REQ-NFR-068

Schedule baseline and cost baseline rows are insert-only at DB role level

ID: REQ-NFR-068
Category: Non-Functional Requirements
Status: approved
Priority: P0
Created: 2026-05-11T18:34:00.000Z
Approved: 2026-05-11T18:37:00.000Z
Updated: 2026-05-11T18:37:00.000Z

What

schedule_baseline, schedule_baseline_activity, cost_baseline, and cost_baseline_allocation tables SHALL grant only INSERT (no UPDATE, no DELETE) to the application DB role. Same enforcement model as the audit_log (REQ-FUN-071 / REQ-NFR-013).

Why

established project management guidelines baselines are configuration-managed artifacts. A retroactive edit destroys the comparison reference and any EVM/variance computation against it.

How

Postgres GRANT statements in the migration scripts; permissions test in CI confirms UPDATE and DELETE return permission errors via the app role.

Done when

Test attempts UPDATE and DELETE via the app role and both fail with permission_denied; baselines remain stable across activity / budget edits.

Out of scope

Cryptographic baseline signing (separate future enhancement).

established project management guidelines Mapping

Primary Knowledge Area: Schedule Management
Secondary KAs: Cost Management, Integration Management, Risk Management
Primary Process Group: Planning
established project management guidelines Deliverable: Schedule Baseline, Cost Baseline

Integrity NFR for both Schedule and Cost baselines.