# LeadPilot — Lead Authorization & Multi-Tenant Boundaries

**Document Version:** 1.0.0 (Phase 7 Lead Management Lock)  
**Status:** Implemented & Verified  

---

## 1. Multi-Tenant Authorization Rules

```
+--------------------------+-----------------------------------------------------------------------------------+
| OPERATION                | ENFORCEMENT & INTEGRITY RULE                                                      |
+--------------------------+-----------------------------------------------------------------------------------+
| View Lead / Inbox        | User must be active member of workspace. Returns 404 (Anti-IDOR) if cross-tenant. |
| Create Lead              | Scoped to `TenantContext`. Stage, Source, and Assignee must belong to workspace.  |
| Update Lead              | Transactional; assignee must be active workspace member.                          |
| Change Stage             | Target stage must belong to active workspace; updates status & terminal timestamps|
| Add Internal Note        | Note author must be authenticated workspace user.                                 |
| Archive Lead             | Transitions `leads.status = 'archived'`; omitted from default inbox view.         |
| Delete Lead              | Hard deletion restricted to workspace owners/admins.                              |
+--------------------------+-----------------------------------------------------------------------------------+
```