Open questions

Each item stays pending until it is confirmed with its owner. Recorded answers are shown under the question they belong to.

P8-Q1 — Scope & audience
Who logs in (customer procurement, engineering, per-site or global) and what is the single most valuable first view?
Owner: Jimmy Connor / portal owner (to confirm)
Recorded answer
Answered (3 Sep, Jimmy): one customer role only — everyone from the customer sees the same thing. Access is per SITE, not per global account: a customer of a global account is entitled to specific class-A sites individually, not all of them. Where EWIE/IWI is the integrator (e.g. most Rolls-Royce sites), Seco is contractually barred from showing that site's data even though it is class-A; where Seco deals direct (e.g. RR Germany, GKN Filton integrator) full sharing is fine. Most valuable first view still to confirm.
Answered
P8-Q5 — Owners
Who owns portal requirements and client-side sign-off?
Owner: To confirm
Pending confirmation
P8-Q4 — Authentication
How do customer users sign in — external identity / invitation flow on Power Pages?
Owner: CSP (technical)
Pending confirmation
P8-Q14 — Login administration
Who creates a customer login, and who removes it when that person leaves the customer or changes role?
Owner: To confirm
Raised by: CSP, 8 Sep 2026
Direction (not confirmed): An operational owner question rather than a technical one. Nobody has been named, and a customer contact whose access is never removed keeps seeing that account's data.
Pending confirmation
P8-Q13 — Contact attachment
Does a customer contact belong to a single site (e.g. Rolls-Royce Bristol) or to the parent customer (Rolls-Royce)? What a contact can see is filtered by whichever account record they are attached to, so a contact attached to the parent would see every site beneath it.
Owner: Jimmy Connor / Steven Bell
Raised by: CSP, 8 Sep 2026 — reviewing the per-site entitlement answer against how isolation is enforced
Direction (not confirmed): P8-Q1 and P8-Q9 confirm entitlement is a per-site allow-list, but neither says at what level a customer contact attaches. If contacts attach to the parent customer, the per-site allow-list cannot be enforced by account scoping alone.
Pending confirmation
P8-Q3 — Data isolation & security
When a customer logs in, how do we know which account they belong to, and how do we guarantee they can only ever see that account's data?
Owner: CSP (technical)
Pending confirmation
P8-Q2 — Data boundary
Which internal features become customer-facing (obsolescence notices, sales/spend, market share, order/expediting status, consignment) and which stay internal-only?
Owner: Jimmy Connor / Steven Bell
Prototype direction: Prototype strawman: obsolescence and order delivery are exposed for the seed account; sales/spend, market share, consignment and drawings are hidden. Not a confirmed decision.
Recorded answer
Answered (3 Sep, Jimmy): full flexibility — nothing is permanently un-exposable. The only sensitive spots are the sales dashboard (fine on integrator accounts, maybe not others) and some internal action-log items (future strategy / business cases). A default-on set of ten is switched on for every account then toggled off: safety first, sales dashboard, top-10 spend, action log, recycling, cost savings, Seco time on site, innovation hub, obsolescence, on-time delivery. Exact per-widget columns (data boundary detail) still to confirm.
Answered
P8-Q7 — Exposure scope
Is what a customer sees configured per account, or is there a global default with per-account overrides?
Owner: Jimmy Connor / Steven Bell
Raised by: CSP, 4 Sep 2026 — exposure-control discussion
Recorded answer
Answered (3 Sep, Jimmy): configured PER ACCOUNT. Every account starts from the default-on set of ten, then account management toggles widgets off/on for that customer. Some customers want everything shared; others want only a couple of widgets.
Answered
P8-Q9 — Inheritance across the hierarchy
Does a site (e.g. RR Bristol) inherit its portal exposure from the global account (RR), or is it set per site? Ties to P8-Q1.
Owner: Jimmy Connor
Raised by: CSP, 4 Sep 2026 — exposure-control discussion
Recorded answer
Answered (3 Sep, Jimmy): NOT inherited automatically. A customer of a global account is entitled to sites individually — 'the customer can see this site, this site, but not this site.' Example: of Rolls-Royce's ~11 class-A sites, Seco may share only RR Germany and must legally hide the others where IWI is the integrator. So entitlement is a per-site allow-list, not global inheritance.
Answered
P8-Q8 — Hidden means what?
When a widget or section is hidden for the portal, is only the tile hidden or is the underlying data also not exposed to the customer at all? (Recommendation to discuss: hidden = not exposed.)
Owner: CSP (technical) with Steven Bell
Raised by: CSP, 4 Sep 2026 — exposure-control discussion
Prototype direction: Prototype strawman: hidden = not exposed. A widget that is not exposed produces no tile and no data request (fail closed).
Pending confirmation
P8-Q11 — Audit
Does the customer, or Seco, need a visible history of when their portal view changed and by whom?
Owner: Steven Bell
Raised by: CSP, 4 Sep 2026 — exposure-control discussion
Pending confirmation
P8-Q6 — Notice delivery
For the obsolescence 12-month notice: CRM email, portal notification, or both? Ties to SAM Q7.
Owner: Steven Bell
Direction (not confirmed): 3 Sep 2026 Q&A (Steven Bell): the 12-month notice should be an automated email originating from CRM; the portal's role is to show the customer which of their products are affected and the notice status, not to send the notice. Not confirmed — depends on Seco fixing the CRM process first.
Prototype direction: Prototype strawman: the lifecycle view shows affected parts and notice status only; no 'send notice' action is offered.
Recorded answer
Answered (3 Sep, Steve): the 12-month notice is an automated email originating from CRM; the portal shows the customer which of their products are affected and the notice status, it does not send the notice. Depends on Seco fixing the CRM process first.
Answered
P8-Q12 — Embedded reports
For Power BI embed widgets, does portal exposure require a separate customer-facing report / row-level security rather than the internal report?
Owner: CSP (technical) with Orla
Raised by: CSP, 4 Sep 2026 — exposure-control discussion
Prototype direction: Prototype strawman: order delivery and market share views use the Power BI embed contract as a typed placeholder only; no real embed URL or customer-safe report/RLS exists yet.
Pending confirmation