docs(adr): ADR-0090 — Permission Model v2: concept convergence, final naming, AI-authoring safety (#2695)

* docs(adr): ADR-0090 permission model v2 — concept convergence, final naming, AI-authoring safety

Records the eight decisions converging the authorization model ahead of
launch: OWD defaults to private for custom objects (D1), the Profile
concept is removed (D2), sys_role and friends are renamed to position
with "role" as a lint-enforced forbidden word (D3), the OWD enum drops
its legacy aliases (D4), a built-in `everyone` position carries default
grants (D5), an explain engine plus access-matrix snapshot gate is
promoted to P0 (D6), security-domain publishes get a linter and tiered
human gates (D7), and teams are confirmed as sharing recipients that
never carry capability (D8).

Ships with the companion reference docs/design/permission-model.md —
the maintained source of truth for the decided model (concepts,
evaluation pipeline, CRM worked example, AI-safety layers, glossary).

Supersedes ADR-0056 D7 (default-profile fallback) and ADR-0057 D5/D7
alias clauses (pre-launch one-step renames, no compatibility layers).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H

* docs(adr): ADR-0090 grows D9-D12 — audience anchors, principal taxonomy, external OWD, delegated admin

Extends the proposed ADR with four decisions raised in review discussion:

D9  — audience anchors: builtin `guest` position joins `everyone`; packages
      suggest bindings, never ship shared builtin sets; deliberately no
      admin anchor (superuser wildcard already covers new packages).
D10 — principal taxonomy (kind: human|agent|service|guest|system,
      audience: internal|external, onBehalfOf). AI agents act on the
      INTERSECTION of their own grants and their delegator's, under a
      lint-enforced ceiling, with human co-sign for destructive ops.
D11 — external OWD dimension: optional `externalSharingModel`, default
      private, validated external <= internal; depth axis inapplicable
      to externals.
D12 — delegated administration: admin scopes (BU subtree + assignable-set
      allowlist + no self-escalation) so subsidiary admins run their own
      units without tenant-wide power.

Non-goals section restructured into deliberate non-goals + six named
follow-up ADRs (grant lifecycle/recertification, SoD, scale hardening,
dimension restrictions, ALM promotion, portal identity). Phasing updated:
P1 additionally lands the ctx principal shape and externalSharingModel
spec shape; P2 becomes both audience anchors; P3 adds delegated admin.

Companion design doc gains plain-language sections: "Who is calling"
(principal kinds, the agent overlap rule, guardrails), "Running a large
organization" (delegated admin worked example), external OWD dial, guest
position, and glossary entries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H

* docs(adr): mark ADR-0090 accepted (2026-07-09)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang