Expert quotes

The bid pool — experts quoting on a qualified lead, and the manager review that picks one. See Reading the tables for the conventions, and /admin/settings/scope in the platform for the live per-tenant answer.

Capabilities

The SDM and admin see the whole bid pool and decide it. They hold proposal.view across the tenant and proposal.respond to accept or reject. Experts and customers hold proposal.view own-scoped, and act through their own flows — the expert submits, resubmits and withdraws their own quote, and the customer reads the expert quotes on their own lead. Neither ever acts through proposal.respond. CSMs and vendors hold no expert quote permission at all.

The CSM is out of the bid pool by ruling, not by oversight. The SDM handles everything with the expert — the bid pool, the review of each expert quote, selecting the expert and sending the customer quote by accepting an expert quote — and the CSM everything with the customer. The CSM held the bid pool briefly after the October 2026 demo review; the csm-drops-match-and-bid-pool migration took it back off every tenant’s CSM template. So the CSM holds neither permission: the Customer Service Journey shows them no Expert quotes section and no expert quote lever, and /proposals denies them. Both surfaces are derived from the permission set, so nothing in the UI branches on the role to achieve it. What the CSM keeps is the commercial half — the Customer quote section still names the winning expert and the accepted amount, and quote.approve is still theirs. Before the customer quote, the same section tells them how many expert quotes are in, naming none. A tenant admin who wants one particular CSM in the bid pool grants proposal.view and proposal.respond to that user; the per-user override is untouched by this split. That grant restores the workspace Expert quotes section and its inline accept/reject and opens /proposals: the route gate derives its allow-list from the platform role defaults, and when that list refuses the acting role it resolves the principal’s effective permissions and admits them if they hold the route’s permission after all. Such a CSM’s acceptance selects the expert but never claims the lead’s SDM or CSM slot. Both surfaces are permission gates; the route’s default list is the fast path, not the whole answer.

Both halves of that grant are needed, and half a grant is silent rather than broken. The rail’s two bid-pool levers — “Review the expert quotes” and “Go to the expert quotes” — do nothing but scroll to the Expert quotes section, so they are offered only to someone who holds proposal.view as well as proposal.respond. Granting the response permission on its own shows no lever at all, rather than one that scrolls to a section that is not on the page. That is the general rule for any lever whose action is to move you somewhere in the workspace: it is offered only where the section it lands on is.

The expert’s Expert quotes section also has a stage. It is theirs while the quote is live — it is where they read and edit their own quote — and it disappears once the customer quote is accepted and work starts, because from then on the engagement’s record for them is the Delivery section. The expert keeps proposal.view (own) throughout; this is a suppression at one stage for one persona, not a revoked permission, and it changes nothing for anyone else.

Within that stage, a decided quote is no longer the expert’s to change. Once a quote has been accepted or rejected — or carries a status the platform cannot read — its expert can no longer edit it, withdraw it back to draft, or archive it, and the controls for all three are withheld rather than shown and then refused. Reading is unaffected. Like the section’s own stage, this is a status rule rather than a revoked grant: the expert still holds proposal.view, proposal.resubmit, proposal.delete and proposal.archive, and every one of them still works on a quote nobody has decided yet. See the expert quotes journey for what each decision closes.

The customer’s half of the negotiation loop is its own permission. proposal.requestChanges is own-scoped and held by the customer alone: asking an expert to revise is not deciding the quote, so it is deliberately not proposal.respond, and the managers who decide quotes do not need it. The service re-checks that the caller owns the quote’s lead, so the scope is enforced on the data rather than asserted by the template. The expert answers a request through proposal.resubmit — the same grant that already covers resubmitting — and while a round is open that grant no longer returns the quote to draft. See Expert quotes for the loop itself.

Surfaces

Writing a quote is expert-only, so /proposals/create carries an explicit list rather than deriving from proposal.view — otherwise every manager would be handed a form none of them can submit.