PROD-CAT-002 — Hide unsupported adjacent-product controls
| Field | Value |
|---|---|
| Status | Open finding; source-verified and live-observed |
| Severity | Medium |
| Affected surface | Catalog landing actions |
| Implementation issue | oqullus #538 |
| Code-change repository | sparqd/oqullus |
Where the problem appears
Open Catalog as each visible role and inspect Delta Sharing, Clean Rooms, and External Data.
Concrete observed case
All three controls are unconditionally disabled, offer no availability reason, and have no identified backend, deployment capability, permission, feature flag, or supported journey.
Expected condition
Hide unavailable products. Reintroduce a control only when an explicit capability response, role condition, workspace requirement, documentation, and supported end-to-end journey exist.
Cause and evidence
- The controls are always disabled.
- Their handlers do not lead to a product operation.
- No matching deployed capability was identified.
Why it matters
The UI advertises unsupported products and suggests that an unexplained role or configuration change might unlock them.
Existing controls and workarounds
Treat these products as unavailable; the disabled state is not an access-request mechanism.
Alternatives considered
- Recommended: remove controls until supported.
- Show an informational roadmap page — only if product intentionally communicates availability.
- Keep unexplained disabled buttons — rejected as ambiguous and noisy.
Component involvement
- Product owns availability decisions and documentation.
- Oqullus gates presentation from explicit capabilities.
- BFF/platform deployment supplies capability state when implementation exists.
Reproduction and verification
Follow CAT-S013. Record the visible state, request outcome, effective identity, and recovery behavior relevant to this finding.
Resolution conditions
Close when unsupported controls are absent or each control has a verified capability, reason, documentation path, permission model, and working journey.
Validation and blockers
Product and Oqullus owners must validate.