Permissions and Consent
Status: Planned
Permissions and Consent
Section titled “Permissions and Consent”Application access and business authority are separate questions.
A developer may have a valid application integration, while the software’s customer has only granted permission to read public company facts. That integration must not silently gain the power to place orders on behalf of the customer.
The three questions
Section titled “The three questions”- Who is connecting? Identify the application or service that makes a request.
- Which company is represented? Identify the relevant registered business and account or person.
- What is permitted? Check the granted role, action scope, period and any required approval.
Examples of different scopes
Section titled “Examples of different scopes”| Action | Expected authorization |
|---|---|
| Read publicly available company information | Appropriate public-data access |
| Retrieve a private business document | An authorized recipient or company permission |
| Draft a supplier inquiry | Delegated drafting scope |
| Send a quotation under a company’s name | Authorized representative or approved service scope |
| Accept an order | Relevant company commitment authority |
| Revoke an agent permission | Valid company-managed authorization to revoke |
Time and revocation
Section titled “Time and revocation”Permissions can expire or be withdrawn. Historical proof must distinguish authorization at the time of the signed action from present-day permission to perform further work.
An agent’s successful research or ability to retrieve company information is not a substitute for human or company authorization when an action creates a business commitment.