Autonomy for the Owner and for a customer

Same feature, two paths to it#

A customer session is not a restricted copy of the operator's. It is the same code, reached through a facade: tenantAdapt rewrites the path a screen asks for into the customer form of it, and customer_safe in the middleware is an allowlist deciding which requests a customer session may make at all. Anything the facade does not recognise is turned into a blocked path and answered 403 rather than guessed at.

The practical consequence for autonomy is that a difference in behaviour between the two audiences is almost never a difference in the feature. If the modes screen works for the operator and 403s for a customer, the fault is in the facade or the allowlist — one rewrite that was never added — not in a deliberately narrower product.

What genuinely differs#

The last row is the only category of capability that is properly one audience's, and it is not a Connect feature being withheld. Verifying a customer's payment and publishing the operator's own price list are the work of running the business that sells Connect; a customer workspace has no more use for them than for the deployment scripts.

Parity is enumerated, not promised#

The claim that both audiences have the same capabilities is checked mechanically rather than asserted in a document. A parity test reads the route table out of the running application and compares every operator capability against every customer one. It carries two lists: the renamings, where the customer surface calls something by a different name, and the known gaps, each recorded with a reason.

Reading a report about one audience#

1. When something is reported missing on one side, check the other before changing anything.

   Result An asymmetry is evidence about the facade; a symmetry is evidence about the feature.

2. If it is asymmetric, look at the rewrite and the allowlist first.

   Result A path with no rewrite becomes a blocked path answered 403, which reads exactly like a missing feature and is not one.

3. If it is symmetric, look at the autonomy configuration itself.

   Result Both audiences behave identically here, so the cause is a mode, a scope or a gate — the same three places as for anybody else.

4. Say which audience you checked when you report back.

   Result "Works for me" is not an answer to "it does not work for my customer", and the two sessions can be held at once for exactly this reason.

Questions#

Related#

• What Connect may do
• Autonomy and spend
• Who may change what
• The operator's workspace and a customer's
• The customer facade
• One implementation, two audiences