Audience: Admins, Compliance, Developers
Outcomes: Secure cross-org workflows; proper enforcement of sensitive actions
Partner relationships (lifecycle & effects)
Invite partner (Admin/Owner) with target org name + admin email.
Partner accepts → Active; either side can revoke (suspends new cross-org actions).
Effects:
Contract pickers show only linked partners.
Disputes between linked partners can be adjudicated.
Anti-patterns
Creating contracts against unlinked orgs (blocked).
Sharing accounts across orgs (violates audit requirements).
KYC & compliance gates
Gated actions (examples)
Contract creation/activation
Escrow release
Large-value payments or refunds
Enforcement middleware
const enforceKyc = (action: string) => async (req, res, next) => { const result = await kycService.enforceKycForAction(req.user.id, action); if (!result.allowed) return res.status(403).json({ requiresKyc: true, message: result.reason }); next(); };Statuses
unverified → pending → verified(orfailed/needs_more_info).UI clearly blocks gated actions and links to Settings → Compliance.
Edge cases
Revoked partner link: existing orders continue per contract; no new cross-org actions.
KYC failure locks only gated actions; read access remains per role.
QA checklist
Attempt gated action while unverified ⇒ 403 + { requiresKyc: true }.
Verified user performs same action ⇒ 200 and audit log entry.
Revoking partner link hides partner in contract selectors immediately.