Revenue approves the ADR-0039 Sales route-to-scope map
Revenue approves Platform's exact seven-scope map for the bounded Sales
production workload policy. This memo clears
event:revenue-sales-service-auth-scope-map-approved.
Approved route policy
Revenue approves these exact route-to-scope bindings for issued sub: sales,
aud: revenue tokens under policy sales-production-to-revenue-v1:
| Revenue operation | Revenue route | Required scope |
|---|---|---|
| Credit coverage read | GET /api/v1/credit-accounts/coverage |
revenue.credit-accounts.read |
| Invoice-link and credit-purchase reads | GET /api/v1/orders/invoice-link, GET /api/v1/orders/credit-purchases |
revenue.orders.read |
| Invoice-link creation | POST /api/v1/orders/invoice-link |
revenue.orders.create |
| Invoice cancellation | POST /api/order-externals/cancel-invoice |
revenue.orders.cancel |
| Reservation creation | POST /api/v1/reservations, POST /api/v1/reservations/atomic-multi-create |
revenue.reservations.create |
| Reservation release | POST /api/v1/reservations/{id}/release |
revenue.reservations.release |
| Sales ordering close | POST /api/v1/sales-ordering/close |
revenue.sales-ordering.close |
GET /api/v1/sales-ordering/orders/{id} remains outside this policy because
Sales found no active caller. Revenue does not approve broad, wildcard,
Delivery-only, settlement, refund, grant, payment-capture, correction, or
lesson-consumption authority for sub: sales.
Revenue enforcement ownership
Platform owns workload-proof verification and policy-bound token issuance.
Revenue remains the resource-authorization owner. Revenue will bind each
listed operation to the exact scope above and allow sub: sales only on this
approved route set. Revenue authorization will also enforce the service-auth
contract's issuer, audience, tenant, canonical Organization reach, iat,
nbf, expiration, and jti requirements and will record token-correlated
authorization decisions without secret material.
Missing or mismatched scope must fail closed with the contract's stable
403 INSUFFICIENT_SCOPE behavior. Invalid authentication must fail with
401 UNAUTHENTICATED; valid authentication with the wrong subject, tenant, or
Organization reach must fail with 403 FORBIDDEN. A valid Platform signature
alone is not authorization.
Sequencing
This decision approves Platform to implement and deploy the Sales workload policy. It does not declare Revenue enforcement ready or Sales migrated. The current Revenue deployment still needs complete subject, exact-scope, Organization-reach, required-claim, and authorization-audit enforcement across the approved routes. The legacy invoice-cancellation route in particular must gain the same fail-closed service authorization before migration proof can pass.
No root secret is rotated, no consumer secret copy is removed, and no legacy route is retired by this approval. Platform should publish the deployed policy handoff next. Sales then performs its shared-client migration and production proof, while Revenue separately completes and proves its resource-server enforcement readiness.
References
2026-08-02-platform-adr-0039-root-inventory-and-sales-policy-proposal2026-08-02-sales-adr-0039-caller-inventory-approved2026-08-02-revenue-adr-0039-root-rotation-gate-correctionadrs/ADR-0039-platform-issued-workload-identity.mdcontracts/service-auth/README.md