Story: Complete the ores.inbox approvals and notifications
Table of Contents
This page documents a story in Sprint 27. It captures the goal, current status, acceptance criteria, and the tasks that compose it.
1. Goal
A member asks for a role, an administrator answers from the queue, and both are told through in-application notifications: the role request is the first approval kind, and the request and notification screens render it. The component, its two models and the service that answers the operations shipped with the source story and with PR #2652; this story is the surface over them.
This story was split from Build approval requests and notifications when that story was reworded to what it delivered and closed DONE at the sprint 26 close on 2026-10-05; its two remaining tasks moved here.
2. Status
| Field | Value |
|---|---|
| State | DONE |
| Parent sprint | Sprint 27 |
| Now | Nothing. |
| Waiting on | Nothing. |
| Next | Nothing. |
| Last touched | 2026-10-05 |
3. Acceptance
- The request and notification screens render the approvals and the notifications the service already serves.
- A member asks for a role, an administrator answers from the queue, and both are told through in-application notifications.
4. Tasks
| Task | State | Start | End | Description |
|---|---|---|---|---|
| Build the request and notification screens | DONE | 2026-10-05 | 2026-10-06 | Ask for a role and Your requests on My access, the Requests queue, and the notification bell with its list, as the accepted prototype draws them. |
| Land the role request kind | DONE | 2026-10-05 | 2026-10-05 | The IAM role grant request and its roles as the first approval kind, applying an approval through the ordinary grant and raising the waiting and decided notifications. |
5. Decisions
- A role request is one call. IAM raises the inbox request as the person, passing on their token, then records the roles; it withdraws the request if the record fails.
- Approvals are applied by reconciliation. IAM grants every approved role not yet held, at start and on every request change, in every tenant not terminated, as the approver. The change event is only a nudge.
- IAM reads the inbox through two functions it owns, so its role holds no grant on the inbox's tables; the cross-tenant one runs for the IAM service only.
6. Out of scope
7. Result
Both tasks shipped. Serving the approvals and the notifications landed with PR #2652, the role request kind with PR #2673, and the request and notification screens with PR #2707. Live on a fresh database provisioned with ACME: a member asked for a role, the tenant administrator answered from the queue, the role was granted, and the member read the decision in the bell. The task page carries the evidence.