docs(adr): ADR-0090 — Permission Model v2: concept convergence, final naming, AI-authoring safety#2695
Draft
os-zhuang wants to merge 1 commit into
Draft
docs(adr): ADR-0090 — Permission Model v2: concept convergence, final naming, AI-authoring safety#2695os-zhuang wants to merge 1 commit into
os-zhuang wants to merge 1 commit into
Conversation
…naming, AI-authoring safety Records the eight decisions converging the authorization model ahead of launch: OWD defaults to private for custom objects (D1), the Profile concept is removed (D2), sys_role and friends are renamed to position with "role" as a lint-enforced forbidden word (D3), the OWD enum drops its legacy aliases (D4), a built-in `everyone` position carries default grants (D5), an explain engine plus access-matrix snapshot gate is promoted to P0 (D6), security-domain publishes get a linter and tiered human gates (D7), and teams are confirmed as sharing recipients that never carry capability (D8). Ships with the companion reference docs/design/permission-model.md — the maintained source of truth for the decided model (concepts, evaluation pipeline, CRM worked example, AI-safety layers, glossary). Supersedes ADR-0056 D7 (default-profile fallback) and ADR-0057 D5/D7 alias clauses (pre-launch one-step renames, no compatibility layers). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two documents, deciding and describing the converged permission model ahead of launch:
docs/adr/0090-permission-model-v2-concept-convergence.md— the decision record (Status: Proposed). Eight decisions:private; the unset state ceases to exist (existing metadata grandfathered by explicit stamping, no silent behavior change)isProfiledeleted fromPermissionSetSchema);isDefaultnarrows to an install-time package suggestionsys_role/sys_user_role/sys_role_permission_set/ctx.roles[]/current_user.rolerenamed toposition; "role" becomes a lint-enforced reserved-forbidden word (single exception: better-auth'ssys_member.role, already projected asorg_membership_level)read/read_write/fullaliases; authoring rejects, no lenient parseeveryoneposition carries default grants: packages suggest, admins confirm, resolution is per-request (abolishes the fallback cliff; no second distribution channel)docs/design/permission-model.md— the companion complete reference for the decided model: the five concepts, the evaluation pipeline, OWD semantics, a worked CRM-package example (developer story + admin story), theeveryonebaseline, the AI-safety layers, a "if you come from Salesforce/Dataverse/ServiceNow/SAP/AWS" mapping table, and the glossary/naming rules.Why
Three forcing facts, argued in the ADR's Context: the pre-launch window is the only zero-cost moment for breaking renames (hence no aliases — explicitly superseding ADR-0057 D5/D7's alias clauses); the metadata is AI-authored, so vocabulary size is attack surface; and a dogfood incident (objectstack-ai/objectui#2348) proved the current "unset OWD = fully public" default silently inverts the admin's mental model into org-wide read/write.
Relationship to existing ADRs
Builds on 0049 / 0056 / 0057 / 0066 / 0086. Amends: ADR-0056 D7 (default-profile fallback → replaced by the
everyoneposition), ADR-0057 D5/D7 (deprecated-alias discipline → superseded pre-launch). ADR-0057's core (BU tree, scope depth,sys_user_roledecoupling) is untouched and load-bearing.What this PR does NOT do
Docs only — no spec, plugin, or runtime changes. Implementation is phased in the ADR (P1 breaking wave → P2 everyone-position → P3 linter/gates → P4 explain/matrix), each phase with its own proofs per ADR-0054 discipline.
🤖 Generated with Claude Code
https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
Generated by Claude Code