Skip to content

0006 — The customs team is chosen per dossier, not from the user's role

Status: accepted · 2026-08-06

Context

The Entra app registration defines four team roles — CustomsAntwerpen, CustomsAalst, CustomsRekkem, CustomsGent — matching the four CustomsTeams rows name for name. They were created for exactly the use case they suggest: a declarant belongs to a branch, so the branch could follow them from their role assignment and the dropdown would disappear.

Nothing in the codebase reads them. The team is selected from a dropdown on New Dossier and Declare, per dossier, and written to Dossier.CustomsTeamId.

That looks like an unfinished feature, and it is not. The team determines the Descartes folder a declaration is routed to, and the routing is not cosmetic — Gent's folders carry their own handling (TUF Gent/IDMS-Y025&4008 on detail, TUF Gent/NCTS5-add 4006) where the other three are plain IDMS <branch> / AES <branch> / NCTS5 <branch>.

The reason the roles were never wired up: a declarant creates dossiers for other teams as well as their own. Branch membership does not determine which branch a given dossier belongs to. Deriving the team from the user would therefore be right most of the time and silently wrong the rest, and "silently wrong" here means a declaration filed into another branch's folder.

Decision

The customs team stays a manual, per-dossier choice. The user's role does not select it, and the Customs* roles are not read.

Consequences

  • The dropdown is deliberate, not a to-do. Do not "finish" this by defaulting it from the role. A default that is usually right is worse than no default here, because being wrong is invisible until the declaration is in the wrong folder at Descartes.
  • The four Customs* roles were deleted from Entra on 2026-08-06, once this decision was taken. Nothing in the application noticed, which was the point. The app registration now holds only Admins, SuperUsers, Users and Ingestion.Write.
  • While they existed, a user assigned only a team role would have had no access at all: unknown roles map to nothing and the baseline RequiresUser policy needs a tier role. That never bit, because everyone also held one — a habit rather than a safeguard. Worth remembering if team-ish roles are ever reintroduced.
  • If per-user defaulting is ever wanted as a convenience, the honest shape is a pre-selected dropdown the declarant can still change, never a derived value they cannot see. That is a different decision from this one, and would need a new record.