Management authority
Management authority sets who may change a Workspace in Installable Products. Each Workspace has one owner for its design. The policy sets whether Console or code owns those changes. A change of Surface does not grant a right to write.
Ownership
Management authority binds the Workspace to a mode and, for IaC, a deployment principal. The mode applies across Surfaces. Both code forms use the same Workspace plan.
| Mode or form | Who can change the design |
|---|---|
| Console-managed | A caller with the required rights. |
| IaC-managed | Only the configured deployment principal, with the required rights. |
| Merulan Code | The IaC owner applies the TypeScript form of the plan. |
| OpenTofu | The IaC owner applies the optional OpenTofu form of the same plan. |
Repository, ref, and source digest are provenance, not authorization. Design rights do not replace the call's access checks. Record writes, Workflow Runs, and Source sync stay outside the design plane.
Lifecycle
Management authority changes through an explicit authority transfer. Import alone does not transfer authority or mutate an installation. To enter IaC mode, account for all installs. Import them without change, then prove that the next plan is empty. The deployment principal must adopt under its own identity.
The current owner must admit the transfer. That rule also covers a change of principal or a return to Console mode. A failed transfer keeps the prior owner.
Boundaries
Management authority and plan scope answer different questions. A mixed portfolio has some installs in the managed plan and some outside it. Both share the Workspace's design policy. Composition and Workspace Bundles explains how plan scope treats omitted installs.
The Console's install editor can apply a change in Console mode if the checks pass. In IaC mode, it can return a repository proposal for review. A proposal does not change installed settings. The deployment principal still applies the accepted plan.
Merulan Code and OpenTofu support the plan contract. Their public release needs separate proof. Use the Infrastructure as Code guide to check setup and release status.
Failures
Management authority refuses a stale policy, a changed plan, or the wrong principal. Missing adoption proof blocks a transfer. Changing the repository label cannot fix these failures. Labels grant no rights. A Console proposal gives you a change for repository review. Read the apply result to learn whether that change took effect.
Recovery
Management authority recovery starts with the current policy and failed plan. Refresh a stale revision. Preview and review the changed plan again. Review a proposal in the owning repository before the deployment principal applies it. If adoption is incomplete, account for the missing installs. Import them and check that the next plan is empty before transfer.
After transfer, read the policy again. Check the mode, principal when present, code format, and new revision. Use that read as the base for the next design change.
Related
- Lifecycle, provenance, and drift explains what to retain when installed state changes.
- Governance & Administration owns the access checks that apply alongside design authority.