Skip to content

docs(approvals): drop duplicate role-vs-position callout (unbreak role-word ratchet) #3122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
os-zhuang wants to merge 1 commit into from
Closed

docs(approvals): drop duplicate role-vs-position callout (unbreak role-word ratchet) #3122

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 4 additions & 11 deletions content/docs/automation/approvals.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,10 +54,10 @@ defineFlow({

<Callout type="warn">
**`position` vs `role`.** `{ type: 'position', value: 'finance_manager' }` routes to the
holders of a position (`sys_user_position`, ADR-0090 D3). The `role` approver type is the
better-auth **org-membership tier** (`sys_member.role`: `owner`/`admin`/`member`) — a position
name authored as `type: 'role'` matches nobody and the request stalls; `os lint` flags this
(`approval-role-not-membership-tier`).
holders of a position (`sys_user_position`, ADR-0090 D3). `type: 'role'` is a different thing
entirely — the better-auth **org-membership tier** (`sys_member.role`: `owner`/`admin`/`member`)
— so a business position name authored there matches nobody and the request stalls; `os lint`
flags this (`approval-role-not-membership-tier`).
</Callout>

Approving is itself a gated action — model "may approve" as a capability (`approve_invoice`) the approver's permission set grants, and gate the approve action's `requiredPermissions` on it so the gate is enforced on **both** the UI and the server (ADR-0066 D4).
Expand Down Expand Up @@ -132,13 +132,6 @@ and the flow run parks until a decision arrives.
Only `approvers` is required on the node; everything else has a default
(`behavior: 'first_response'`, `lockRecord: true`, `maxRevisions: 3`).

<Callout type="warn">
**`type: 'role'` is not a position.** In an approver entry, `role` means the
better-auth membership tier (`owner` / `admin` / `member`). Naming a business
role like `sales_manager` there matches nobody and the request silently has no
approvers — use `{ type: 'position', value: 'sales_manager' }`.
</Callout>

### The approver finds it in their queue

Requests land in **Setup → Approvals → Requests**, whose `my_pending` view
Expand Down