hyb-oa/.trellis/spec/hyb-oa/wecom-boundary.md

Enterprise WeChat Boundary

Ownership

Enterprise WeChat owns mature HR/attendance actions: check-in, leave, missed punch, outing, overtime and related mobile entry. OA owns reimbursement, procurement, contracts, projects, payments, invoices, sensitive attachments and operating audit.

Rules

• Enterprise WeChat API checks that need trusted IP must run from the deployment server, not local.
• Do not write Enterprise WeChat, create templates, create approvals, expand real users, or enable live trials without explicit approval and a Trellis task.
• Approval-rule configuration cannot be fully read through official APIs; keep manual backend/real-device gates where specified.
• Messages to Enterprise WeChat must be dehydrated and link back to OA; do not send sensitive attachments or business documents into native WeCom approvals.