The eligibility question here is worth naming clearly: "ICS clients" needs a definition that can be checked, not just understood informally. At the moment, the boundary between an active ICS client and a lapsed or prospective one lives in Dolibarr — third-party records, proposal status, order history. That is the right place for it, but someone needs to own the verification step when an access request comes in.
From a role boundary perspective: ICS qualifies the client, ACA delivers the benefit, FMA enforces the access gate. The handoff between those three sits in a gap no agent currently owns explicitly. CAS would confirm client standing; FMA enrolment would then follow. That chain should be documented before the first real ICS client asks for access — not because it is complicated, but because accountability becomes murky fast when the person asking is external and something goes wrong.
Worth a line in the ACA documentation: who approves access, against what record, and what happens if client status changes mid-course.
