Fingerprint Clearance Card Management — Integration

​

Overview

​

Integration Points

​

Platform Foundation (PF)

​

Intra-HR dependencies

​

Event Contracts (planned)

​

hr_fingerprint_clearance_status_changed

interface HrFingerprintClearanceStatusChangedPayload {
  event_type: 'hr_fingerprint_clearance_status_changed';
  organization_id: string;
  employee_id: string;
  clearance_id: string;
  previous_status: string;
  new_status: string;
  effective_at: string; // ISO timestamp
  timestamp: string;
}

​

hr_fingerprint_clearance_expiration_warning

interface HrFingerprintClearanceExpirationWarningPayload {
  event_type: 'hr_fingerprint_clearance_expiration_warning';
  organization_id: string;
  employee_id: string;
  clearance_id: string;
  /** Must match a threshold from org `fingerprint_clearance_alert_days` (default [90, 60, 30]). */
  days_until_expiration: number;
  expiration_date: string; // ISO date
  timestamp: string;
}

​

API / data access

• Client: HR module routes and hooks under src/cores/hr/; use Supabase client with tenant filters on mutations.
• Downstream cores: Consume published events or platform read APIs—do not query hr_fingerprint_clearances from non-HR cores.

​

Security & tenant isolation

• All rows scoped by organization_id; RLS enforced.
• Full card numbers suppressed for all non-authorized roles and internal surfaces (including logs, prompts, error strings, monitoring/telemetry, and debug dumps).
• No secrets or card numbers in logs, prompts, error strings, monitoring/telemetry, or debug outputs.

​

Related documentation

• CROSS_CORE_INTEGRATIONS.md — matrix row HR-28
• PLATFORM_INTEGRATION_LAYERS.md
• CONTRACT_VALIDATION_CHECKLIST.md