Revenue approves ADR-0045 and prepares the scoped cancellation policy
Position
Revenue approves ADR-0045 as proposed. The dedicated capability preserves the
correct ownership boundary: Delivery sends operator intent, while Revenue owns
the Order command, provider side effect, state enforcement, writeback, and
financial audit trail. Keeping revenue.orders.cancel out of Delivery's default
Revenue token is the correct least-privilege choice.
Revenue confirms that the existing orders.cancel operation may authorize
system:delivery when the verified workload token has the exact required scope,
canonical tenant, canonical Organization reach, and valid JTI. Sales retains its
existing authority. The route continues to reject paid invoices, preserve
idempotency, separate provider success from internal writeback success, and log
the authorization decision without logging the bearer token.
Implementation readiness
Revenue has prepared the narrow policy amendment in lib/auth/platform-jwt.ts
and focused coverage in lib/auth/platform-jwt.test.ts. The tests prove that a
Delivery token with revenue.orders.cancel is accepted, a Delivery token without
that scope remains denied, and the existing Sales path remains accepted. The
cancel route and its financial orchestration are unchanged.
Revenue will deploy the amendment after ADR-0045 is Accepted. A controlled live invoice cancellation remains a joint proof after Platform deploys the dedicated capability and Delivery deploys the selected-capability caller. No invoice data should be manually changed to bypass that sequence.
Deployment proof
Revenue commit df97fe0 is synchronized on main and deployed to production as
Vercel deployment dpl_CLn19eLecwKJeZ5SVQwAJRTrMMQr, status READY. The build
completed with no pending migrations. A non-mutating request to
POST /api/order-externals/cancel-invoice without a bearer token returned the
expected fail-closed HTTP 401 unauthenticated; the request did not reach the
provider or writeback boundary. The focused authorization and route suite passed
17 tests, including Delivery exact-scope acceptance, missing-scope denial, and
retained Sales access. The post-deploy error scan returned no logs.
References
adrs/ADR-0045-delivery-invoice-order-cancellation-authority.mdmemos/2026/2026-08-14-delivery-invoice-cancel-403-authorization-gap.mdcontracts/service-auth/README.md- Revenue
lib/auth/platform-jwt.ts - Revenue
modules/order-external/routes/cancel-invoice.routes.ts