register-referentie/docs/architecture/adr-0003-default-fill.md

ADR-0003: ACL default-fill strategy

• Status: Accepted
• Date: 2026-06-04
• Deciders: Respellion engineering
• Relates to: S-04 (#5); builds on ADR-0001 (loose coupling)

Context

The ACL is the only code that talks to ZGW APIs (ADR-0001 / CLAUDE.md §8.1). When the domain asks it to "open a zaak", the domain payload is intentionally free of ZGW specifics — it carries domain facts (e.g. the registrant's BSN), not OpenZaak fields. But OpenZaak's POST /zaken requires ZGW-mandatory fields: bronorganisatie, verantwoordelijkeOrganisatie, startdatum, vertrouwelijkheidaanduiding, and a zaaktype URL. Something has to supply those, and it must not leak into the domain.

Decision

The ACL default-fills the ZGW-mandatory zaak fields; the domain never sees them.

• bronorganisatie, verantwoordelijkeOrganisatie, vertrouwelijkheidaanduiding, and the zaaktype URL come from ACL configuration (AclDefaults options) — not hardcoded, not from the domain. This keeps them operationally manageable (the beheer portal will edit them in S-15) and environment-specific (the seeded BIG zaaktype URL differs per env).
• startdatum is derived from an injected clock (today's date), so it is deterministic in tests.
• The mapping from domain payload → ZGW ZaakRequest lives entirely inside the ACL (Application builds the request from payload + defaults; Infrastructure serialises and POSTs it). No other service constructs ZGW payloads or URLs.

Consequences

• Positive: the domain stays ZGW-agnostic; ZGW knowledge is in one named place; defaults are config (testable, env-specific, later editable via the beheer portal).
• Cost: the ACL must be configured per environment (the seeded zaaktype URL, the organisation RSINs). Missing/invalid config fails fast at the ACL boundary.
• Follow-ups: mapping the BSN onto the zaak (eigenschap/rol), status transitions, and documents are explicitly out of scope for S-04 and get their own slices.

Alternatives considered

• Defaults in the domain payload — rejected: leaks ZGW concerns into the domain, violating ADR-0001.
• Hardcoded defaults in code — rejected: not env-specific, not operationally editable.