17B. Supplier lifecycle and exact approved-list qualification
Maintain one authoritative immutable supplier history, qualify exact capabilities by receiving site, pin the approved version into procurement and receive a bounded supplier PO response without granting external tenant or transaction authority.
Purpose
Maintain one authoritative immutable supplier history, qualify exact capabilities by receiving site, pin the approved version into procurement and receive a bounded supplier PO response without granting external tenant or transaction authority.
Buyer, different Procurement Manager, different Supplier Quality Engineer, optional different Security & Compliance Officer, supplier Commercial contact, Project / Contract Manager, Auditor
SUP-001 onboarding v1 rejected → immutable v2 approved → separate supplier screening CLEARED → suspended → reinstatement v3 → exact RFQ/PO pin → single-use UNCLASSIFIED portal acceptance → pending receipt authority.
Before you begin
- Supplier legal/commercial identity and at least one location and named contact are known
- Receiving site plus item/category/service scope exists
- At least one CLEAN controlled evidence version is available
- Buyer, Procurement Manager and Supplier Quality Engineer are separate users; Security is separate when required
- A Security & Compliance Officer is available to record the independently governed restricted-party screening
- Portal use requires an UNCLASSIFIED released PO and an exact COMMERCIAL contact in the pinned lifecycle version
Supplier authority and collaboration boundaries
Legal/trading identity, supplier type, country, CAGE/registration, validity, tolerance, locations, contacts, scopes and evidence are snapshotted and fingerprinted. Rejection, amendment or reinstatement creates another version rather than rewriting history.
Supplier locations identify the external organisation's facilities. Qualification receiving sites are internal Moduvio sites where the approved capability may be used; they are intentionally separate.
Each approval names one receiving site plus ALL catalogue items, one category, one exact item or one service code. RFQ and PO use must match every sourced item at that receiving site.
The Buyer author submits; a different Procurement Manager decides commercial identity; a different Supplier Quality Engineer decides capability; a different Security officer decides only when required. No reviewer may reuse an earlier authority.
This is separate from the optional lifecycle Security review. The supplier card publishes the latest server-derived state—Not recorded, Cleared, Expired or Rejected—and sends an authorised Security & Compliance Officer to Party screening with that supplier preselected. A current CLEARED supplier decision is required before receipt creation; the later physical receipt still needs its own screening before quarantine submission.
Current date must fall inside the approved version. Suspension immediately blocks sourcing/acknowledgement; offboarding additionally requires no open sourcing or PO commitment. Reinstatement is a fully reviewed immutable version.
RFQ invitation stores the approved lifecycle version. Issue, quotation, award, PO creation and acknowledgement recheck that exact version and scope. A later reinstatement does not silently repair a stale RFQ.
Only an explicitly UNCLASSIFIED released PO package can be issued, for at most 30 days, to the exact versioned COMMERCIAL email. Access and response sessions are single-use and stored only as SHA-256 hashes; no internal evaluation, evidence or navigation is exposed.
The representative name, role, controlled email, supplier reference, decision and note are attributable. ACCEPTED creates only a PENDING_APPROVAL receipt authority; CHANGE_REQUESTED or REJECTED changes the commercial PO state but never creates custody or accounting.
Supply owns lifecycle and commercial commitment; Quality owns SCAR/audit/scorecard facts; Security/Governance owns screening/access; Inventory owns ASN/receipt/inspection/custody; Project/Contract approves inbound authority; Finance/AP remains future scope.
Procedure
- 1
Create a supplier lifecycle draft with identity, locations, named contacts, exact receiving-site scopes and CLEAN evidence.
- 2
Submit as its Buyer author; perform Procurement, Quality and optional lifecycle Security decisions as separate named users.
- 3
On the approved supplier card, inspect the screening badge and next owner. As Security & Compliance Officer, choose Record screening, confirm Screening target = Vendor onboarding / validity and the preselected Vendor, then enter Controlled source reference, Decision and Valid until before recording the immutable checklist.
- 4
Return to Supplier management and confirm the server-owned screening state changed to CLEARED. Do not treat the earlier lifecycle Security review as this clearance.
- 5
Inspect the approved current version and its fingerprint/history, then use it in a competitive RFQ and released PO.
- 6
Prove a suspension blocks use and a fully reviewed reinstatement creates a new current version without changing the old sourcing pin.
- 7
Issue a single-use PO portal only for an UNCLASSIFIED released order and exact Commercial contact; transfer the shown-once link through an approved channel because Moduvio does not send it.
- 8
Record one attributable supplier response and have a separate Project / Contract Manager decide the pending receipt authority if accepted.
- 9
As Auditor, reconcile versions, reviews, screening evidence, suspension events, portal hashes, audit/outbox records and unchanged custody/accounting witnesses.
Expected result
- Rejected, superseded and current versions remain immutable and readable
- Every activation has ordered separate Procurement, Quality and required lifecycle Security decisions
- Lifecycle Security review never substitutes for current restricted-party clearance
- Supplier cards show Not recorded, Cleared, Expired or Rejected plus a permission-aware next step
- AVL eligibility is date-, receiving-site- and item/category/service-specific
- Suspension blocks procurement use and reinstatement never mutates a stale RFQ
- Portal links and response sessions are single-use with no plaintext credential storage
- Portal package is UNCLASSIFIED and exposes no tenant navigation or internal evaluation
- External representative is attributable to the exact versioned Commercial email
- Accepted response creates only a pending receipt authority
- No supplier lifecycle or collaboration step creates stock, ledger, notification delivery, invoice or payment; restricted-party screening has the same zero-transaction boundary
- Auditor can read the full history without transition authority