Design roster-entry claiming and its verification #24

New Issue

christian · 2026-08-02T03:21:52Z

christian commented

2026-08-02 03:21:52 +00:00

Question

Surfaced by the tenancy resolution. A retailer imports a roster entry for "Acme Foods". Someone
signs up claiming to be Acme Foods. What makes that claim legitimate?

This is the seam where the whole isolation model could be defeated socially rather than
technically — a bad actor who successfully claims a competitor's roster entry inherits their
position on a retailer's list.

Resolve: who may claim an entry and on what evidence (email domain match against the roster
contact, retailer confirmation, DUNS verification, a claim token in the invitation); what happens
when two parties claim the same entry; how "Acme Foods Inc" on one roster and "Acme Foods" on
another are merged into one vendor org, and who authorises that merge; whether a retailer can
revoke a claim; and what a vendor sees of a roster entry before claiming it.

Note the ordering constraint: a vendor may be invited by a second retailer after already holding
a claimed vendor org, so claiming must handle both the cold path and the already-a-customer path.

Parent: #1

## Question Surfaced by the tenancy resolution. A retailer imports a roster entry for "Acme Foods". Someone signs up claiming to be Acme Foods. What makes that claim legitimate? This is the seam where the whole isolation model could be defeated socially rather than technically — a bad actor who successfully claims a competitor's roster entry inherits their position on a retailer's list. Resolve: who may claim an entry and on what evidence (email domain match against the roster contact, retailer confirmation, DUNS verification, a claim token in the invitation); what happens when two parties claim the same entry; how "Acme Foods Inc" on one roster and "Acme Foods" on another are merged into one vendor org, and who authorises that merge; whether a retailer can revoke a claim; and what a vendor sees of a roster entry before claiming it. Note the ordering constraint: a vendor may be invited by a second retailer *after* already holding a claimed vendor org, so claiming must handle both the cold path and the already-a-customer path. --- Parent: #1

christian added the

wayfinder:grilling

wayfinder:ticket

labels 2026-08-02 03:21:52 +00:00

christian referenced this issue

2026-08-03 16:47:06 +00:00

Design the app framework — retailer and vendor surfaces #23

Sign in to join this conversation.