docs: RBAC grant model contract (S2 contract 2)

Conversation 1 Commits 2 Files Changed 1

+259

2 Commits

Author	SHA1	Message	Date
fred	501112d2a4	docs: RBAC grant model contract revision 2 (GLM review findings 1-10) ci/woodpecker/pr/ci Pipeline was successful Details - name the two shipped platform-admin bypass paths (command-authorization hasScope short-circuit, MCP tenant-admin scope derivation) as non-conformant; 7.4 retires them explicitly - suspend team grant subjects pending a team contract; command surface refuses team-subject grants; evaluation semantics pre-specified - no-self-escalation restated with future-decoupling rationale; observable is an audit invariant, not an unconstructible refusal test - bootstrap seeding scoped to top-level company creation; child nodes inherit via down-the-chain, resolving the 7.7/4.3 contradiction - exact A1 quote (not a bypass of workspace authorization) - subject/role audit fields attributed as this contract's addition - principal-position consequence named (1.3) with matrix cell - added observables: zero membership rows, fail-closed fault injection, no existence oracle - role-string namespacing rule (4.5) - ruling request names the PRD-admins interpretive resolution	2026-08-26 18:33:08 -05:00
fred	3538d33106	docs: RBAC grant model contract (S2 contract 2) ci/woodpecker/pr/ci Pipeline is pending Details Defines the hierarchy grant vocabulary (viewer\|member\|owner, totally ordered), evaluation semantics (deny-by-default, down-the-chain, max rule, live fail-closed evaluation), grant management (owner-managed, no self-escalation, explicit bootstrap of authority), transfer authority (both-sides owner, completing contract 1 §4.2), and revocation propagation with the same 30s/next-message bound as identity §7.1. Embedded decision for ratification: platform admin confers no implicit tenant access (§1.1). Sources: PRD Part I §4, native-kanban SOT Amendment A1 §8.1.3/§8.3, hierarchy-schema contract (PR #1435), identity-lifecycle contract §1.4 (PR #1433).	2026-08-26 18:23:23 -05:00

Author

SHA1

Message

Date

fred

501112d2a4

docs: RBAC grant model contract revision 2 (GLM review findings 1-10)

ci/woodpecker/pr/ci Pipeline was successful

Details

- name the two shipped platform-admin bypass paths (command-authorization
  hasScope short-circuit, MCP tenant-admin scope derivation) as
  non-conformant; 7.4 retires them explicitly
- suspend team grant subjects pending a team contract; command surface
  refuses team-subject grants; evaluation semantics pre-specified
- no-self-escalation restated with future-decoupling rationale; observable
  is an audit invariant, not an unconstructible refusal test
- bootstrap seeding scoped to top-level company creation; child nodes
  inherit via down-the-chain, resolving the 7.7/4.3 contradiction
- exact A1 quote (not a bypass of workspace authorization)
- subject/role audit fields attributed as this contract's addition
- principal-position consequence named (1.3) with matrix cell
- added observables: zero membership rows, fail-closed fault injection,
  no existence oracle
- role-string namespacing rule (4.5)
- ruling request names the PRD-admins interpretive resolution

2026-08-26 18:33:08 -05:00

fred

3538d33106

docs: RBAC grant model contract (S2 contract 2)

ci/woodpecker/pr/ci Pipeline is pending

Details

Defines the hierarchy grant vocabulary (viewer|member|owner, totally
ordered), evaluation semantics (deny-by-default, down-the-chain, max rule,
live fail-closed evaluation), grant management (owner-managed, no
self-escalation, explicit bootstrap of authority), transfer authority
(both-sides owner, completing contract 1 §4.2), and revocation propagation
with the same 30s/next-message bound as identity §7.1.

Embedded decision for ratification: platform admin confers no implicit
tenant access (§1.1).

Sources: PRD Part I §4, native-kanban SOT Amendment A1 §8.1.3/§8.3,
hierarchy-schema contract (PR #1435), identity-lifecycle contract §1.4
(PR #1433).

2026-08-26 18:23:23 -05:00

docs: RBAC grant model contract (S2 contract 2) #1436