Settings Guardrails
Source-static proofTenant And Membership Control
No live account writesMembershipPortfolio Manager AOwner approves real membership, invitations, and auth setup laterBoundarySynthetic POC operationsEvery record carries account/workspace/source contextFollow-onOpen permissionsContinue into denial coverage and access checks.
Tenant & data boundary
Workspace identity, tenant isolation, and membership readiness in one account panel.
Account Settings reviews the synthetic tenant envelope after Settings or Team triage. Real-data tenant setup, invitations, membership writes, permission grants, and provider activation remain blocked.
Synthetic POC operationsacct_synthetic_demo
Every record carries account/workspace/source context
Account profileacct_synthetic_demo
Matches the app shell context and every tenant-owned record
Active synthetic accountSynthetic POC Tenant
Tenant-owned fixture rows36
Denial tenants rendered0
Live invitationsDisabled
Real-data migrationBlocked
Portfolio Manager Amanager / All active synthetic POC properties
Configured in fixture onlyOwner Group 101owner / Owner-visible synthetic property group
Configured in fixture onlyCleaner Team Acleaner / Assigned synthetic work only
Configured in fixture onlyVendor HVAC-01vendor / Assigned synthetic work only
Configured in fixture onlyRead-only account review only; no tenant activation, invite, membership write, permission change, provider execution, or external account change.
Language And Translation Preferences
Profile language reviewApp languageSelectable in the global shell
Users can choose the browser-local app language from the top navigation. The current sprint translates the shell navigation and records the profile preference path for account-backed settings.
Message languageOriginal plus reviewed translation
Inbound messages preserve original wording and show reviewed English/profile-language text before any draft is staged.
Receiver preferenceEnglish or profile language
Recipients can be reviewed as English-first or profile-language-first. Delivery remains blocked until future provider and approval gates exist.
English / EnglishSpanish / EspañolPortuguese / PortuguêsFrench / Français
Original inbound wording is preserved for audit.Translated review text is synthetic and requires human approval.Receiver profile language controls draft review, not automatic delivery.No translation provider, external send, mailbox writeback, or channel writeback runs from this UI.Language preference is local browser state until account settings are connected.
Account Boundary
Synthetic onlyActive synthetic accountSynthetic POC Tenant
Tenant-owned fixture rows36
Denial tenants rendered0
Live invitationsDisabled
Real-data migrationBlocked
Account Profile Readiness
Section 1 account-profile carry-throughUse field, value, safety, and next action as the first arrival scan so account review stays tied to the tenant-boundary handoff.Profile review remains synthetic-only, read-only, and no-live.
| Field | Value | Safety | Next Action |
|---|---|---|---|
| Account id | acct_synthetic_demo | Matches the app shell context and every tenant-owned record | Keep as synthetic fixture until separate migration, security, and tenant-isolation approval |
| Account name | Synthetic POC Tenant | Planning-only workspace for STR, MTR, LTR, Work, Money, and Admin | Do not mix future real owner data into this synthetic POC tenant |
| Fixture purpose | poc_demo | Identifies this tenant as synthetic POC data only | Create a separate second tenant for future owner-approved real-data migration |
| Data policy | Redacted fixtures only | No real tenant, owner, guest, vendor, cleaner, property, payment, or source-system data | Keep seed execution, Supabase writes, and real imports blocked |
| Environment | Local/dev planning | No production deployment, no DNS, no secrets, no auth setup, no live integrations | Hold production setup, invitations, provisioning, and provider setup until explicit approval |
Workspace Boundaries
Section 2 workspace-boundary carry-throughRead account context, included scope, denied scope, and audit requirement first so tenant isolation stays explicit and reviewable.Boundary review remains fail-closed and no-live.
| Workspace | Account Context | Includes | Denied | Audit Requirement |
|---|---|---|---|---|
| Synthetic POC operations | acct_synthetic_demo | 20 properties, 2 work rows, 1 inspections, 2 documents, 6 messages | Denial tenants, production imports, private records, and future real owner data | Every record carries account/workspace/source context |
| Owner-safe summaries | acct_synthetic_demo | 1 report rows and 1 owner-visible Money summaries | Private resident ledgers, source rows, draft reconciliation notes, platform payout detail | Manager approval before owner-visible publication |
| Field execution | acct_synthetic_demo | 2 assigned work rows and checklist/evidence metadata | Financials, private contacts, access codes, owner statements, account writes | Property assignment and role filter before data renders |
| Future real-data tenant | Not created in Gate A | Nothing in the synthetic POC tenant | Owner real data import, Supabase writes, seed execution, auth provisioning, provider setup | Separate owner-approved migration, security, and tenant-isolation gate |
Membership Readiness
Section 3 membership carry-throughUse role, property access, allowed actions, blocked actions, and next action as the first scan so membership review stays internal and synthetic-safe.No invite, activation, or permission write is available here.
| Actor | Role | Status | Property Access | Can Do | Blocked Actions | Next Action |
|---|---|---|---|---|---|---|
| Portfolio Manager A | manager | Configured in fixture only | All active synthetic POC properties | Run operations, review work, approve owner-visible summaries, see operational Money | No cross-account access, no external send, no invitations, no auth provisioning | Owner approves real membership, invitations, and auth setup later |
| Owner Group 101 | owner | Configured in fixture only | Owner-visible synthetic property group | Read approved statements, approved reports, approved expenses, contributions, draws | No internal ledgers, private resident rows, draft reconciliation, or non-owner payables | Owner approves real membership, invitations, and auth setup later |
| Cleaner Team A | cleaner | Configured in fixture only | Assigned synthetic work only | Read assigned checklist, schedule window, and evidence prompts | No financials, no private contacts, no owner statements, no account writes | Owner approves real membership, invitations, and auth setup later |
| Vendor HVAC-01 | vendor | Configured in fixture only | Assigned synthetic work only | Read assigned work context, schedule window, and evidence prompts | No financials, no private contacts, no owner statements, no account writes | Owner approves real membership, invitations, and auth setup later |
Account Guardrails
Account/workspace tenant boundary is visible before data rendersNo live invitations or user provisioningNo auth setup or account provisioningNo real user email, phone, address, tax, bank, or payout dataNo production data importsNo Supabase writes, seed execution, or database migrationsFuture owner real data must use a separate second tenant after migration, security, and tenant-isolation approvalNo external account changesNo secrets or provider credentialsAll settings changes are placeholders until approval and audit rules exist
Route Closure
Source-static route closureAccount Settings now carries supervisory continuity, bounded table readability, and tenant-safe workspace review through this receiving surface.Profile, workspace-boundary, and membership review stay synthetic-only and no-live.
Boundary rules summaryRead-only account review only; no tenant activation, invite, membership write, permission change, or provider execution.The receiving surface stays source-static, review-only, and ready for later no-live validation routing only.