Clarify Order Management spec audience is internal/staff-facing

[xavierjohn]

What

Adds an explicit Audience note to Section 1 (Domain Overview) stating the Order Management system is internal / staff-facing: its users are staff actors (sales representatives, warehouse managers, administrators) acting on behalf of customers.

Why

The overview described the domain as "customers place orders" yet models staff roles (SalesRep, WarehouseManager, Admin) and records a separate CreatedByActorId — leaving it ambiguous whether the ordering user is the customer or a staff member. That gap is security-relevant: it decides whether accepting a client-supplied customerId on create is correct (staff acting on behalf) or an IDOR (customer self-service). The note makes the intended model explicit so an AI implementation — and any reviewer — isn't guessing.

Note

States that orders:create authorizes creating an order for any existing customer (customer-exists check only; no per-customer ownership check), and that a self-service design would instead derive the customer from the authenticated actor rather than trusting a request field.

[Copilot]

Pull request overview

Adds an explicit clarification to the Order Management specification that the system is internal/staff-facing, so readers (and AI-generated implementations) don’t have to infer whether order creation is customer self-service vs. staff acting on behalf of customers.

Changes:

• Add an “Audience — internal, staff-facing” note to the Domain Overview.
• Clarify that customerId is supplied on order creation and CreatedByActorId tracks the staff actor.
• Clarify that orders:create permits creating orders for any existing customer (customer-exists check only), not a per-customer ownership model.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.