Problem
A sys_permission_set has two representations that are not kept in sync:
- Metadata — what
client.layered('permission', name) / client.save read/write; the authoritative permission definition (ADR-0090). The structured permission editor writes this. Parsed camelCase fields: objects, fields, systemPermissions, rowLevelSecurity, tabPermissions, adminScope.
- Data record — the queryable
sys_permission_set object (GET /api/v1/data/sys_permission_set), with snake_case JSON-string columns: system_permissions, object_permissions, row_level_security, admin_scope, tab_permissions.
An environment-scope metadata save (which is live — config, no publish) does not project onto the data record.
Repro (verified against app-showcase, 2026-07-13)
- Open the env-scope permission editor for
sales_rep and grant studio.access (System Capabilities), Save.
- Reload the editor → the grant persists (metadata is updated). ✅
GET /api/v1/data/sys_permission_set → sales_rep.system_permissions is still "[]". ❌
Same for adminScope (e.g. toggling manageBindings on showcase_field_ops_delegate persisted in metadata but not in the data record). Seeded sets look consistent only because both stores were seeded together.
Why it matters
objectui ADR-0056 / #2403 (pure model: Studio designs, Setup assigns) makes Setup's sys_permission_set record page render each facet read-only from the data record (summary + "Design in Studio →" deep-link). Because env-scope metadata saves don't refresh the data record, a fresh Studio edit to any facet isn't reflected in Setup's summary until the projection catches up.
This is display-freshness only — enforcement and the ADR-0090 explain engine read the authoritative metadata, so access is correct. But it breaks the closed loop of the pure model (design in Studio → see it in Setup).
Ask
Make the sys_permission_set data-record projection track env-scope metadata saves (project all six facet columns), so the queryable record reflects the authoritative metadata. (Alternatively, objectui could read the metadata directly for the Setup summary, but the record projection is the framework-owned bridge.)
Refs
Filed from objectui #2403 verification.
Problem
A
sys_permission_sethas two representations that are not kept in sync:client.layered('permission', name)/client.saveread/write; the authoritative permission definition (ADR-0090). The structured permission editor writes this. Parsed camelCase fields:objects,fields,systemPermissions,rowLevelSecurity,tabPermissions,adminScope.sys_permission_setobject (GET /api/v1/data/sys_permission_set), with snake_case JSON-string columns:system_permissions,object_permissions,row_level_security,admin_scope,tab_permissions.An environment-scope metadata save (which is live — config, no publish) does not project onto the data record.
Repro (verified against app-showcase, 2026-07-13)
sales_repand grantstudio.access(System Capabilities), Save.GET /api/v1/data/sys_permission_set→sales_rep.system_permissionsis still"[]". ❌Same for
adminScope(e.g. togglingmanageBindingsonshowcase_field_ops_delegatepersisted in metadata but not in the data record). Seeded sets look consistent only because both stores were seeded together.Why it matters
objectui ADR-0056 / #2403 (pure model: Studio designs, Setup assigns) makes Setup's
sys_permission_setrecord page render each facet read-only from the data record (summary + "Design in Studio →" deep-link). Because env-scope metadata saves don't refresh the data record, a fresh Studio edit to any facet isn't reflected in Setup's summary until the projection catches up.This is display-freshness only — enforcement and the ADR-0090 explain engine read the authoritative metadata, so access is correct. But it breaks the closed loop of the pure model (design in Studio → see it in Setup).
Ask
Make the
sys_permission_setdata-record projection track env-scope metadata saves (project all six facet columns), so the queryable record reflects the authoritative metadata. (Alternatively, objectui could read the metadata directly for the Setup summary, but the record projection is the framework-owned bridge.)Refs
plugin-security—sys-permission-set.object.ts(the JSON-string columns), the metadatapermissiontype →sys_permission_setprojection path.Filed from objectui #2403 verification.