Parent
Problem
Accounts created under the PENDING_APPROVAL access policy are stored as PENDING without a business session. When an administrator later changes such an account to ACTIVE, the current admin workflow updates only user_account.status; it does not provision the built-in @global namespace membership expected by active users. The approved user can therefore authenticate but encounter authorization failures in workflows that require global membership.
The OAuth flow also reevaluates PENDING_APPROVAL before resolving the existing binding, so an already approved account can be sent back to the pending page on every login. Separately, the generic status endpoint can currently reactivate a MERGED account.
Proposed solution
Make activation through the administrative user-status workflow provision the built-in @global MEMBER membership in the same transaction. Reuse the existing membership service so repeated activation remains idempotent, and roll back the account activation if membership provisioning fails.
For a policy decision of PENDING_APPROVAL, resolve the existing binding with PENDING only as the initial status: a new account remains pending, an existing approved account can log in, and an existing disabled account remains rejected. Reject attempts to reactivate MERGED accounts.
What to build
When an administrator activates a pending or disabled non-system account, SkillHub must atomically set the account to ACTIVE and ensure exactly one @global membership with role MEMBER. The completed approval must remain effective on subsequent OAuth logins even when the configured access policy continues to require approval.
Acceptance criteria
Blocked by
None - can start immediately.
Parent
Problem
Accounts created under the
PENDING_APPROVALaccess policy are stored asPENDINGwithout a business session. When an administrator later changes such an account toACTIVE, the current admin workflow updates onlyuser_account.status; it does not provision the built-in@globalnamespace membership expected by active users. The approved user can therefore authenticate but encounter authorization failures in workflows that require global membership.The OAuth flow also reevaluates
PENDING_APPROVALbefore resolving the existing binding, so an already approved account can be sent back to the pending page on every login. Separately, the generic status endpoint can currently reactivate aMERGEDaccount.Proposed solution
Make activation through the administrative user-status workflow provision the built-in
@globalMEMBERmembership in the same transaction. Reuse the existing membership service so repeated activation remains idempotent, and roll back the account activation if membership provisioning fails.For a policy decision of
PENDING_APPROVAL, resolve the existing binding withPENDINGonly as the initial status: a new account remains pending, an existing approved account can log in, and an existing disabled account remains rejected. Reject attempts to reactivateMERGEDaccounts.What to build
When an administrator activates a pending or disabled non-system account, SkillHub must atomically set the account to
ACTIVEand ensure exactly one@globalmembership with roleMEMBER. The completed approval must remain effective on subsequent OAuth logins even when the configured access policy continues to require approval.Acceptance criteria
PENDINGtoACTIVEcreates an@globalMEMBERmembership.DISABLEDtoACTIVEcreates an@globalMEMBERmembership.ACTIVEupdate does not create duplicate memberships.PENDINGorDISABLEDstatus.DISABLEDdoes not provision membership.PENDING_APPROVAL.PENDING_APPROVAL.MERGEDor system account cannot be reactivated.@globalmembership have smoke coverage.Blocked by
None - can start immediately.