2026-05-04 Resource Access Meeting Notes

Date: May 4, 2026 

Recordings

NOTE: RESOURCE ACCESS SIG USES EITHER ZOOM’S AI NOTES FUNCTIONALITY OR GOOGLE GEMINI TO PROCESS THE TRANSCRIPT. If you would prefer that we do not use AI any session you attend, we are happy to! Please alert the convener at the start of the meeting.

Find all recordings here: https://recordings.openlibraryfoundation.org/folio/resource-access-sig/ (pw: folio-lsp)

Zoom

https://zoom.us/j/337279319 (pw: folio-lsp)

Attendees

@Jacob Dudley

@Susan Kimball

@Scott Peterson

@Charlotte Whitt

@Olga Kalachinskaya

@David Bottorff

@Stephanie Buck (Deactivated)

@Cornelia Awenius

@Erin Weller

@Tobi Hines

@Heather

@Martina Tumulla

@Joseph A Molloy

@Steve Strohl

@Jamie Jesanis

@Robert Heaton

@Kimie Kester

@Thomas Trutt

Discussion Items:

Meeting Notes

AI-Generated minutes (pardon any errors)

Based on the combined audio and chat transcripts from May 4, 2026, here is the summary and analysis of the Resource Access SIG meeting.

📄 Meeting Minutes: The meeting, facilitated by Susan Kimball, addressed critical technical and policy issues within the FOLIO ecosystem. The primary focus was on addressing a newly discovered security risk regarding failed patron email notices and refining the design and logic for upcoming SMS messaging capabilities. The group also received updates on upcoming community events like Trillium Bugfest.

📄 Discussion Points:

• DCB Admin and "Aged to Lost" Status (00:01:51 – 00:02:35):

  • Katie Rahman asked whether the issue with Digital Communications Board (DCB) items failing to transition to "Aged to Lost" had been resolved.

  • Scott Peterson confirmed that a fix was implemented to ensure that borrowed items aging to loss would proceed through the standard billing cycle as expected.

• Announcements and Community Engagement (00:03:50 – 00:07:37):

  • Trillium Bugfest: Susan Kimball announced that Trillium Bugfest is scheduled to begin this Friday, the 8th, with a kickoff meeting on Wednesday at 9:00 AM.

  • Participation: Attendees were encouraged to participate in Bugfest to learn about upcoming features, test system stability, and help the community identify bugs before wider release.

  • Scheduling: The Fee/Fine subgroup meeting was confirmed for Thursday, May 7.

• PII Retention for Failed Email Patron Notices (00:07:37 – 00:23:13):

  • Discovery of Security Risk: Steph Buck revealed that while successful email notices are purged after 24 hours, FOLIO currently stores the full content of failed notices indefinitely in a database table.

  • Personally Identifiable Information (PII): These stored notices contain sensitive data, including patron email addresses and specific loan details, posing a privacy risk.

  • Retention Debate: David Bottorff suggested a 7-day retention period to allow for troubleshooting failures that occur over weekends or holidays. Cornelia Awenius noted that this data is sometimes used by local administrators to manually resend notices outside of FOLIO if a major system failure occurs.

  • Technical Context: Steph clarified that these logs are not currently accessible via the User Interface (UI) and require administrative permissions to view, yet they continue to grow in size.

• SMS Messaging Feature Design and Technical Requirements (00:24:00 – 01:02:46):

  • Plain Text Constraint: Steph reported that SMS messages must be sent in plain text (not HTML) to ensure compatibility across various service providers.

  • Character Limits and Truncation: A central debate focused on the 160-character limit for SMS. Susan Kimball emphasized the need for clear truncation rules for tokens like "Item Title," as a single long title could exhaust the character limit.

  • Handlebars Logic: Thomas Trutt suggested using Handlebars/Mustache templating syntax (e.g., using a "pipe" character to define length, such as {{title|35}}) to allow administrators to truncate token data directly within the notice template.

  • Notice Policy UI Consolidation: Thomas proposed a notice policy UI change: instead of having separate entries for email and SMS, both should be contained within a single "notice card." This would allow users to define different templates for different delivery channels (Email vs. Text message) within the same policy trigger.

  • Delivery Logic and Preferences: The group discussed whether SMS should be an "OR" choice (overriding email) or an "AND" choice (sending both). Jacob Dudley suggested that if a patron has a preference for SMS, the system should prioritize it, but certain "always send" notices might still require email delivery.

     

✅ Decisions Made:

• Retention Period for Failed Notices: The group reached a consensus to implement a default 7-day retention period for failed email patron notices. If it can be made configurable by institution, that would be ideal.

  • Rationale: This timeframe provides a sufficient window for technical staff to troubleshoot delivery issues (covering long weekends) while mitigating the long-term risk associated with storing PII.

📄 Action Items and Follow-up:

• SMS Feature Refinement: Steph Buck will continue refining the SMS "story" and technical requirements based on the feedback regarding plain text and truncation.

• Scheduling Follow-up: Steph Buck will return to discuss SMS design further, potentially on Thursday of the following week.

• Administrative Coordination: Katie Rahman will coordinate with Thomas Trutt and Steph Buck regarding scheduling for upcoming refined discussions.

• Bugfest Participation: All members are encouraged to join the kickoff for Trillium Bugfest on Wednesday morning.