权限设置应该可以配置实效性，权限在一个时间段之内生效

[os-zhuang]

[os-zhuang]

Triage: needs-user-decision (feature — expands the public authoring surface, human floor per the standing adjudication boundary), domain:identity, type Feature. Original request quoted verbatim: 「权限设置应该可以配置实效性，权限在一个时间段之内生效」.

Context the ruling should weigh — the platform already owns a time-validity vocabulary for grants, partially live:

• ADR-0091 declares grant validity windows, and resolveUserAuthzGrants applies the window to sys_member-derived accessible_org_ids today ([finding] resolveUserAuthzGrants applies the ADR-0091 window to sys_member for accessible_org_ids only — the org-admin role projection is unfiltered #8802 measures the org-admin role projection as still unfiltered).
• The ADR-0091 D5 recertification columns are declared on both grant tables with no producer or reader ([finding] The ADR-0091 D5 recertification columns (last_certified_at / certified_by) are declared on both grant tables and nothing writes or reads them #9046).
• The ADR-0056 authz matrix has no row for the windows at all ([finding] The ADR-0056 D10 authz matrix has no row for the ADR-0091 grant validity windows either — a second instance of #8711's gap #8811).

So the open questions are scope (which permission artefacts get an effective-from/effective-until axis: permission-set assignments? sharing rules? object permissions?), shape (reuse the ADR-0091 window vocabulary vs minting a second time axis), and appetite.

Decision block (four-prism):

• Platform long-term coherence — reusing the ADR-0091 window shape on more grant surfaces converges one time axis; a new per-surface validity shape would be a second one to reconcile forever.
• Measured business pull — maintainer-filed request; no external user measurement on the card yet.
• AI-agent error-resistance — a declared window must be enforced at evaluation time on every surface where it is writable; [finding] The ADR-0091 D5 recertification columns (last_certified_at / certified_by) are declared on both grant tables and nothing writes or reads them #9046/[finding] resolveUserAuthzGrants applies the ADR-0091 window to sys_member for accessible_org_ids only — the org-admin role projection is unfiltered #8802 show the declared-but-partially-enforced state this feature would widen if shipped declaration-first. Enforce-with-declare, or don't declare.
• Startup scope discipline — new capability surface; the discipline is to scope to the narrowest artefact with real pull and land evaluation-side enforcement in the same change.

Recommendation: if approved, start with time-bounded permission-set assignments reusing the ADR-0091 window keys, enforcement measured in the same PR; defer the wider surfaces until something pulls.

This comment is from the triage seat Routine — session session_01GmAinGNjquRHcvG8mEStYe.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling (2026-08-17, recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf). Verbatim: 「9272 放到 v18开发」(within the batch reply accepting the report's recommendations).

Ruled: approved in the narrowed form, scheduled for v18.

• Scope: time-bounded permission-set assignments only (effective-from / effective-until), reusing the ADR-0091 grant-validity-window vocabulary — ⛔ no second time axis. Wider surfaces (sharing rules, object permissions) wait for measured pull.
• Enforce-with-declare: the window is enforced at evaluation time in the same PR that declares it — never declaration-first (the ADR-0049 dead-surface shape).
• Precondition / same program: [finding] resolveUserAuthzGrants applies the ADR-0091 window to sys_member for accessible_org_ids only — the org-admin role projection is unfiltered #8802 (org-admin role projection still unfiltered by the existing windows) is fixed first or in the same batch, so the window axis is not widened while half-enforced.

Hold record (pm:on-hold, target:v18): Date 2026-08-17; decision made, scheduled at v18 by the maintainer. Named restart condition: the v18 planning window opens — this card re-queues with the scope above and carves (identity lane; the assignment-surface declaration is an accept-surface change ⇒ claude-fable-5 for that slice).

Labels flipped needs-user-decision → pm:on-hold + target:v18 in the same stroke.

---

Generated by Claude Code