Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot)

[os-zhuang]

Successor to #2696 (ADR-0090 tracking — now fully delivered and closed). This issue carries the six named follow-up ADRs that ADR-0090 §"Non-goals and named follow-ups" acknowledged and deliberately scoped out of the v2 launch window. None of them changes the v2 breaking surface; each has a workable substitute today.

Convention: per the repo's ADR discipline, the ADR for each item is opened when the work actually starts — this issue is the parking lot, not a commitment to write six documents up front.

The six follow-ups

• 1. Grant lifecycle & recertification — time-boxed assignments (valid_from/valid_until), delegation-of-duty during absence, break-glass elevation with auto-expiry, periodic access-review campaigns (SOX/等保). Also the substrate for task-scoped, time-boxed AI-agent grants (D10) — the agent story is a second trigger for this one.
  Today's substitute: permanent grants + manual review.
  → Delivered (community scope): ADR-0091 Accepted (docs(adr): ADR-0091 (Proposed) — grant lifecycle: effective-dated assignments, delegation, break-glass, recertification substrate #2751 proposed, docs(adr): ADR-0091 accepted — grant lifecycle decisions confirmed; D3 gains the no-self-renewal rule #2764 accepted). L1 validity windows + resolution-time filtering merged (feat(security): ADR-0091 L1 — grant validity windows with resolution-time filtering #2795); L2 delegation-of-duty merged (feat(security): ADR-0091 L2 — delegation of duty (职务代理) #2810). Break-glass community shape (time-boxed, reasoned direct grant) is in L1; break-glass activation workflow + recertification campaigns are ADR-0091 L3 (enterprise, cloud-side) — not tracked here.
• 2. Segregation of Duties (SoD) — declarative conflict rules between permission sets ("vendor-create must not combine with payment-approve"), checked at assignment time, with an audit report. Joins the D7 lint family.
  Today's substitute: org process / manual audit.
• 3. Scale & reorg hardening — membership-set materialization/caching, asynchronous share recalculation, batched BU-subtree moves. Hard gate: 100k-user × 10M-record benchmark — without it, D6 explain/matrix don't hold at enterprise scale. The most engineering-debt-like of the six.
  Today's substitute: per-request resolution, fine at current tenant sizes.
  Note: the benchmark's stated blocker (unbounded telemetry, ADR-0057 lifecycle P1–P4, ADR-0057 data lifecycle P1–P4: retention contract, rotation, separation, governance (tracking) #2786) closed completed 2026-07-11 — no hard precondition remains.
• 4. ERP dimension restrictions — declarative "rows where field ∈ my values" (Frappe User-Permissions shape) as first-class metadata; admin picks dimension values in the UI, platform compiles the row filter.
  Today's substitute: hand-written RLS/CEL.
• 5. ALM / environment promotion — export/import + semantic diff of positions/bindings across dev→test→prod, reusing the D6 access-matrix as the diff layer (two environment snapshots subtracted = promotion pre-flight report).
  Today's substitute: manual reconfiguration per environment.
• 6. Portal identity & licensing — the product track that activates D11 (externalSharingModel) at scale: external registration/auth (separate identity pool vs invite), external-seat licensing/metering. Mechanism is fully shipped (spec shape, runtime enforcement, Studio dial); this is the productization decision.
  Today's substitute: D11 mechanism usable ad hoc; no external identity product.
  Note: the kernel-chain posture ladder (tracking(authz): 双轨赛道下的授权改进开发任务 v2（内核链 ADR 待编号 + 补齐轨 + 地基） #2920 B2, ADR-0095 D2) reserves an EXTERNAL rung with locked semantics; item 6 itself has not started.

Suggested priority (non-binding)

#3 (hard benchmark gate) and #1 (compliance + the D10 agent-grant substrate) are the likeliest first pulls; #6 activates whenever the portal product track starts. #2/#4/#5 are demand-driven.
2026-07-15: #1 pulled and delivered (community scope, see above). #3's precondition is now clear.

References

• ADR-0090: docs/adr/0090-permission-model-v2-concept-convergence.md §"Non-goals and named follow-ups"
• ADR-0091 (item 1): docs/adr/0091-grant-lifecycle-and-recertification.md — Accepted 2026-07-10
• Predecessor tracking issue: ADR-0090: Permission Model v2 — concept convergence, final naming, AI-authoring safety (tracking) #2696 (all platform + UI deliverables shipped; see closing comment there for the final delivery map)

🤖 Generated with Claude Code

[os-zhuang]

关联 follow-up：#2918（内置行写护栏 — sys_position / sys_capability 平台/应用托管行可被删改）属于 Permission Model v2 的 enforcement 尾巴——provenance 字段（managed_by/package_id）已存在但无写保护，对应 ADR-0049「不引入未强制的安全属性」。与 #2909（两存储类型审计）同域。

[os-zhuang]

汇总 tracking：#2920（双轨赛道下的授权改进开发任务）—— 内核链 ADR-0094（B1→B5 串行）+ 补齐轨（层级 RLS 企业包 GA / 记录级 debugger）+ 地基（用户页分配入口 / 来源三态 / capability 声明链）。已拆出的独立项 #2917 #2918 不在其中。

[os-zhuang]

2026-07-15 完成度核实(逐项对照 ADR/PR/代码,正文已同步更新):

第 1 项已勾选 — Grant lifecycle & recertification,社区侧交付完毕

• ADR-0091 docs/adr/0091-grant-lifecycle-and-recertification.md 已 Accepted(docs(adr): ADR-0091 (Proposed) — grant lifecycle: effective-dated assignments, delegation, break-glass, recertification substrate #2751 提案 → docs(adr): ADR-0091 accepted — grant lifecycle decisions confirmed; D3 gains the no-self-renewal rule #2764 接受,2026-07-10),含 D1–D7 七项决策。
• L1(spec + 解析时过滤)已合并 — feat(security): ADR-0091 L1 — grant validity windows with resolution-time filtering #2795:valid_from/valid_until 上 sys_user_position / sys_user_permission_set;过期行在 resolveAuthzContext / explain buildContextForUser / sharing expandPositionUsers 中 fail-closed 停止解析;explain 增 state: 'expired';lint 规则 security-grant-expired-at-authoring、security-delegation-missing-reason。
• L2(职务代理)已合并 — feat(security): ADR-0091 L2 — delegation of duty (职务代理) #2810:PositionSchema.delegatable;D12 门自助代理分支(时限 + 必填理由 + 双向审计 + 30 天上限 + 禁止自我代理 adminScope 岗位);explain "via delegation from X, until Y";liveness proof delegation-of-duty。
• 不计入本项的余量:break-glass 激活工作流、复核 campaign/通知属 ADR-0091 L3 企业侧(cloud 仓库产品),社区侧只承诺基底(已交付)。按 ADR 自身分层,本项在 framework 范围内完成。

第 2–6 项均未启动(符合本 issue 约定)

对五个主题做了 issue / PR / ADR 三方搜索,无专属 ADR 或工作项。ADR-0092–0095 编号紧随但主题不同(profile 字段代理 / 租户模式 / permission-set 纯投影 / 内核租户层),属 #2920 双轨改进线,不计入本停车场。两个状态更新已注入正文:

• 第 3 项前置已清除:ADR-0057 data lifecycle P1–P4: retention contract, rotation, separation, governance (tracking) #2786(ADR-0057 生命周期 P1–P4)已于 07-11 关闭 completed,「无界遥测导致基准跑不动」的硬阻塞不存在了。按原正文优先级建议,Implement ObjectStack protocol specification with Zod schemas and TypeScript interfaces #3 现在是最顺手的下一拉项。
• 第 6 项有前兆但未启动:ADR-0095 D2 / tracking(authz): 双轨赛道下的授权改进开发任务 v2（内核链 ADR 待编号 + 补齐轨 + 地基） #2920 B2 的 posture 阶梯预留了 EXTERNAL 档位并锁定语义(仅显式共享、永不 OWD),实现明确等 portal 主体类型出现后另立 issue。

本 issue 保持 open,继续作为 2–6 项的停车场。

---

Generated by Claude Code