# EDU-010 — Tenant content publication and graph integrity

- **Status:** blocked
- **Type:** implementation program
- **Phase:** 3
- **Blockers:** EDU-004, EDU-009, provider-authority decision, PUBLIC graph-semantics decision

## Tenant-admin outcome

Authorized tenant administrators can author, classify, publish, archive, and retire education content without creating cross-tenant or invalid PUBLIC/tenant relationships, and student reads remain consistent with publication state.

## Scope

- Question banks, questions, versions, classifications, catalogs, collections, blueprints, and bindings.
- Draft/published/archived lifecycle.
- System RBAC/DataPermission enforcement.
- Tenant-consistent graph constraints or equivalent transactional enforcement.
- Provider consistency between authoring source and student reads.
- Safe projections preserved from EDU-001.

## Acceptance criteria

- [ ] Admin permission and data-scope matrix is explicit.
- [ ] Cross-tenant graph relationships cannot be persisted.
- [ ] PUBLIC and tenant-owned reference rules are enforced and tested.
- [ ] Unpublished/archived content is never student-visible.
- [ ] Publication is transactional and auditable.
- [ ] Database changes use `flyway-postgresql` and forward migrations.

## Risk and rollback

- **Risk:** High content-integrity and authorization risk.
- **Rollback:** Disable authoring/publishing and roll back application; preserve data and correct forward.