permission.json

{
  "type": "permission",
  "_note": "PermissionSetSchema (the `profile` alias and isProfile flag were removed by ADR-0090 D2). Seeded from docs/audits/2026-06-security-identity-property-liveness.md. CRUD/FLS/RLS enforced via plugin-security. allowTransfer/Restore/Purge are RBAC-mapped in the evaluator (#1883) — deny unless granted; the ObjectQL operations themselves are pending M2.",
  "props": {
    "name": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts",
      "note": "registration/assignment key."
    },
    "label": {
      "status": "live",
      "note": "display metadata."
    },
    "packageId": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/bootstrap-declared-permissions.ts (author-declared fallback for the registry `_packageId` provenance; persisted to sys_permission_set.package_id)",
      "note": "ADR-0086 D3 — owning package for a package-shipped set; proven by packages/qa/dogfood/test/showcase-permission-seeding.dogfood.test.ts."
    },
    "managedBy": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/bootstrap-declared-permissions.ts (persisted per record as sys_permission_set.managed_by; 'package' rows re-seeded, platform/user rows never clobbered)",
      "note": "ADR-0086 D3 — per-record provenance on the metadata-persistence axis (package | platform | user)."
    },
    "adminScope": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/delegated-admin-gate.ts — non-tenant-admin writes to sys_user_position / sys_position_permission_set / sys_user_permission_set / sys_permission_set require a covering adminScope (BU-subtree boundary + assignable-set allowlist + strict-containment for scope grants).",
      "note": "ADR-0090 D12 — delegated administration; proven by packages/plugins/plugin-security/src/delegated-admin-gate.test.ts."
    },
    "isDefault": {
      "status": "live",
      "evidence": "plugin-security: packages/plugins/plugin-security/src/security-plugin.ts (constructor) — when no explicit fallbackPermissionSet is configured, the SecurityPlugin resolves the fallback from the permission set marked isDefault:true (ADR-0056 D7).",
      "note": "LIVE — app-declared default profile; proven by packages/qa/dogfood/test/showcase-default-profile.dogfood.test.ts."
    },
    "objects": {
      "children": {
        "allowCreate": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8"
        },
        "allowRead": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8"
        },
        "allowEdit": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8"
        },
        "allowDelete": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:8"
        },
        "allowExport": {
          "status": "live",
          "evidence": "packages/plugins/plugin-hono-server/src/hono-plugin.ts (annotateEffectiveApiOperations: userExportAllowed = allowExport !== false) + packages/spec/src/data/api-derivation.ts (export derives from list ∧ userExportAllowed)",
          "note": "#3544 — user-level export axis over read. Enforced end-to-end: the bit drives userExportAllowed, which removes `export` from the object's effective apiOperations on /me/permissions; the frontend hides Export and the REST export gate 405s. Optional/no-default = backward-compatible opt-out (unset inherits read); `false` denies export while keeping read."
        },
        "allowTransfer": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts (OPERATION_TO_PERMISSION transfer→allowTransfer + modifyAllRecords bypass)",
          "note": "#1883 — RBAC gate pre-mapped, deny unless granted; the `transfer` ObjectQL operation is pending M2, so granting delivers nothing until it ships."
        },
        "allowRestore": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts (OPERATION_TO_PERMISSION restore→allowRestore + modifyAllRecords bypass)",
          "note": "#1883 — RBAC gate pre-mapped, deny unless granted; the `restore` ObjectQL operation is pending M2."
        },
        "allowPurge": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts (OPERATION_TO_PERMISSION purge→allowPurge + modifyAllRecords bypass)",
          "note": "#1883 — RBAC gate pre-mapped, deny unless granted; the `purge` ObjectQL operation is pending M2."
        },
        "viewAllRecords": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:64"
        },
        "modifyAllRecords": {
          "status": "live",
          "proof": "packages/qa/dogfood/test/owner-anchor-and-bulk-writes.dogfood.test.ts#owner-anchor-and-bulk-writes",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts:60"
        },
        "readScope": {
          "status": "live",
          "proof": "packages/qa/dogfood/test/showcase-scope-depth.dogfood.test.ts#showcase-scope-depth",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts (getEffectiveScope) + packages/plugins/plugin-sharing/src/sharing-service.ts (owner-match widened by readScope; hierarchy values delegated to IHierarchyScopeResolver)",
          "note": "ADR-0057 D1 — read access DEPTH (own/own_and_reports/unit/unit_and_below/org). own/org enforced in open edition; hierarchy values via the enterprise hierarchy-scope-resolver (fail-closed to owner-only when absent; defineStack requires 'hierarchy-security'). Proven: packages/qa/dogfood/test/showcase-scope-depth.dogfood.test.ts."
        },
        "writeScope": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts (getEffectiveScope) + packages/plugins/plugin-sharing/src/sharing-service.ts (canEdit owner-set widened by writeScope; hierarchy values delegated)",
          "note": "ADR-0057 D1 — write access DEPTH (same enum as readScope)."
        }
      }
    },
    "fields": {
      "children": {
        "readable": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts",
          "note": "FLS read-mask."
        },
        "editable": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts",
          "note": "FLS write-deny."
        }
      }
    },
    "systemPermissions": {
      "status": "live",
      "evidence": "packages/plugins/plugin-hono-server/src/hono-plugin.ts",
      "note": "PARTIAL — app-entry/nav visibility only, not a general capability gate."
    },
    "tabPermissions": {
      "status": "live",
      "note": "PARTIAL — only 'hidden' is read."
    },
    "rowLevelSecurity": {
      "children": {
        "name": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts"
        },
        "label": {
          "status": "live",
          "note": "display."
        },
        "description": {
          "status": "live",
          "note": "display."
        },
        "object": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts"
        },
        "operation": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts"
        },
        "using": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts",
          "proof": "packages/qa/dogfood/test/rls-fixture.dogfood.test.ts#rls-by-id-write",
          "note": "compiled into find + analytics SQL. ADR-0054 high-risk class (RLS): the proof boots an owner-isolated fixture so a fresh member cannot read an admin-created row, then asserts the runner's verdict in both directions — `rls-consistent` when the owner predicate also gates the by-id write (#1994 pre-image check) and `rls-hole` when it doesn't. Guards read AND by-id-write enforcement, not just the read predicate."
        },
        "check": {
          "status": "live",
          "proof": "packages/qa/dogfood/test/showcase-d3-d4-capabilities.dogfood.test.ts#showcase-d3-d4-capabilities",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts"
        },
        "positions": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts",
          "note": "flat match — no subordinate rollup (ADR-0090 D3 rename)."
        },
        "enabled": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts"
        },
        "priority": {
          "status": "live",
          "evidence": "packages/plugins/plugin-security/src/rls-compiler.ts",
          "note": "ordering."
        },
        "tags": {
          "status": "live",
          "note": "organizational."
        }
      }
    }
  }
}