ADR-0004: Ownership Transfer Is Super Admin-Only in V1
Status
Accepted
Context
A device's registered owner can change (a unit is sold on, a mosque replaces hardware, etc.). Allowing the current owner to self-service a transfer is convenient, but it also creates a fraud surface: a stolen device could be "transferred" by whoever currently holds it, laundering its provenance without any check.
Decision
Ownership transfer is performed by a Super Admin only, in V1. Self-service transfer by the device's current owner is deferred.
Alternatives Considered
Not recorded in source material.
Consequences
- A stolen unit cannot be laundered into a new owner's name without going through a human operator who can apply judgment.
- Legitimate transfers (resale, hardware swap) require Super Admin involvement rather than being instant and self-service, which is a real operational cost accepted deliberately in exchange for the fraud protection.
- This is explicitly a V1 constraint, not a permanent architectural limit — self-service transfer may be revisited later.