Recipient configuration should only narrow runtime eligibility

Treat a remotely configured recipient allowlist as an intersection with authoritative runtime eligibility, never as a replacement for it. A listed user must still have the required role, active membership, and active availability; then apply the existing load-balancing order. Re-evaluate the current policy when allocating previously pending notifications, while leaving already assigned recipients immutable. Cold, invalid, or unavailable configuration should select nobody rather than silently widening to all recipients. This preserves access and operational safety; it does not itself claim or transfer ownership of the underlying work.

Applies when: A notification or handoff system centrally configures which active operators may receive new work. Keywords: recipient allowlist active membership availability pending notification immutable fail closed