Skip to content

Grievance Officer configuration

The editable Grievance Officer record is a dedicated singleton aggregate. It is intentionally separate from PolicyRegistry: policy text/version/hash remains immutable, while operational contact details can change without manufacturing a new policy hash.

Authority and access

  • GrievanceOfficerConfigurations is the only editable source used by the admin screen and public legal-page contact card.
  • The management API requires authentication, the live compliance.legal_configuration.manage permission, and a current active SuperAdmin role. All three checks are server-side; hiding the navigation is only a user-interface convenience.
  • The public API exposes only an active officer's public contact fields. It returns no content when the record is absent or inactive. Audit/actor data is never public.

Date and launch gate

AppointmentEffectiveDate is nullable by design. The seeded record contains no invented date and formal appointment evidence starts unverified. Customer operations are not launch-ready unless the record is active, the date is configured, and formal appointment evidence is explicitly verified. The admin readiness endpoint exposes this gate.

The public contract never contains the appointment date, even after a SuperAdmin records it. Publication is a separate legal/policy decision and requires a deliberate future contract change; entering an internal compliance date cannot make a new public legal representation automatically.

Integrity and audit

Updates require the caller's expected version and fail with a conflict on a stale write. Every changed field produces an append-only audit row containing old/new values, actor, UTC timestamp, and mandatory reason. Server validation rejects missing fields, invalid email/phone/date values, control characters, and markup. React renders public values as text and never injects HTML.