JJijibora
Docs & Product Guide
On this page (8 sections)

Governance & Federation — Multi-Property Hotel Groups

Status: Governance Architecture
Sources: Cross-Organization Federation & Federated PoCE Specification, docs/platform-map/system/S-142-SCOPE-GOVERNANCE.md, S-03 — Jijibora Playbook Registry (stakeholder + developer), S-04 — Security and Fairness: What We Can Promise and What We Cannot (plain-language guide), Jijibora Competitive Positioning — Buyer's Language

1. Property as Scope

Each hotel property is a scope with an isolation boundary. Users, roles, and permissions resolve per scope via APF (s230):

  • fn::app_perms::resolve_effective(user_id, app_id, context_scopes) — aggregates role-based + direct grants
  • fn::app_perms::build_permissions_block(user_id, app_id, scopes) — JWT block with roles, scopes, permissions, features, UI hints
  • fn::app_perms::list_vocabulary(app_id) — full permission vocabulary for UI rendering

Hotel roles: front desk agent, housekeeping attendant, housekeeping supervisor, engineering technician, procurement officer, F&B manager, events manager, revenue manager, finance controller, property GM, regional director, auditor.

2. Delegation & Authority (s142)

Property managers delegate approval authority to department heads; regional offices delegate to property GMs. Revocation cascades.

  • fn::authority::delegate — create a delegation chain entry
  • fn::authority::verify_chain (10-hop bounded unroll) — verify a chain is valid and unbroken
  • fn::authority::root_authorized — check root authorization for a scope
  • fn::authority::cascade_revoke — revoke and cascade to dependents
  • fn::scope::join_scope — add a user to a property scope
  • 15 invariant checks fn::invariant::check_*; recovery sweep_orphans, sweep_expired

All delegation chains are auditable and bounded — no unbounded authority.

3. Record Federation (s184) — Cross-Property & Cross-Organisation

Hotel groups share procurement, staff, and vendor records across properties without merging databases.

  • cns_federation_policy — which CNS schemas may cross property/org borders (e.g., cns://claim/type/hotel/requisition federates; cns://claim/type/hotel/folio_line may not)
  • record_federation_binding — binds a local record to an authorized peer property scope (READ_ONLY / COLLABORATIVE, BIDIRECTIONAL)
  • record_federation_event — immutable audit ledger of cross-tenant actions
  • Fields on claim, truth_node, truth_edge: is_federated, federation_scope, federation_mode, federation_policy

Group procurement (H-9): Federated requisition (is_federated: true) bound to peer property scopes; each property signs its allocation quota with BBS+ key (selective disclosure — no internal margin leakage); shared PoCE escrow session releases supplier payment only on multi-property delivery verification.

Guard rails: Authority verdict required before award; missing verdict blocks award; no autonomous escrow release.

4. BBS+ Selective Disclosure & Identity (s121-s123)

  • Guest proves age/nationality without surrendering full ID document (selective disclosure)
  • Property proves participation validity without revealing internal margins
  • Keycloak DID anchoring per organisation; X-Sovereign-DID-Proof header (Ed25519/BBS+) on cross-tenant calls

5. Community Governance (s165-s166) — Hotel Rules as Law

Hotel-specific rules (scope, compliance, spatial, AI-advisory) live as governance rules with lifecycle:

  • fn::scope::create_community, fn::scope::effective_rules
  • fn::rule::create, fn::rule::enforce, fn::rule::search_text, fn::rule::explain
  • fn::proposal::create, fn::proposal::cast_vote, fn::proposal::resolve
  • fn::compliance::audit, fn::compliance::check
  • fn::moderation::report, fn::moderation::resolve
  • fn::spatial::bind_rule, fn::spatial::check_jurisdiction

Hotel rule examples (declarative, not hardcoded): "Housekeeping must sign off a room within 90 min of departure"; "Folio adjustments > KES 50,000 require dual custody"; "No event starts without deposit confirmation." Rules are values in NATS KV / governance tables, changeable without code.

6. Notifications (s147) & Security (s146)

  • Device registration, notification enqueue, delivery attempts, preferences, templates
  • Session context, MFA (finance/admin roles), security audit log, login rate limiting, login attempts
  • Front desk and engineering sessions audited

7. Attachments (s148) & Lifecycle (s150)

  • File attachments (housekeeping photos, maintenance evidence, ID scans) with upload sessions, virus scanning, versioning, soft delete
  • Entity lifecycle events bridge to PoCE sessions (auto-start on governed events; governance_hook=true + governance_path_spec_id)
  • NATS outbox routing via fn::lifecycle::emit_poce_stage_event

8. Claims We Can / Cannot Make (Governance)

Can claim: Role-based access per property; auditable delegation chains; immutable cross-property audit ledger; BBS+ selective disclosure; fail-closed on infra failure; rules changeable without code.

Cannot claim: No specific savings until baseline measured; no autonomous escrow release/dispatch (machines propose, rules dispose); no PHI custody; no FedRAMP High/FIPS.

Referenced by 1 document