued and must be deliberately granted; the default Georgia policy is permissive for internal-service flows but jurisdictions can scope tighter."

services/craig-intake/src/api/service_token.rs (intake → cases for report conversion)

services/craig-security/src/api/partners.rs:352 (admin endpoint accepting service-account hits)

Any future service-to-service call patterns

service: the service emitting (e.g., craig-cases)

user_id: claims.sub for user-driven events; service-account sub for service-driven events

user_role: comma-joined claims.roles

action: per the table above

resource_type: matches ResourceType::to_string() (snake_case)

resource_id: the affected row’s UUID, or NULL for cache events

details: JSONB per shape above

success: false for access_denied, true for cache events (informational)

Keycloak: realm role attributes + custom mapper that emits attrs.assigned_units from the user’s group memberships

Auth0: app metadata mapped to a custom claim

Okta: profile attributes mapped via OAuth claim mapper

Walks services//src/api/*/*.rs files

Parses each via syn (workspace dep already used by macros)

For every function annotated with #[utoipa::path(…​)], checks the function body for at least one of:

Reports any handler that bypasses + reports any allowlist entry without a reason

/livez, /readyz, /healthz — k8s probes; pre-auth

/openapi.json — public schema doc

Any future public-by-design endpoint

docs/modules/ROOT/pages/plans/multi-jurisdictional-authz.adoc — new (this content)

docs/modules/ROOT/pages/adrs/adr-024-multi-jurisdictional-authz.adoc — new (Proposed)

docs/modules/ROOT/pages/adrs/adr-025-policy-engine-design.adoc — new (Proposed)

docs/modules/ROOT/pages/adrs/adr-026-identity-normalization.adoc — new (Proposed)

docs/modules/ROOT/pages/adrs/adr-027-idp-neutral-identity.adoc — new (Proposed)

docs/modules/ROOT/pages/adrs/adr-028-architectural-principles.adoc — new (Proposed)

docs/modules/ROOT/nav.adoc — under * Plans / ** Active, add this plan; under ADRs, add 5 entries

CHANGELOG.adoc — entry under == Unreleased

1 epic at group level: epic: multi-jurisdictional authorization (BOLA + jurisdiction-readiness)

14 step-tracking issues, linked to the epic, labeled per character (chore for 1/14; feat for 2-13), milestone TBD

docs/modules/ROOT/pages/adrs/adr-026-identity-normalization.adoc — flip Proposed → Accepted

services/craig-cases/migrations/<TS>_assigned_worker_uuid.sql — new (destructive ALTER per §D1)

services/craig-cases/src/store/models.rs — change assigned_worker: String → assigned_worker: Uuid; same for supervisor, investigations.assigned_worker

services/craig-cases/src/store/cases.rs — update INSERT/UPDATE bindings to UUID

services/craig-cases/src/store/investigations.rs — same

services/craig-cases/src/api/cases.rs — handler writes claims.sub_uuid() into assigned_worker; request body’s assigned_worker_sub field if present

services/craig-cases/src/api/investigations.rs — same pattern

crates/craig-cases-contracts/src/cases.rs — DTOs changed: CreateCaseRequest.assigned_worker: Uuid, supervisor: Option<Uuid> (was String)

crates/craig-cases-contracts/src/investigations.rs — CreateInvestigationRequest.assigned_worker: Uuid

All cases-service integration tests in services/craig-cases/tests/api/ referencing "bob.smith" etc. as assigned_worker strings — updated to use the seeded UUID 00000000-0000-0000-0000-000000000002. Use the existing craig_test_lib::SeedSubs constants if available; otherwise add them.

tools/craig-seed/src/datagen.rs — assigned_worker values become UUIDs from a seeded user pool

services/craig-cli/tests/cli/referral.rs:22 and other assigned_worker: "bob.smith".into() test sites — convert to UUID

services/craig-security/migrations/<TS>_worker_identities.sql — new table per §D2 (includes attrs JSONB NOT NULL DEFAULT '{}' column per §D16) + pg_trgm extension enable

services/craig-security/src/store/worker_identities.rs — new module (upsert + search fns; upsert merges attrs from JWT custom claims)

services/craig-security/src/store/models.rs — add WorkerIdentity struct (with attrs: Value field)

crates/craig-auth/src/middleware.rs::JwtMiddleware::on_request — call upsert_worker_identity after Claims validation; pass non-standard JWT claims into the attrs JSONB

crates/craig-auth/src/middleware.rs — add db: Arc<PgPool> field on JwtMiddleware (security-service connection only; other services use a scoped helper that no-ops if db absent)

crates/craig-auth/src/claims.rs — extend Claims deserializer to capture extra: HashMap<String, Value> for non-standard claims via #[serde(flatten)]

services/craig-security/src/api/workers.rs — new module with GET /v1/security/workers?search=&limit=; rate-limited to 60 req/min/sub via existing rate-limit middleware; minimum 2-character search query

services/craig-security/src/api/mod.rs — register route

crates/craig-cases-contracts/src/workers.rs — new (DTOs: WorkerIdentitySummary, ListWorkersQuery)

services/craig-security/tests/api/workers.rs — new (8 tests: lazy upsert via JWT, search by username, search by display name, search with diacritics, search below minimum length returns 400, prefix collision returns multiple, rate-limit triggers 429, custom claim populates attrs column)

.claude/docs/services.md — document new endpoint + table + attrs column

docs/modules/ROOT/pages/adrs/adr-{023,024,026,027}.adoc — flip Proposed → Accepted (ADR-025 was already Accepted in Step 2)

crates/craig-authz/Cargo.toml — new (deps: zen-engine workspace, craig-auth, craig-common, craig-rules-client, async-trait, anyhow, serde, serde_json, tokio, tracing, strum, uuid, syn for the coverage-gate impl)

crates/craig-authz/src/lib.rs — public surface per §D3 (trait, types, re-exports)

crates/craig-authz/src/engine.rs — ZenAuthzEngine impl + validate_default_policy_coverage per §D18

crates/craig-authz/src/cache.rs — RulesetCache per §D3

crates/craig-authz/src/types.rs — ResourceRef, Action, ResourceType, ListScope, CoverageWarning

crates/craig-authz/src/error.rs — Authz-specific error mapping to ApiError

crates/craig-authz/src/audit.rs — emit_audit_event helper publishing authz.access_denied / authz.cache_miss / authz.cache_refreshed envelopes per §D14 schema

crates/craig-authz/tests/engine_unit.rs — L1 unit tests (~50-100 tests covering grammar shapes, scopes, fail-closed, cache miss, audit emission, missing-policy detection)

crates/craig-authz/tests/fixtures/ — minimal hand-crafted JDM ruleset fixtures for unit tests

xtask/src/cmd/validate_authz_coverage.rs — new xtask per §D17 (AST walker via syn; allowlist comments; markdown report)

xtask/src/cmd/mod.rs — add pub mod validate_authz_coverage;

xtask/src/cmd/validate.rs — call into validate_authz_coverage::run from existing validate command

xtask/tests/authz_coverage_test.rs — fixture cases (with-engine, with-allowlist, bypassed)

crates/craig-common/src/settings.rs — add authz_require_full_coverage: bool (default false) per §D18

Cargo.toml (workspace) — add craig-authz to members

.claude/docs/shared-crates.md — document craig-authz public API

crates/craig-mq/src/lib.rs — define CACHE_INVALIDATIONS_EXCHANGE: &str = "craig.cache_invalidations"; declare in bootstrap

crates/craig-mq/src/subscriber.rs — subscribe_exclusive already exists; verify or extend for cache-invalidation routing

services/craig-rules/src/api/sets.rs — admin endpoints (POST/PUT/DELETE) publish ruleset.changed { name, version } via publish_in_tx; ALSO publish authz.policy.changed per §D14 schema (when the changed ruleset name matches -authz-)

services/craig-rules/src/api/sets.rs — new GET /v1/rules/sets?prefix=&limit= endpoint (bulk-fetch)

crates/craig-cases-contracts/src/rules_sets.rs (or matching DTO crate) — ListRuleSetsQuery { prefix: Option<String>, limit: Option<u32> }

crates/craig-authz/src/cache.rs — wire RMQ inbox handler that invalidates entries on ruleset.changed.<name>; emits authz.cache_refreshed event per §D14; TTL refresh task with jitter

crates/craig-rules-client/src/lib.rs (new or extended) — list_by_prefix + get_by_name HTTP clients used by ZenAuthzEngine boot-load

crates/craig-authz/tests/cache_invalidation.rs — integration test: spawn in-memory mock craig-rules, push a ruleset.changed event, verify cache entry invalidated and authz.cache_refreshed event emitted

crates/craig-authz/tests/audit_emission.rs — integration test: trigger access_denied + cache_miss paths; verify audit_log row appears in craig-security’s table with correct envelope shape per §D14

crates/craig-common/src/settings.rs — add authz_policy_ttl_seconds: u64 field with default 3600

All 6 consuming services' src/main.rs — register cache-invalidation subscriber via subscribe_exclusive

rulesets/georgia/georgia-authz-case.json — new (per §D5 example)

rulesets/georgia/georgia-authz-{investigation,referral,report,placement,foster_home,payment,…​}.json — ~30 files for the resource-type set

rulesets/texas/texas-authz-*.json — same set, deliberately divergent per §D5

rulesets/georgia/georgia-icpc-policy.json — new (carries icpc_deadline_days: 84)

rulesets/texas/texas-icpc-policy.json — placeholder (Texas ICPC config TBD by Texas team; carry Georgia’s 84 as starter)

tools/craig-seed/src/cmd/seed_rulesets.rs (or equivalent existing path) — extend to seed the new authz rulesets if not already covered by the wildcard pattern

rulesets/README.md — document naming convention {jurisdiction}-authz-{resource} + the "curated example, replace before production" caveat

services/craig-rules/tests/api/authz_rulesets.rs — verify the seeded rulesets exist after cargo xtask dev reseed

services/craig-placement/migrations/<TS>_assigned_worker_sub.sql — ADD column on placements/education_records/health_records/kinship_options/home_documents

services/craig-financial/migrations/<TS>_assigned_worker_sub.sql — ADD column on payments/payment_adjustments/claims

services/craig-exchange/migrations/<TS>_assigned_worker_sub.sql — ADD column on icpc_requests/icpc_home_studies/icpc_attachments

services/craig-{placement,financial,exchange}/src/store/models.rs — add assigned_worker_sub: Option<Uuid> field

xtask/src/cmd/backfill_cross_service_assignment.rs — new xtask following xtask/src/cmd/reconcile.rs precedent

services/craig-cases/src/events.rs — add publish_assignment_changed fn, called from create_case/update_case + create_investigation/update_investigation handlers (inside the transaction via publish_in_tx)

services/craig-{placement,financial,exchange}/src/main.rs — register inbox handler bound to case.assignment_changed (subscribe, not subscribe_exclusive — competing-consumer for at-least-once update semantics)

services/craig-{placement,financial,exchange}/src/inbox/case_assignment.rs — handler that UPDATEs all referencing rows

Per-service integration tests in services/craig-{placement,financial,exchange}/tests/api/cross_service_assignment.rs — verify denormalized column updates on event

services/craig-cases/src/api/{cases,investigations,referrals,reports,contacts,court_orders,case_plans,case_plan_tasks,persons,report_persons,report_attachments,contact_attachments,screening_decisions,disposition_follow_ups}.rs — replace role checks with authz.check(…​) (single-row) or authz.auto_scope_list(…​) (LIST). ~57 sites.

services/craig-cases/src/api/cases.rs::batch_lookup — adopt bulk-operation pattern per §D15: per-row engine.check() with drop-on-deny; BatchLookupResponse gains unauthorized_count + partial_auth fields

crates/craig-cases-contracts/src/cases.rs::BatchLookupResponse — DTO change per §D15

services/craig-cases/src/main.rs — register craig_authz::ZenAuthzEngine in axum extensions

services/craig-cases/src/store/cases.rs — new list_with_scope fn per §D7

Same pattern for investigations.rs, referrals.rs, etc. — ~14 store fns gain _with_scope variants

services/craig-cases/tests/api/authz_smoke.rs — generated tests via #[authz_smoke_test] macro (L2)

services/craig-cases/tests/api/authz_fixture_regression.rs — generated tests via macro reading rulesets/{georgia,texas}/georgia-authz-*.json (L3)

services/craig-cases/tests/api/batch_lookup_authz.rs — new integration test: POST batch with mixed authorized/unauthorized IDs; assert partial_auth: true + unauthorized_count > 0 + filtered cases dict

crates/craig-authz/src/test_macros.rs — proc macros for L2/L3 generation

.claude/docs/services.md — document new authz integration on cases (incl. bulk-lookup behavior)

services/craig-placement/src/api/*.rs — ~20 handler sites

services/craig-exchange/src/api/*.rs — ~22 handler sites (incl. ICPC)

services/craig-{placement,exchange}/src/main.rs — register engine

services/craig-{placement,exchange}/src/store/*.rs — _with_scope store fns

services/craig-{placement,exchange}/tests/api/authz_{smoke,fixture}.rs — generated tests

services/craig-financial/src/api/*.rs — ~13 handler sites

services/craig-reporting/src/api/*.rs — ~15 handler sites

services/craig-{financial,reporting}/src/main.rs — register engine

services/craig-{financial,reporting}/src/store/*.rs — _with_scope store fns

services/craig-{financial,reporting}/tests/api/authz_{smoke,fixture}.rs — generated tests

services/craig-security/src/api/*.rs — ~10 handler sites (most admin-only)

services/craig-rules/src/api/*.rs — ~2 handler sites

services/craig-{security,rules}/src/main.rs — register engine

services/craig-{security,rules}/tests/api/authz_{smoke,fixture}.rs — generated tests

xtask/src/cmd/validate_authz_coverage.rs — flip from soft-warn to hard-fail mode (handlers that lack engine wiring outside the allowlist now fail the gate)

xtask/src/cmd/validate.rs — make validate-authz-coverage a required step (no longer skippable)

crates/craig-common/src/settings.rs:124 — delete default_jurisdiction(); field becomes required

services/craig-intake/src/config.rs:270 — same

services/craig-web/src/config.rs:61, 65, 67 — delete default_theme(), default_branding_agency(), default_admin_unit_label()

services/craig-{cases,placement,exchange,financial,reporting,security,rules}/src/main.rs — boot-guard messages clearer if env vars missing

docker-compose.yml — set all required env vars explicitly

.env.example — same

docs/modules/ROOT/pages/deployment-guide.adoc — document required env vars per service

.gitlab-ci.yml — CI overrides updated

crates/craig-reference/src/fips.rs — deprecate admin_units_for_state; replace with admin_units_for_jurisdiction(pool, jurisdiction) reading from DB

default_admin_units/georgia.csv — new (159 rows extracted from GEORGIA_COUNTIES)

default_admin_units/texas.csv — new (Texas counties; closes #225)

xtask/src/cmd/seed_admin_units.rs — new

services/craig-security/migrations/<TS>_seed_default_admin_units.sql — auto-seed for known jurisdictions on first install

services/craig-intake/static/report.html:82 — i18n key="report-form-admin-unit-label"

services/craig-intake/static/report.html:211 — i18n key="report-error-admin-unit-required"

services/craig-intake/locales/en/public.ftl — add new keys

services/craig-web/templates/intake/report_detail.html:253 — replace static dropdown with template loop fetching from screening-policy ruleset metadata

services/craig-web/locales/en/web.ftl:82, 207, 471 — "Fulton" placeholders → generic

services/craig-web/locales/en/public.ftl:63, 111 — generic

services/craig-exchange/src/api/icpc.rs:264 — read icpc_deadline_days from {jurisdiction}-icpc-policy ruleset metadata

rulesets/{georgia,texas}/{j}-icpc-policy.json — already shipped in Step 6; verify metadata field present

services/craig-financial/src/main.rs:148, 173 — replace calendar-month logic with PaymentPeriodConfig from settings

crates/craig-common/src/settings.rs — add payment_period: PaymentPeriodConfig struct

services/craig-web/src/routes/cases/list.rs and similar — stop sending ?worker= query param to backend (engine determines scope)

docs/modules/ROOT/pages/plans/multi-jurisdictional-authz.adoc — Status table → all Complete

docs/modules/ROOT/nav.adoc — Active → next plan or "(none)"

docs/modules/ROOT/pages/plans/archive.adoc — new row under Security & Compliance with all step MR numbers

.claude/CLAUDE.md — Phase Status final stats; new row "Multi-Jurisdictional Authorization"

CHANGELOG.adoc — wrap-up entry

icpc_deadline_days via settings, not ruleset metadata: the plan body called for reading the 84-day deadline from {jurisdiction}-icpc-policy ruleset metadata, but no such ruleset exists (Step 6 only shipped authz rulesets). Added icpc_deadline_days: i64 to ServiceSettings instead — same env-var driven posture as admin_unit_label, single boot-time read, no per-request ruleset evaluation overhead. A future MR can move it to ruleset metadata if jurisdiction-specific authz rules need to read it; right now it’s a single boot constant.

PaymentPeriod enum: 3 variants — CalendarMonth (default), FiscalMonth (currently identical to CalendarMonth since federal fiscal-month boundaries align with calendar boundaries), IsoWeek (Monday-anchored 7-day windows). New compute_period(today, payment_period) helper in services/craig-financial/src/main.rs replaces the inline with_day(1) + end_of_month shape.

AuthzContext bundle for too-many-args at icpc::update_icpc_request: adding the IcpcDeadlineDays extension pushed the handler past clippy’s 7-arg threshold. Replaced the separate authz + jurisdiction extensions with the existing AuthzContext bundle (same Step 9 pattern). The handler reads authz_ctx.engine + authz_ctx.jurisdiction thereafter.

BFF ?worker= cleanup — UI state preserved: dropped the redundant caseworker-default-self path that round-tripped claims.sub to the backend (engine handles it post Step 8). Kept the supervisor-explicit-filter path (?worker=<sub>) since that’s a genuine "view as worker X" feature not covered by engine scope. UI toggle state computed separately so templates render the correct selection.

Intake i18n: HTML genericization, not Fluent integration: craig-intake doesn’t host an i18n stack (no FTL files, no fluent-rs dep). Step 13b genericizes the inline strings ("County" → "Administrative Unit", "e.g. fulton" → "e.g. your county or region") rather than retrofitting a full Fluent i18n stack. Full intake-side i18n is a separate plan-level concern; Step 13b removes the Georgia-specific copy.

Fluent placeholder strings in craig-web: the 5 P0 i18n items the 2026-05-07 audit flagged were Fulton-specific example placeholders. Step 13b replaces them with jurisdiction-neutral examples in the existing FTL keys; no new keys required.

CSV-as-single-source-of-truth: rather than the plan body’s admin_units_for_jurisdiction(pool, jurisdiction) async function in crates/craig-reference/src/fips.rs, Step 13a keeps the existing static GEORGIA_COUNTIES const for sync callers (validation.rs::validate_admin_unit, translate.rs::admin_unit_to_fips) and adds CSV files (default_admin_units/{georgia,texas}.csv) as the canonical source for both the production xtask seed path AND the devstack seeder. craig-reference stays sqlx-free; the DB-driven path lives in craig-security where it already does (store::admin_units::list_units since Step 6).

Texas counties: 254 entries seeded via default_admin_units/texas.csv (closes #225). Not embedded as a static const in fips.rs — keeps the file from ballooning to ~3000 lines and avoids duplicating the CSV.

xtask seed-admin-units: idempotent UPSERT keyed on the existing (name, jurisdiction) WHERE active = true partial unique index. RETURNING (xmax = 0) reports per-row inserted/updated/skipped so operators can dry-run-equivalent re-runs.

craig-seed via include_str!: instead of leaving the seeder’s existing admin_units_for_state(State::Georgia) path untouched and adding Texas separately, Step 13a replaces it with a CSV-driven loop reading both jurisdictions via include_str!. Single source of truth between devstack reseed and the xtask path. Required Dockerfile change: COPY default_admin_units/ default_admin_units/ so the macro resolves at container-build time.

No new craig-security migration: the plan body called for <TS>_seed_default_admin_units.sql to auto-seed at install. Step 13a keeps the seeder + xtask paths instead — both are repeatable and idempotent, and a SQL migration that bakes 413 INSERT statements (159 + 254) is harder to evolve than the CSVs. Production deployments run cargo xtask seed-admin-units once at install.

Step 13b deferred scope (split for review tractability): BFF/intake i18n FTL extraction (5 P0 items from 2026-05-07 audit), ICPC 84-day deadline → ruleset metadata, payment-period config struct in crates/craig-common/src/settings.rs + craig-financial wiring, BFF ?worker= query param removal post Step 8 engine-driven scope.

Per-service bootstrap: services/craig-security/src/authz_bootstrap.rs mirrors Step 9/10 (transitional ROPC; Plan E retires).

DB-source for craig-rules: instead of HTTP self-loopback (http://craig-rules:8001), craig-rules' authz engine reads rule_sets directly from its own Postgres pool via a new services/craig-rules/src/authz_db_source.rs::DbRulesetSource. HTTP self-loopback raced the still-starting axum listener at boot AND recursed every authz check through the same handler chain (each engine.check for RuleSet triggered an HTTP call to the same service which itself called engine.check). The DB source is bootstrap-correct, latency-free, and architecturally honest about craig-rules being the source of truth for its own data. Removed the now-redundant services/craig-rules/src/authz_bootstrap.rs module.

Cold-start hardening in craig-authz: three layers of self-healing close the bootstrap window where rulesets exist in DB but the engine cache hasn’t yet seen them. (1) ZenAuthzEngine::boot retries the bulk-fetch up to 5× with exponential backoff (250ms → 4s, ~7.75s budget). (2) New lazy_load helper in check + auto_scope_list: on cache miss, attempts a single refresh_entry round-trip before failing closed. (3) New spawn_post_boot_warmup task: after axum binds, retries bulk_refresh 20× × 1s waiting for the seeder to populate rulesets. Wired into all 7 authz-using services.

depends_on: craig-rules added in compose: craig-cases, craig-placement, craig-exchange, craig-financial, craig-reporting, craig-security all gain depends_on: { craig-rules: { condition: service_healthy } } so their ROPC bootstrap doesn’t connection-refuse out the gate. craig-rules itself can’t depend on itself; the DB-source above sidesteps the question.

26 admin-only rulesets created: Step 6 deliberately excluded the admin-internal ResourceTypes (admin_unit, major_change, audit_event, security_archive, security_alert, detection_rule, nist_control, partner, partner_api_key, partner_signer_key, security_review, rule_set, rule_evaluation) — 13 per jurisdiction × 2. Step 11 ships them, sourced from the Step-10-refined claim template. rule_set allows caseworker read+list (rule sets are referenced in case workflows); rule_evaluation allows caseworker create+read (case workflows trigger person-match etc. evaluations). 1 additional ruleset (worker_identity) sourced from the foster_home template (caseworker list scope=all, supporting the autocomplete-style UI on case assignment).

Shared admin-fallback helpers in craig-security: services/craig-security/src/api/mod.rs::authz_check_or_admin_fallback + authz_list_or_admin_fallback collapse the engine.check + admin-role-fallback pattern at every site. Wired across all 9 security modules. craig-rules has the equivalent rules_authz_or_admin_fallback plus the same per-handler admin-role bypass on ListScope::Denied.

AuthzContext bundle for too-many-args: update_rule_set + import_rule_set in craig-rules use Extension<AuthzContext> to keep the per-handler arg count under clippy’s 7-arg threshold without #[allow]. Established Step 9 pattern.

list_rule_sets / get_rule_set / get_rule_set_by_name now require authz: pre-Step-11 these were authenticated-only (any role). The engine path now requires admin/supervisor (default ruleset) — but rule_set policy explicitly allows caseworker read+list since rule sets are referenced in case workflows.

Existing role-gates removed: handlers no longer call require_admin() / require_supervisor_or_above() / require_caseworker_or_above() / require_role(). 60 handlers across 10 modules.

Per-service bootstrap: services/craig-{financial,reporting}/src/authz_bootstrap.rs mirrors Step 9 (transitional ROPC; Plan E retires).

Payment scope filter: Payment carries assigned_worker_sub (Step 7 denorm). ListPaymentsParams + CountPaymentsParams gain assigned_worker_sub: Option<Uuid>; SQL filters on the denorm column. PaymentAdjustment also has the denorm but its list endpoint is small-N so Step 10 maps AssignedWorker scope to "empty page" rather than threading the column through the query (consistent with Step 9 KinshipOption deferral).

Ruleset refinements (12 files: 6 admin-only resources × 2 jurisdictions): dropped caseworker rules entirely from Claim, RateTable, AfcarsSubmission, NcandsSubmission, QualityReview, DataQualityIssue. These are admin/supervisor-managed reference data + reporting submissions; caseworker → default deny → 403.

Action::Approve mapping: approve_payment, approve_adjustment, approve_afcars, approve_ncands, submit_claim, transmit_afcars, transmit_ncands use Action::Approve. Submit and transmit are state-promoting operations on already-reviewed submissions; semantically Approve.

Early authz on resolve_issue: DataQualityIssue policy gates on role + jurisdiction (no per-row attrs); the resolve_issue handler does the engine check with a skeleton ResourceRef before the row read so the existing 404-on-missing semantic is preserved for authorized callers (mirrors Step 9 retry_transaction).

Existing role-gates removed: handlers no longer call require_eligibility_worker_or_above() / require_supervisor_or_above() / require_admin() / require_caseworker_or_above() — engine.check() / auto_scope_list() are the entire access decision. 34 handlers across 7 modules.

Per-service bootstrap: services/craig-{placement,exchange}/src/authz_bootstrap.rs ships the same transitional ROPC pattern Step 8 introduced for craig-cases. docker-compose.yml adds CRAIG_PLACEMENTAUTHZ_BOOTSTRAP_* + CRAIG_EXCHANGEAUTHZ_BOOTSTRAP_*. Plan E retires all three modules together.

ResourceType vocabulary: 7 placement types (Placement, KinshipOption, FosterHome, HomeDocument, EducationRecord, HealthRecord — and matching uses FosterHome::Read) + 4 exchange types (ExchangeTransaction, ExchangePartner, ExchangeAgreement, IcpcRequest — IcpcHomeStudy + IcpcAttachment are children of IcpcRequest). All already covered by the 70-file ruleset corpus from Step 6.

Scope filter — Placement only: the Placement row carries assigned_worker_sub (Step 7 denorm), so list_placements translates ListScope::AssignedWorker(sub) into a SQL filter via a new assigned_worker_sub: Option<Uuid> column on ListPlacementsParams + count_placements. Other resource types (FosterHome, HomeDocument, EducationRecord, HealthRecord, ExchangeTransaction, ExchangePartner, ExchangeAgreement, IcpcRequest) lack the denorm column; non-admin scopes map to "empty page" rather than a SQL filter.

KinshipOption post-filter: KinshipOption has assigned_worker_sub (Step 7 denorm) but its existing list_kinship_options SQL takes only case_id — Step 9 post-filters in the handler rather than threading another optional param through, since kinship lists are bounded by case (small N).

Action::Update for child-resource deletes: delete_kinship_option, delete_home_document use Action::Update on the parent (case for kinship; foster home for home_document) rather than Action::Delete — same pattern as Step 8b’s case-scoped child deletes (deleting a kinship option is a case mutation, not a case deletion).

FosterHome / HomeDocument caseworker access: Georgia’s default rulesets allow caseworker read/update on assigned foster homes via claims.sub == resource.assigned_worker_sub. FosterHome has no assigned_worker denorm (Step 7 deviation: foster homes are licensable provider entities, not case-assigned), so the predicate evaluates false and caseworkers fall through to default deny. Practical effect: caseworkers currently cannot view foster homes via the engine path. Documented as a Step 12 (Phase A defaults removal) follow-up — the right fix is to either add a foster-home→assigned-worker linkage table or refine the ruleset so caseworker FosterHome::Read is admin-unit-scoped rather than worker-scoped.

EducationRecord / HealthRecord child→case lookup deferred: same root cause as foster_home but with a Step 7-deferred remedy. child_id-keyed records can be in multiple cases simultaneously; the right fix is a child→primary-case lookup at authz-eval time. Step 9 leaves assigned_worker_sub: None so caseworker access goes to default-deny; admin/supervisor/readonly remain functional. Lookup work deferred to a follow-up.

ICPC child resources: home_study + attachment authz checks operate on the parent IcpcRequest (their id parameter is the IcpcRequest id). submit_home_study uses Action::Update; get_home_study / list_attachments / download_attachment use Action::Read; upload_attachment uses Action::Update.

No new test crate: Step 8 / 8b ship hand-written L2 smoke tests. Step 9 follows the same pattern; Step 11+ revisits proc-macro test generation.

Existing role-gates removed: handlers no longer call require_caseworker_or_above() / require_supervisor_or_above() / require_admin() / require_icpc_coordinator_or_above() — engine.check() / auto_scope_list() are the entire access decision. 59 handlers across 11 modules.

investigations.rs (5 handlers — create, list, get, update, submit_safety_assessment) — parent resource with its own assigned_worker. Uses ResourceType::Investigation. List path uses auto_scope_list (returns empty page for AssignedSupervisor — Investigation has no supervisor field; documented in handler).

contacts.rs (5 handlers — create, list, get, update, delete) — case-scoped child. All authz routes through parent case_resource_ref.

court_orders.rs (7 handlers — create, list, upload_document, download_document, get, update, delete) — case-scoped child. upload_document + download_document authz on parent case.

case_plans.rs (9 handlers — create_case_plan, list_case_plans, update_case_plan, approve_case_plan, create_task, update_task, list_tasks, get_task, delete_task) — case-scoped child + tasks scoped via plan→case chain. approve_case_plan uses Action::Approve.

services/craig-cases/src/api/referrals.rs — intake-side (entry point from craig-intake forwarding). Authz semantics differ from case-assigned model: pre-screening posture; no assigned_worker until referral-to-investigation conversion. Needs separate ResourceType::Referral policy design.

services/craig-cases/src/api/reports.rs — partner-submitted reports with PII encryption. Authz interacts with intake-source authentication (anonymous public form vs. authenticated partner) + the existing report→person link audit trail (ADR-019).

services/craig-cases/src/api/persons.rs — PII-encrypted records (ssn_last_four, etc. — platform-stab-2 §D9). Authz query interacts with the blind-index search path; needs careful design to avoid plaintext cache leaks.

services/craig-cases/src/api/report_persons.rs — ADR-019 report-person linking (suggestions / link / unlink). Authz on parent report (when wired in 8c) + secondary check on the linked person (when 8c does persons).

services/craig-cases/src/api/report_attachments.rs — report-scoped child. Trivial wiring once reports.rs is wired (mirrors contacts.rs → contact_attachments.rs shape).

services/craig-cases/src/api/contact_attachments.rs — contact-scoped child. Trivial; deferred only because contacts.rs was wired in 8b but attachments weren’t yet — keeping module-pair churn together.

Module scope: plan body listed 14 modules with ~57 handlers. Step 8 wires only services/craig-cases/src/api/cases.rs (8 handlers: create_case, list_cases, get_case, update_case, list_household, add_household_member, list_milestones, batch_lookup). The remaining 13 modules (investigations, referrals, reports, contacts, court_orders, case_plans, case_plan_tasks, persons, report_persons, report_attachments, contact_attachments, screening_decisions, disposition_follow_ups) defer to a continuation MR (Step 8b). Reasoning: Step 8 establishes the integration pattern (bootstrap + Jurisdiction extension + ResourceRef helper + ListScope→SQL mapping + invalidation subscriber + TTL refresh + ROPC bootstrap) — Step 8b template-applies the pattern across the remaining modules. Splitting reduces per-MR review surface + lets Step 8’s foundation land before the bigger templating sweep.

L2 macro generators + L3 fixture-driven regression tests: plan body called for crates/craig-authz/src/test_macros.rs proc-macros generating #[authz_smoke_test] + L3 fixture tests. Step 8 ships hand-written tests in services/craig-cases/tests/api/authz_smoke.rs instead (3 tests covering admin / supervisor / caseworker scope outcomes against the live engine). Macro-generation is deferred to Step 8b along with the remaining handlers — at that point the macro produces ~80 tests automatically. Hand-written 3 in this MR demonstrates the integration works end-to-end without taking on the macro-generation complexity in the same MR.

Pre-Plan-E ROPC bootstrap: craig-cases needs a service-account bearer to fetch authz rulesets from craig-rules at boot. Plan E (service-identity, filed at !235) ships OidcServiceToken + client_credentials to handle this, but Plan E hasn’t started yet. Step 8 ships a transitional services/craig-cases/src/authz_bootstrap.rs that does ROPC against Keycloak using devstack admin credentials to obtain a bearer for the boot bulk-fetch. Same anti-pattern as services/craig-intake/src/api/service_token.rs::KeycloakServiceToken; explicitly marked "REMOVE WHEN PLAN E LANDS" in the file header. Devstack docker-compose.yml sets the four env vars (CRAIG_CASES__KEYCLOAK_TOKEN_URL, …​_USER, …​_PASSWORD, …​_CLIENT_ID); production deployments unset → engine boots with empty cache and fail-closes every request until Plan E lands. Documented as Plan E Step 3’s first concrete consumer.

Cache-invalidation subscriber + TTL refresh registration: Step 5 plan errata documented that registering subscribers in service main.rs files was deferred to Steps 8-11. Step 8 wires both for craig-cases here. Routing-key bug fixed in crates/craig-authz/src/invalidation.rs: bind on ruleset.changed. (one full word per RabbitMQ topic semantics) rather than ruleset.changed.<prefix> (which would require dashes-as-separator); jurisdiction-prefix filtering moved into the handler.

Ruleset emit shape: scope outputs added: Step 6’s rulesets emitted {allow, reason} for every rule. Step 8 surfaced that auto_scope_list needs {scope: …​} shape. Regenerated all 70 ruleset files to emit {allow, scope, reason} from every rule. Read/Update/Create rules emit o_scope: "assigned_worker" as a placeholder; List rules emit the actual policy scope ("all" / "assigned_worker" / "assigned_supervisor" / "denied"). Engine reads the right field based on action.

BatchLookupResponse contract change: per Plan A § D15, added unauthorized_count: usize + partial_auth: bool fields. Pre-1.0 + serde defaults guarantee the addition is a non-breaking wire change for existing clients (older clients ignore the new fields).

Existing role-gate removal: handlers no longer call claims.require_caseworker_or_above() — engine.check() / auto_scope_list() are the entire access decision, with role logic now living inside the JDM rulesets via 'admin' in claims.roles etc.

Table count: plan body called for "11 tables across placement/financial/exchange". Step 7 shipped 7 (placements, kinship_options, payments, payment_adjustments, icpc_requests, icpc_home_studies, icpc_attachments). The 4 deferrals are architecturally justified, not scope-shedding:

Inbox handler subscriber semantics: plan body called for "competing-consumer for at-least-once update semantics" using subscribe. Implemented exactly as spec’d. UPDATE WHERE clauses include assigned_worker_sub IS DISTINCT FROM $1 so duplicate deliveries from competing consumers are no-ops. craig_mq::handle_idempotently wraps the handler for full at-least-once correctness per platform-stab-2 §D3.

Backfill xtask shape: ships at xtask/src/cmd/backfill_cross_service_assignment.rs matching plan §D6. Direct DB connection (4 pools: cases + placement + financial + exchange) — no service API churn. cargo xtask backfill-cross-service-assignment [--limit N]. Idempotent re-runs cheap.

Placement subscriber added; financial + exchange extended: plan body had placement listed in the per-service main.rs registration. craig-placement had no inbound subscribers prior; this MR adds the first. craig-financial + craig-exchange had subscribers for other events; we extend their routing-key list + dispatch.

Manual-verification of backfill: backfill against current devstack populated 17 placements + 7 kinship_options + 45 payments + 1 icpc_request + 1 icpc_home_study from 7 seeded cases. payment_adjustments + icpc_attachments updated 0 rows because the seeder doesn’t currently produce any.

Resource type count: plan body’s CHANGELOG draft estimated "~30 per jurisdiction"; Step 6 shipped 35 per jurisdiction (70 total). The extra 5 per jurisdiction are the icpc/exchange/rate_table types that fall under caseworker-visible scope. 12 admin-internal types (audit_event, security_alert, security_archive, security_review, detection_rule, nist_control, major_change, admin_unit, worker_identity, partner, partner_api_key, partner_signer_key, rule_set, rule_evaluation) intentionally excluded — they fail-closed via cache miss, which is the right default for admin-only types. Documented in rulesets/README.adoc. Step 11 (security + rules engine adoption) will revisit if explicit policies are needed there.

JDM expression syntax: plan §D5 example used "contains 'admin'" for input rule expressions; Step 6 verified that zen-engine 0.54 actually accepts the cleaner 'admin' in claims.roles form as the input field expression (returns bool), with "== true" as the rule value. The §D5 example wire-shape was approximately right but not literal; the shipped rulesets carry the verified syntax.

Generator script not committed: a one-shot Bash generator at /tmp/gen-authz-ruleset.sh stamped out the 70 JSON files. Discarded after use — rulesets are version-controlled artifacts, not generated code. Re-running the generator would produce the same output (template is deterministic) but ops should treat the JSON files as the source of truth.

README format: rulesets/README.adoc (asciidoc per project convention). Initial draft was markdown; corrected mid-MR after user feedback.

Cache-invalidation exchange: plan’s Files-list called for crates/craig-mq/src/lib.rs to define CACHE_INVALIDATIONS_EXCHANGE: &str = "craig.cache_invalidations" as a separate topic exchange. Step 5 reuses the existing craig.events topic exchange instead — same fan-out semantics via subscribe_exclusive (auto-delete queues bound on ruleset.changed.<name> routing key) without an extra exchange to declare in bootstrap. The existing Publisher::publish_in_tx path stages the events through the outbox unchanged; consumers bind narrowly via topic-pattern. Documented in crates/craig-authz/src/invalidation.rs module doc.

6-services-main.rs subscriber wiring: plan’s Files-list called for "All 6 consuming services' src/main.rs — register cache-invalidation subscriber via subscribe_exclusive`". Step 5 ships the subscriber primitive (`craig_authz::spawn_invalidation_subscriber) but does NOT register it in the 6 services because no service consumes craig-authz yet — Steps 8-11 wire the engine into individual services. Subscriber registration becomes part of each service-adoption step (Step 8 wires craig-cases + registers; Step 9 wires craig-placement + craig-exchange + registers; etc.) so the subscriber ships alongside its first consumer in each service.

authz.policy.changed event: plan’s § D14 schema includes a separate authz.policy.changed event for -authz- ruleset mutations. Step 5 ships the more general ruleset.changed.<name> event (which covers all rule-set CRUD); the authz.policy.changed distinction is a routing-key namespace concern that becomes meaningful only when a separate audit subscriber wants to filter authz-only changes. Deferred to Step 8 (cases adoption) when audit-event subscribers actually exist.

TTL task cadence: plan called for "TTL refresh task with jitter". Step 5 ships TTL/10 sweep cadence (floor 30s) with ±25% jitter. Defaults: 1h TTL → 6m sweeps. Override via CRAIG_<SVC>__AUTHZ_POLICY_TTL_SECONDS=<n>.

Test count: plan called for "~10 new tests"; Step 5 shipped 10 new (6 invalidation + 4 rules-client). Math reconciles.