Skip to Content

← All archived intake epics

Intake: v1-user-hierarchy

breakdown.md

Breakdown: V1 User Hierarchy

What I understood

A Sustentus organisation has no reporting structure, so nobody has a manager and a leader cannot see their people's customers, service leads or delivery work. The scope's answer is deliberately small: one pointer on each user record — their manager — is the organisation, and everything else falls out of it. Visibility is inherited upward through that chain; ownership never is.

The second half of the scope is ownership of the customer's service lifecycle. Paul was explicit that at every stage there must be exactly one named owner, and that this is unclear today either side of BRD approval. Sales becomes a real user role owning the lead until the customer approves; a CSM must be assigned before that approval is even possible; and at the approval, ownership transfers by itself. Vendor is the organisation, not a person, and is not a user role.

The rest is consequence: location collapses to Region and Country only, those two plus My Team become the standard filters everywhere, and licence classes are counted and reported but never enforced. Paul's review trimmed rather than grew this — six business rules retired as restatements, the two-hat model struck, and the worked example cut to four people.

Where it sits

  • feature-role-matrix/leads — service-lead ownership, the Sales role, and the handoff.
  • feature-role-matrix/projects — the CSM's ownership of the customer after approval.
  • feature-role-matrix/experts — internal Experts in the hierarchy, external ones by assignment.
  • service-journey/lead-intake and .../requirements — where a lead is raised and where the BRD is completed and approved; the ownership transfer sits on that boundary.
  • service-journey/delivery — the SDM's reach and the Expert-vacancy case.
  • business/roles — all six personas gain an explicit Owns / Can see / Can change split.

Build order

  1. user-record-and-reporting-line — the seven-field user record and the single manager pointer that forms the hierarchy — depends-on: none
  2. regions-and-countries — Region and Country as the only two location levels, curated per organisation — depends-on: user-record-and-reporting-line
  3. inherited-visibility — every user sees their own work plus their whole team's, all levels down, view-only — depends-on: user-record-and-reporting-line
  4. service-lead-ownership-and-handoff — the Sales role, the CSM assignment gate, and the automatic transfer at BRD approval — depends-on: user-record-and-reporting-line
  5. team-region-country-filters — My Team, Region and Country filters across dashboards, tiles, lists and reports — depends-on: regions-and-countries, inherited-visibility
  6. licence-class-reporting — every user counted once in a licence class, reported and never enforced — depends-on: user-record-and-reporting-line

Parallelizable

Stub 1 is the only true foundation. Stubs 2, 3, 4 and 6 depend on it and on nothing else, so they can run in parallel once it lands. Stub 5 is the only join — it needs both the geography of stub 2 and the visibility model of stub 3. The linear order above tie-breaks foundation-first, then by what unblocks the most work (2 and 3 feed stub 5), then by impact, leaving the Should-priority licence report last.

Out of scope (whole scope)

  • No organisation chart builder or visual hierarchy editor — the manager pointer is the hierarchy.
  • No billing, seat purchasing, licence enforcement or usage metering.
  • No territory or state location levels anywhere — retired this round.
  • No matrix, dotted-line or multiple reporting hierarchies — exactly one manager per person.
  • No manager powers over team members' records — visibility is inherited, ownership never is.
  • No customer-side organisation structures.
  • No retroactive re-attribution when a person moves manager, region or country.
  • No changes to expert matching or bidding.
  • The demonstration dashboards keep their current behaviour this round.

Note on scope size. scope.md runs over the 2,000-word ceiling with §6 on its 20-rule cap and §14 at 13 decisions against a cap of 10 — the documented signal that this is more than one scope. The cut above is the honest decomposition of it as agreed; if the source is split later, stubs 1, 2, 3 and 6 form the organisation-model half and stub 4 the service-lifecycle-ownership half.

_done/inherited-visibility.md

Stub: Inherited visibility — see your team, act on nothing

  • feature-slug: inherited-visibility
  • scope: v1-user-hierarchy
  • personas: Admin, Sales, CSM, SDM, Expert
  • initiative: Refine the bridge / objective: Q2-2026 Objective 1 — Establish Product-Market Fit with Vendor Partners
  • depends-on: user-record-and-reporting-line
  • sequence: 3 of 6

Problem

Today a person sees either only their own work or, as an administrator, everything. A leader cannot see their people's customers, service leads or delivery work, so they chase by email. The reporting line from stub 1 exists to answer exactly this — but nothing reads it yet.

Proposed change

Visibility is inherited upward through the reporting hierarchy, and only visibility is.

  • Every user sees their own work, plus everything belonging to everyone below them in their reporting line — the whole team, all levels down, not just direct reports.
  • Managers inherit visibility only, never ownership: managing someone lets you view their work, not approve their invoices, edit their leads or reassign their customers.
  • Visibility fails safe. If a person's reporting line is incomplete or broken, they see only their own work — a fault in the hierarchy narrows what people see, never widens it.
  • Administrators see everything in their organisation, regardless of where they sit.
  • Internal Experts belong to the reporting hierarchy. External Experts are managed through assignments, not reporting, and are reached through the engagement rather than a manager.
  • Each of the six roles gets an explicit Owns / Can see / Can change split, kept separate from one another.

Acceptance criteria (rough)

  • A manager sees their own work plus everything belonging to their line, all levels down.
  • A manager sees nothing belonging to anyone outside their line.
  • A manager cannot act on a team member's records by virtue of the reporting line alone.
  • A broken or incomplete reporting line leaves the person seeing only their own work.
  • An internal Expert's work rolls up their reporting line.
  • An external Expert's work is reached through the engagement, not through a manager.

Out of scope (this feature)

  • The My Team / Region / Country filters — that is team-region-country-filters.
  • Any manager power to act on a team member's records — deferred to a future release.
  • Ownership transfer rules — that is service-lead-ownership-and-handoff.

Notes for Define

Covers FR-4, FR-11 and BR-11, BR-12; proves AC-2, AC-13. Paul's one-line ruling governs this whole feature: "Managers inherit visibility only. Never ownership." He also asked specifically that Visibility, Ownership and Permissions be kept separate rather than mixed — §7 of scope.md carries that split and Define should preserve it rather than collapsing the columns. The SDM's reach follows their reporting hierarchy and the Region/Country filters; there is deliberately no separate SDM regional assignment in V1 (D-7). BR-9, BR-10 and BR-13 from the Doc were retired at the fold as restatements — their content lives in §7's role table, which is the source to build from.

_done/licence-class-reporting.md

Stub: Licence classes — counted and reported, never enforced

  • feature-slug: licence-class-reporting
  • scope: v1-user-hierarchy
  • personas: Admin
  • initiative: Refine the bridge / objective: Q2-2026 Objective 1 — Establish Product-Market Fit with Vendor Partners
  • depends-on: user-record-and-reporting-line
  • sequence: 6 of 6

Problem

Once every user holds exactly one role, the business needs to know what its user base costs to licence — but it needs that as a number it can look at, not as a gate that starts locking people out of a platform they are mid-project on.

Proposed change

A licence report derived entirely from the role each user already holds.

  • Each user falls into exactly one licence class, determined by their role.
  • The classes are Platform (which cannot exist without Admin, nor Admin without it), Sales, and Delivery.
  • The report lists every user with their licence class, and the count per class.
  • Licence classification is a report, not a gate: it never blocks anyone from signing in or working.

Acceptance criteria (rough)

  • Every user appears in the licence report with exactly one licence class.
  • The report shows the count per class.
  • Changing a user's role changes their licence class in the report.
  • No licence class ever prevents a user from signing in or working.

Out of scope (this feature)

  • Billing, seat purchasing, licence enforcement and usage metering — explicitly out of the scope.
  • Any pricing attached to a class — that is a commercial decision, not a product one.

Notes for Define

Covers FR-12 and BR-27; proves AC-8. Priority is Should, and it is last in the batch for that reason. Paul cut the drafted four-class model down twice: "Licensing should be much simpler. Platform Licence & Admin can't have one without the other. Sales Licence. Delivery Licence" — and then, on the open decision about how the Platform licence composes, "This is a commercial decision, not a product one." BR-26, which spelled out the class composition, was retired at the fold for that reason. Build the report against the three classes above and leave the commercial structure where Paul put it: outside the product. The hard line that survives is BR-27 — this never gates anyone.

Answers from Jamie — interrogation 2026-08-17

Recorded by the intake-easy-features session; these rulings bind Define.

  • Role-to-class mapping: Admin → Platform, Sales → Sales, CSM → Sales, SDM → Delivery, Expert → Delivery, Customer → Delivery — every user appears in exactly one class.

_done/regions-and-countries.md

Stub: Regions and countries — two location levels, and only two

  • feature-slug: regions-and-countries
  • scope: v1-user-hierarchy
  • personas: Admin
  • initiative: Refine the bridge / objective: Q2-2026 Objective 1 — Establish Product-Market Fit with Vendor Partners
  • depends-on: user-record-and-reporting-line
  • sequence: 2 of 6

Problem

Location is recorded at a territory and state level of detail the business does not use, so a regional total has to be assembled by hand and cannot be trusted to add up. Paul's rule is blunt: two geographic levels only, used consistently for users, customers, service leads, dashboards and reporting.

Proposed change

Region and Country become the only two location levels anywhere in the platform.

  • A country is chosen from the standard worldwide country list, never typed free-hand.
  • A region is a named grouping of countries that each organisation defines for itself. An administrator curates them; everyone else picks from them.
  • Within an organisation a country belongs to at most one region, so regional reporting adds up without double counting.
  • Both people and service leads carry a region and a country; when both are set, the country must belong to the region.
  • Territory and state are retired everywhere they appear — on people, on service leads, in filters and in reporting.
  • A region can be renamed and the new name carries through immediately. A region still containing countries or people cannot be deleted — empty it first.
  • Geography filters data. Geography never grants access.

Acceptance criteria (rough)

  • Location everywhere is region and country only — no screen offers or displays territory or state.
  • Countries are chosen from the standard worldwide list, with no free typing.
  • An administrator can create a region and group countries into it.
  • A region still holding countries or people cannot be deleted.
  • A country's region cannot conflict with the region set on the same record.
  • A country not yet grouped into any region can still be recorded on a person or lead.
  • Renaming a region carries the new name through everywhere immediately.

Out of scope (this feature)

  • The Region and Country dashboard filters themselves — that is team-region-country-filters.
  • Any access decision based on geography — geography never grants access.
  • Retroactive re-attribution when a person changes region or country.

Notes for Define

Covers FR-2, FR-10 and BR-15, BR-16, BR-17; contributes to BR-19; proves AC-4, AC-9. Paul rewrote this section twice in review and the wording to honour is his: "Two levels only. Region contains Countries. One Country belongs to one Region. Geography filters data. Geography never grants access." Retiring territory and state is part of this feature, not a follow-up — the scope says retired everywhere, this round. A country with no region yet is a legitimate state, not an error: the Country filter must still find it.

Answers from Jamie — interrogation 2026-08-17

Recorded by the intake-easy-features session; these rulings bind Define.

  • Country list: ISO 3166-1, stored as a static list in packages/services — no external dependency.

_done/service-lead-ownership-and-handoff.md

Stub: Service-lifecycle ownership — Sales to CSM, with no gap

  • feature-slug: service-lead-ownership-and-handoff
  • scope: v1-user-hierarchy
  • personas: Sales, CSM, Customer
  • initiative: Refine the bridge / objective: Q2-2026 Objective 1 — Establish Product-Market Fit with Vendor Partners
  • depends-on: user-record-and-reporting-line
  • sequence: 4 of 6

Problem

At every stage of the customer's service lifecycle there should be exactly one named owner, and today that ownership is unclear either side of BRD approval. No one formally owns a service lead before the customer approves, and the handover to service delivery is a conversation that sometimes does not happen.

Proposed change

Sales becomes a real user role that owns the lead, and ownership transfers by itself at approval.

  • Every service lead has exactly one owner at every moment of its life.
  • The default owner is Sales. A lead raised by another workflow — customer success spotting expansion, support spotting a services opportunity, professional services follow-on work, an AI-created lead, product onboarding — is owned according to its configured service-lead source. No lead is ever left unowned.
  • The Sales owner remains accountable for discovery, qualification and completion of the BRD until the customer formally approves the solution.
  • The customer cannot approve the BRD until a CSM has been assigned to the lead, so ownership always has somewhere to land and no unowned customer is ever created.
  • At the moment the customer approves the BRD, ownership transfers automatically to the assigned CSM — no manual step, no gap, no shared custody — and both people are notified.
  • The CSM owns the customer from that moment through delivery, customer acceptance and the satisfaction survey.
  • If the assigned CSM is disabled, ownership transfers temporarily to their manager until another CSM is assigned. Customer visibility is unchanged throughout.
  • If the Expert leaves during delivery, ownership remains with the CSM; the Expert assignment becomes vacant and the SDM assigns a replacement.

Acceptance criteria (rough)

  • Every service lead shows exactly one named owner at every stage of its life.
  • A lead raised by a workflow rather than a Sales user is owned per its configured source.
  • The customer cannot approve the BRD with no CSM assigned, and the Sales owner is told what is missing.
  • At approval, ownership moves from Sales to the assigned CSM with no manual step.
  • Both the outgoing Sales owner and the incoming CSM are notified at the handoff.
  • The CSM named at approval stays the owner through delivery, acceptance and the satisfaction survey.
  • Disabling the assigned CSM moves ownership to their manager without changing what the customer sees.

Out of scope (this feature)

  • Changes to expert matching or bidding — the bid pool works as it does today.
  • Manager powers to act on an owned lead — visibility only.
  • Customer-side organisation structures.

Notes for Define

Covers FR-5, FR-6, FR-7, FR-8 and BR-20, BR-21, BR-22, BR-23, BR-24, BR-25; proves AC-5, AC-10, AC-11. Two of Paul's rulings drive this feature. First, on terminology: "Don't refer to pipeline ownership — wrong term. It's service lifecycle ownership. It's about the customer's complete service journey." Use that language throughout. Second, on the default owner, in his words: "Every Service Lead must have exactly one owner. Default owner = Sales. If raised by another workflow, ownership is assigned according to the configured Service Lead source." That is deliberately more general than "no lead without a Sales owner" — it future-proofs the model without changing V1 behaviour for inbound sales. One comment in the Doc read "The CSM remains accountable for discovery, qualification and completion of the BRD"; this was raised at the fold and ruled a slip for "Sales", consistent with D-1, D-9, D-10 and his own role list — build it as Sales.

_done/team-region-country-filters.md

Stub: My Team, Region and Country — the three standard filters

  • feature-slug: team-region-country-filters
  • scope: v1-user-hierarchy
  • personas: Admin, Sales, CSM, SDM
  • initiative: Refine the bridge / objective: Q2-2026 Objective 1 — Establish Product-Market Fit with Vendor Partners
  • depends-on: regions-and-countries, inherited-visibility
  • sequence: 5 of 6

Problem

Once a leader can see their whole team's work, the next question is immediately "just EMEA" or "just my direct line". Without a consistent way to narrow, every surface grows its own ad-hoc controls and two views of the same population disagree.

Proposed change

Three filters — My Team, Region and Country — appearing consistently on every surface that shows a population of work.

  • My Team shows the viewer and everyone below them in their reporting line. A person with no team simply sees their own work.
  • Region narrows what the viewer can already see to one region; Country narrows it to one country.
  • The three appear consistently across dashboards, tiles and lists, and reports and analytics.
  • Filters narrow, never widen. They respect the reporting hierarchy automatically and can never surface a record the viewer's visibility would hide.
  • Filter choices are remembered per person between visits.
  • In V1 the filters ship on the live platform dashboards. The demonstration app (apps/demo) is not a delivery target for this feature — Design prototyped the filters there, and that prototype is not what Build ships.

Acceptance criteria (rough)

  • My Team, Region and Country appear on every dashboard, tile, list and report in scope.
  • No filter combination ever shows a record the viewer could not already see.
  • A person with no team sees exactly their own work under My Team.
  • A regional total adds up without double counting.
  • Each person's filter choices are still applied on their next visit.
  • No demonstration-app code is touched by this feature's implementation.

Out of scope (this feature)

  • Region curation and the country list — that is regions-and-countries.
  • The visibility model itself — that is inherited-visibility.
  • The demonstration app — Design already prototyped the filters there; Build does not touch it.
  • Any redesign of the dashboards these filters sit on.

Notes for Define

Covers FR-9 and BR-19; proves AC-3. Paul made the surface list explicit — "These filters appear consistently across: Dashboards, Tiles & Lists, Reports & Analytics" — and separately, "Region and Country become standard filters across all dashboards." Consistency is the requirement: the same three controls, behaving identically, not three variations. The join in the batch: this stub needs both the geography of stub 2 and the visibility model of stub 3, so it must not start before both have landed. Geography filters data; it never grants access — a filter is not a permission.

_done/user-record-and-reporting-line.md

Stub: The user record and the reporting line

  • feature-slug: user-record-and-reporting-line
  • scope: v1-user-hierarchy
  • personas: Admin
  • initiative: Refine the bridge / objective: Q2-2026 Objective 1 — Establish Product-Market Fit with Vendor Partners
  • depends-on: none
  • sequence: 1 of 6

Problem

A Sustentus organisation has no reporting structure. Nobody has a manager, there is no notion of a team, and there is nowhere to record who a person reports to. Every other part of this scope — inherited visibility, ownership handoff, regional roll-up — needs that single fact to exist first.

Proposed change

Every user record carries exactly seven facts — name, email, role, manager, region, country and status — and the manager pointer is the organisation structure. There is no separate chart to build.

  • An administrator manages users end to end and sees all seven fields at a glance, including who is still unplaced.
  • Every user holds exactly one role and reports to exactly one manager. Exactly one top-level user has no manager.
  • A manager must be an active user in the same organisation; nobody can manage themselves, and a change that would create a loop is refused with a clear explanation.
  • A reporting line is at most 10 levels deep.
  • Changing a person's manager moves that person and their whole team below them, intact, in one step. Nobody else's reporting line changes.
  • An unplaced user — no manager set — retains full access to their own work but has no team visibility until an administrator places them.
  • A disabled user cannot sign in. Disabling never removes historical ownership or reporting, and hands each of their open items to their manager until an administrator reassigns them.

Acceptance criteria (rough)

  • An administrator can set and see all seven user fields at a glance in user management.
  • Every user has exactly one role and one manager; only the single top-level user has none.
  • A manager change creating a loop is refused with a clear message.
  • A valid manager change carries the person's whole team with them, and changes nobody else.
  • A user with no manager and no team sees exactly their own work — verified with a fresh account.
  • Disabling a user hands their open items to their manager and leaves their history intact.
  • Administrators can see at a glance who is still unplaced.

Out of scope (this feature)

  • Any visual hierarchy editor or org-chart builder.
  • The inherited visibility rules themselves — that is inherited-visibility.
  • Region and Country semantics — that is regions-and-countries; this feature only stores them.
  • Multiple managers, matrix or dotted-line reporting.

Notes for Define

Covers FR-1, FR-3 and BR-2, BR-3, BR-4, BR-5, BR-6, BR-7, BR-8; proves AC-1, AC-6, AC-7, AC-12. Paul was explicit and repeated: one user, one role, one manager, one reporting line — "no two hats". The two-hat model that appeared in the drafted scope was struck outright, so do not carry any per-role manager concept forward. Vendor is the organisation (tenant), not a user role — the six roles are Admin, Sales, CSM, SDM, Expert and Customer, with Sales new in this scope. Region and country are stored on the record here but only get meaning in stub 2. Street address and postal code stay as contact information with no reporting meaning.

Answers from Jamie — interrogation 2026-08-17

Recorded by the intake-easy-features session; these rulings bind Define.

  • Backfill for existing organisations: the tenant admin becomes the single top-level user; everyone else initially reports to them until rearranged.
  • Existing vendor-role / multi-role user documents: untouched and outside the hierarchy in v1 — the hierarchy covers internal roles only; migrating vendor contacts to organisation-level modelling is a later scope.