Renata Account Activation Plan, Planning Only
Purpose
Define what must be true before future accounts can exist for Individual Mode or Organization Mode, while keeping Public Packet Mode as the only current live-static mode.
Public Packet Mode is the only current live-static mode. Organization Mode and Individual Mode remain future, planning-only, and no-go for runtime activation.
Current Boundary Status
Account activation plan status
read-only-renata-account-activation-plan-plan
Public Packet Mode status
only-live-static-current-mode
Organization Mode status
future-planning-only
Individual Mode status
future-planning-only
Live workflow activation status
no-go
Account activation status
not-active
Account status
not-created
Login status
not-created
Signup status
not-created
Identity capture status
not-active
Account storage status
not-stored
Actor storage status
not-stored
Subscriber storage status
not-stored
Organization tenant storage status
not-stored
Role assignment status
not-created
Permission runtime status
not-active
RBAC runtime status
not-active
Protected API status
not-created
Protected live route status
not-created
Database status
not-active
Migration status
not-added
Billing status
not-active
Lead capture status
not-active
CRM status
not-active
Stripe status
not-active
OpenAI real-submission processing status
not-active
Live workflow status
not-active
Cross-mode sharing status
not-active
Future Account Categories
These are planning labels only. They do not create accounts, permissions, policies, access checks, runtime guards, or account records.
public/no-account reader
Future purpose: Read source-backed Public Packet Mode surfaces without login or identity capture.
Possible future access shape: No-account public read access to static packet routes only.
Data boundaries: No user profile, cookie auth, account record, private content, or identity value.
Blocked powers: No submission, private storage, staff workflow, billing, or protected-route access.
Required future gates: public route safety audit, source-content reliability gate
Current implementation effect: planning-label-only
individual subscriber account
Future purpose: Possible future direct-subscriber account for private recovery structure support.
Possible future access shape: Future private Individual Mode access only after safety, privacy, account, and commercial gates.
Data boundaries: No saved check-ins, reflections, relapse plans, memories, chat transcripts, subscriber records, or billing records exist.
Blocked powers: No recovery coach runtime, AI runtime, crisis runtime, checkout, account settings, or sensitive recovery storage.
Required future gates: Individual Mode safety gate, privacy/consent gate, billing/commercial gate, technical/security gate
Current implementation effect: not-created
organization owner account
Future purpose: Possible future B2B organization owner account for tenant-level planning and configuration.
Possible future access shape: Future tenant owner access only after tenant, legal, privacy, commercial, and RBAC approval.
Data boundaries: No organization tenant, customer record, contract record, staff roster, resident roster, or tenant settings exist.
Blocked powers: No tenant creation, billing, admin CRUD, role assignment, workflow activation, or customer data access.
Required future gates: tenant/RBAC gate, privacy/legal gate, billing/commercial gate
Current implementation effect: not-created
staff account
Future purpose: Possible future staff access for approved organization-supported workflows.
Possible future access shape: Future role-aware staff access only after role, consent, workflow, and privacy approval.
Data boundaries: No staff profile, staff identity, staff notes, review queue, decision record, or protected workflow exists.
Blocked powers: No approve/reject action, staff decision, Morning Sheet placement, resident visibility control, or review writes.
Required future gates: tenant/RBAC gate, staff workflow gate, privacy/retention gate
Current implementation effect: not-created
resident/participant account
Future purpose: Possible future participant account for consented, user-controlled organization workflows.
Possible future access shape: Future participant access only after consent, privacy, deletion, visibility, and support gates.
Data boundaries: No resident name, participant identity, draft body, consent record, account record, or organization-private record exists.
Blocked powers: No draft submission, visibility change, private content storage, attendance tracking, participation tracking, or scoring.
Required future gates: consent gate, data minimization gate, retention/deletion/export gate
Current implementation effect: not-created
privacy/admin reviewer account
Future purpose: Possible future reviewer access for privacy or administrative review after policy approval.
Possible future access shape: Future restricted review access only after audit, access, and legal/privacy review.
Data boundaries: No identity claims, raw headers, JWTs, tokens, audit records, user records, or support records are read or stored.
Blocked powers: No account inspection, deletion workflow, export workflow, audit writes, admin CRUD, or approval recording.
Required future gates: privacy/legal gate, technical/security gate, retention/deletion/export gate
Current implementation effect: not-created
support/admin account
Future purpose: Possible future support access for approved customer support and incident boundaries.
Possible future access shape: Future support access only after least-privilege, audit, privacy, and rollback planning.
Data boundaries: No customer support record, support ticket, impersonation path, account record, or sensitive content access exists.
Blocked powers: No impersonation, customer data export, support ticket creation, rollback execution, or admin mutation.
Required future gates: support/rollback gate, technical/security gate, privacy/legal gate
Current implementation effect: not-created
technical/operator account
Future purpose: Possible future technical operator access for protected runtime support after security review.
Possible future access shape: Future technical access only after route/API, migration, incident, and rollback approval.
Data boundaries: No protected route access, API access, D1 access, raw identity headers, tokens, customer data, or production tenant data.
Blocked powers: No migration execution, D1 query, protected API call, protected route activation, incident workflow, or production mutation.
Required future gates: technical/security gate, pilot/support/rollback gate, privacy/legal gate
Current implementation effect: not-created
Identity and Authentication Boundary
These questions are documented without implementing auth, sessions, middleware, cookies, profile storage, account storage, access claims, tokens, or identity headers.
Future Questions
- identity provider choice
- Cloudflare Access vs app-level auth boundary
- email/password/passkey/social-login decision
- account verification
- invite flow vs self-signup
- organization membership
- tenant membership
- individual vs organization account separation
- staff/resident role assignment process
- deletion/export/access rights
- consent capture requirements
- age/eligibility policy if needed later
Explicit Non-Implementation
- no Cloudflare Access claims are read
- no JWTs are read
- no tokens are read
- no raw identity headers are read
- no cookies are added
- no session storage is added
- no auth middleware is added
- no user profile is created
- no account record is stored
Individual Mode Account Boundary
Status: planning-only-blocks-runtime
Must Pass Before Any Future Activation
- Individual Mode safety model gates are passed
- crisis/emergency escalation copy and routing are reviewed
- non-clinical language is approved
- private reflection privacy model is approved
- AI prompt/evaluation/privacy model is approved if AI is used
- data minimization, retention, deletion, export, and consent policies are approved
- billing/subscription boundary is reviewed separately
Explicitly Blocked
Organization Mode Account Boundary
Status: planning-only-blocks-runtime
Must Pass Before Any Future Activation
- Organization tenant model gates are passed
- tenant data model is approved
- role/permission/RBAC model is approved
- staff/resident account boundaries are approved
- resident consent/visibility model is approved
- organization-private data classification is approved
- audit/retention/deletion policy is approved
- pilot/support/rollback model is approved
- legal/privacy/commercial review is complete
Explicitly Blocked
Cross-Mode Boundary
Status: blocked-by-default
- Individual Mode and Organization Mode accounts must remain separated by default.
- No organization can see Individual Mode private reflections, check-ins, relapse plans, memories, or chat transcripts by default.
- No staff dashboard can inspect direct-subscriber private data by default.
- No cross-mode sharing exists now.
- Future sharing requires explicit consent, privacy, legal, product, and technical review.
- No account-linking bridge is implemented in this phase.
Protected Route and API Activation Sequence
This sequence is planning-only. src/pages/protected remains absent, src/pages/api/protected remains absent, no protected live routes or APIs are created, and no migrations are added in this phase.
1. account model approval
Status: planning-only-not-implemented
2. privacy/retention/deletion approval
Status: planning-only-not-implemented
3. auth provider decision
Status: planning-only-not-implemented
4. identity data minimization
Status: planning-only-not-implemented
5. route protection strategy
Status: planning-only-not-implemented
6. API protection strategy
Status: planning-only-not-implemented
7. account storage schema design
Status: planning-only-not-implemented
8. migration draft/review
Status: planning-only-not-implemented
9. local dry-run
Status: planning-only-not-implemented
10. staged sandbox verification
Status: planning-only-not-implemented
11. manual security/privacy smoke
Status: planning-only-not-implemented
12. rollback plan
Status: planning-only-not-implemented
13. production activation gate
Status: planning-only-not-implemented
Account Activation Gates
privacy/legal gate
Status: planning-only
Required evidence: privacy/legal gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if privacy/legal gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
product safety gate
Status: planning-only
Required evidence: product safety gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if product safety gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
clinical-claims gate
Status: planning-only
Required evidence: clinical-claims gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if clinical-claims gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
crisis/escalation gate
Status: planning-only
Required evidence: crisis/escalation gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if crisis/escalation gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
identity/auth gate
Status: planning-only
Required evidence: identity/auth gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if identity/auth gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
tenant/RBAC gate
Status: planning-only
Required evidence: tenant/RBAC gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if tenant/RBAC gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
data minimization gate
Status: planning-only
Required evidence: data minimization gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if data minimization gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
retention/deletion/export gate
Status: planning-only
Required evidence: retention/deletion/export gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if retention/deletion/export gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
billing/commercial gate
Status: planning-only
Required evidence: billing/commercial gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if billing/commercial gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
technical/security gate
Status: planning-only
Required evidence: technical/security gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if technical/security gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
pilot/support/rollback gate
Status: planning-only
Required evidence: pilot/support/rollback gate evidence reviewed outside this app before activation planning continues
What remains unresolved: No approval, implementation authorization, runtime design, storage design, or protected route/API activation exists in this phase.
Stop condition: Stop if pilot/support/rollback gate is treated as passed, approved, or ready inside this static plan.
Blocked implementation effect: blocks-account-runtime
Stop Conditions
- someone asks to create live accounts
- someone asks to add login/signup
- someone asks to add forms or identity capture
- someone asks to add protected APIs or protected live routes
- someone asks to add migrations or database writes
- someone asks to store account/user/subscriber/tenant/staff/resident records
- someone asks to connect billing/Stripe/CRM/lead capture
- someone asks to use AI for private/direct-subscriber content
- someone asks to make Individual Mode or Organization Mode live from this page
- someone asks to bridge Individual Mode private data into Organization Mode without separate consent/legal/privacy review
What Remains Blocked
Recommended Next Phase
Phase 11.17 - Individual Mode Handoff Freeze, Planning Only
Status: planning-only
After the Individual Mode static closure note is documented as a no-go planning artifact, future planning should freeze the handoff order and no-go language for outside-app review without creating handoff records, approvals, readiness records, protected APIs, storage, or live workflows.