[finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153

Closed
Task
#245
Closed
[finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
Task
#245
Assignees
os-zhuang

Description

@os-zhuang
os-zhuang
opened on Aug 22, 2026

Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.

What is missing

After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:

  • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
  • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.

No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.

Why this is more than a missing gloss

The nearest anchor a reader (or an author adding a link) would reach for is wrong:

  • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.

Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:

It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.

The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.

configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.

Suggested shape (not a decision)

A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.

Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Task

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153
    Closed
    Task
    #245
    Closed
    [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
    Task
    #245
    Assignees
    os-zhuang
    Description
    @os-zhuang
    os-zhuang
    opened on Aug 22, 2026
    Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.
    What is missing
    After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:
    • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
    • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.
    No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.
    Why this is more than a missing gloss
    The nearest anchor a reader (or an author adding a link) would reach for is wrong:
    • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.
    Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:
    It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.
    The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.
    configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.
    Suggested shape (not a decision)
    A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.
    Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.
    Activity
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Metadata
    Metadata
    Assignees
    Labels
    No labels
    No labels
    Type
    Task
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153
      Closed
      Task
      #245
      Closed
      [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
      Task
      #245
      Assignees
      os-zhuang
      Description
      @os-zhuang
      os-zhuang
      opened on Aug 22, 2026
      Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.
      What is missing
      After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:
      • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
      • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.
      No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.
      Why this is more than a missing gloss
      The nearest anchor a reader (or an author adding a link) would reach for is wrong:
      • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.
      Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:
      It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.
      The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.
      configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.
      Suggested shape (not a decision)
      A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.
      Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.
      Activity
      Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
      Metadata
      Metadata
      Assignees
      Labels
      No labels
      No labels
      Type
      Task
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153
        Closed
        Task
        #245
        Closed
        [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
        Task
        #245
        Assignees
        os-zhuang
        Description
        @os-zhuang
        os-zhuang
        opened on Aug 22, 2026
        Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.
        What is missing
        After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:
        • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
        • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.
        No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.
        Why this is more than a missing gloss
        The nearest anchor a reader (or an author adding a link) would reach for is wrong:
        • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.
        Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:
        It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.
        The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.
        configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.
        Suggested shape (not a decision)
        A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.
        Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.
        Activity
        Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
        Metadata
        Metadata
        Assignees
        Labels
        No labels
        No labels
        Type
        Task
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153
          Closed
          Task
          #245
          Closed
          [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
          Task
          #245
          Assignees
          os-zhuang
          Description
          @os-zhuang
          os-zhuang
          opened on Aug 22, 2026
          Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.
          What is missing
          After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:
          • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
          • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.
          No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.
          Why this is more than a missing gloss
          The nearest anchor a reader (or an author adding a link) would reach for is wrong:
          • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.
          Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:
          It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.
          The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.
          configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.
          Suggested shape (not a decision)
          A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.
          Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.
          Activity
          Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
          Metadata
          Metadata
          Assignees
          Labels
          No labels
          No labels
          Type
          Task
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153
            Closed
            Task
            #245
            Closed
            [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
            Task
            #245
            Assignees
            os-zhuang
            Description
            @os-zhuang
            os-zhuang
            opened on Aug 22, 2026
            Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.
            What is missing
            After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:
            • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
            • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.
            No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.
            Why this is more than a missing gloss
            The nearest anchor a reader (or an author adding a link) would reach for is wrong:
            • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.
            Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:
            It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.
            The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.
            configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.
            Suggested shape (not a decision)
            A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.
            Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.
            Activity
            Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
            Metadata
            Metadata
            Assignees
            Labels
            No labels
            No labels
            Type
            Task
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153
              Closed
              Task
              #245
              Closed
              [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
              Task
              #245
              Assignees
              os-zhuang
              Description
              @os-zhuang
              os-zhuang
              opened on Aug 22, 2026
              Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.
              What is missing
              After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:
              • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
              • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.
              No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.
              Why this is more than a missing gloss
              The nearest anchor a reader (or an author adding a link) would reach for is wrong:
              • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.
              Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:
              It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.
              The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.
              configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.
              Suggested shape (not a decision)
              A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.
              Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.
              Activity
              Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
              Metadata
              Metadata
              Assignees
              Labels
              No labels
              No labels
              Type
              Task
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153
                Closed
                Task
                #245
                Closed
                [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none#153
                Task
                #245
                Assignees
                os-zhuang
                Description
                @os-zhuang
                os-zhuang
                opened on Aug 22, 2026
                Found while implementing #131 (PR #152), which adds delegated_admin to the tier list on build/automation/approvals.mdx. Out of that card's scope — #131 is one file and its job is to make the vocabulary correct, not to introduce a definition.
                What is missing
                After #152 lands, the four-value org-membership tier vocabulary (owner, admin, delegated_admin, member — ADR-0108, sys_member.role) appears in exactly two places in the English corpus, both of which only use it:
                • content/docs/configure/notifications.mdx:137 — as the values a role: principal selector accepts.
                • content/docs/build/automation/approvals.mdx:77 and :88 — as the values an org_membership_level approver accepts.
                No page says what the tiers are, what a delegated admin may do, or where the tier is set. A reader who meets delegated_admin on either page has nowhere in the corpus to go.
                Why this is more than a missing gloss
                The nearest anchor a reader (or an author adding a link) would reach for is wrong:
                • configure/permissions/permission-sets.mdx:120 — Delegated administration — documents a permission set carrying an adminScope. That is a different mechanism from the delegated_admin membership tier.
                Upstream is explicit that these must not be merged. objectstack:packages/spec/src/identity/membership-role.ts heads a section "Three facts that look like one — do not merge them", and says of the tier:
                It carries NO ObjectStack authority by construction […] Reaching the endpoint is not authority to place — placement authority comes solely from a separately-granted adminScope. Role = can reach the endpoint; adminScope = what the endpoint permits.
                The two are doubly opt-in and independent: someone must set the membership tier and grant an adminScope. So a reader who assumes the tier grants the delegated-administration powers documented at permission-sets#delegated-administration has formed exactly the belief the spec is built to prevent — and the corpus currently offers nothing that corrects it.
                configure/users.mdx does not cover this either: its "memberships" section is about sys_business_unit_member (org-tree placement), a different object from sys_member.
                Suggested shape (not a decision)
                A short tier table on an identity/permissions page — most likely configure/users.mdx alongside memberships, or configure/permissions/ — giving each of the four tiers a one-line meaning, stating that the tier is a grade that decides what you can reach rather than a bundle of permissions, and explicitly distinguishing delegated_admin from an adminScope. The two consuming pages could then link to it instead of repeating a bare list.
                Filing unassigned for triage; no page's current statement is false, so this is a coverage gap rather than a defect.
                Activity
                Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
                Metadata
                Metadata
                Assignees
                Labels
                No labels
                No labels
                Type
                Task
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions