Matter walls

Makes a matter team-only, or screens a member of the firm from it — held by the database on every read and write of the matter, its files and its records, every change on the record.

A screen beats every role and every team seat, and nobody lifts their own; the matter's own client is never walled, and only the firm's attorneys, its administrators or the matter's responsible member change its walls.

• Answer

  forbidden

  HTTP

  403

  Meaning

  The session is not the firm's staff for this matter; the door reads nothing further.

• Answer

  mfa-required

  HTTP

  —

  Meaning

  A staff session needs its second factor before any staff door opens: 401 to verify it, 403 to set one up.

• Answer

  unavailable

  HTTP

  503

  Meaning

  The record could not be read: the door answers unavailable, never an empty list or a zero.

The registry declares no action of this capability that reaches outside EstateDraft.

• src/lib/db/phase4c2-migration.test.ts
• src/lib/rls-suite-coverage-4c2.test.ts
• src/lib/access/walls.test.ts
• src/lib/phase4c2-routes.test.ts
• src/lib/access/wall-census.ts
• src/lib/access/walls.ts
• src/app/api/admin/matter-access/route.ts
• src/components/access/MatterAccessView.tsx

Reviewed: 2026-10-24