Contract-freeze · UX approval · design-first

Employee — cross-org staff console · Approval Frames

An Employee is formalized FuzeFront platform staff: the existing cross-org Permit ReBAC org-admin-on-root capability, which derives down the parent tree, surfaced as a named, scoped role. An Employee operates across customer orgs from the root/portal-management console without a membership row in any customer org — which is exactly why a customer's own member list never shows them (their access is inherited, not a row). This console is where that inherited/derived access is made explicit and labelled, the one place it is legitimately surfaced. Approving freezes the visual + interaction model and commissions the "Employee" role in the role catalog. Built in the fuse-seam design system (tokens only).

Frame (a) · flow: employee-console

🛰️ Cross-org explorer

Every org/portal in the tree an Employee can reach via derived access — with an explicit "derived from root" tag on each. No membership row anywhere.

Frame (b) · flow: employee-console

🔎 Org drill-down

Operate inside a customer org as staff: a clearly separated, labelled "Access via platform staff (inherited)" panel — never mixed into the org's own direct-member list.

Frame (c) · states are contract

◔ States

Loading skeleton (aria-busy), empty (no orgs yet), error+retry, and the fail-closed 403-in-place for a non-Employee reaching /staff — never a sign-in redirect.

Build inventory — approving these frames approves this plan

Flows

employee-console → EmployeeConsoleFlow @ /staff · approved:false

Components

EmployeeConsole
StaffGuard
CrossOrgExplorer
OrgTreeRow
DerivedAccessTag
OrgDrilldownPanel
InheritedAccessPanel
StaffScopeSummary
NotStaffNotice

Packages

@fuzefront/identity-ui

Feature flag

fuzefront.identity.employee-console

Contract mapping — what approval commissions

Commissioned by approval: a named "Employee" role in the role catalog, defined as Permit ReBAC org-admin on the platform root org (derives down parent). Not a membership row — a scoped, derived capability. Backed today by backend/src/services/rootOrgAdmin.ts / utils/permit/resource-instances.ts.
Read model: the org tree an Employee can reach — reuses GET /api/organizations (tree via parent_id) evaluated under the caller's ReBAC scope, and the member/directory surfaces per-org. No customer membership is written or implied.
Requirement #5 boundary: a customer org's own member list shows direct memberships only and MUST NOT show Employees (they have no row). This console is the only place inherited/derived staff access is surfaced, and it is a clearly separated, labelled panel — never merged into a customer's direct-member list.
Authz fail-closed: a non-Employee reaching /staff gets 403 FORBIDDEN rendered in place; cross-org data is scoped by ReBAC, never by a client-supplied org id.

Design system: @fuzefront/design-system (fuse-seam) · Contract: packages/security/openapi.yaml + Permit ReBAC schema (Employee role commissioned) → @fuzefront/security-client · Component: @fuzefront/identity-ui → EmployeeConsoleFlow · Flag: fuzefront.identity.employee-console (default OFF).
Approve per flow by setting build.flows[].approved: true (+ approver + date), or reply @claude approve / @claude reject: <reason>.