Uh oh!
There was an error while loading. Please reload this page.
docs(adr): ADR-0056 — permission model landing verification (whole-model enforce/prove/reconcile) - #2058
Merged
Conversation
…l enforce/prove/reconcile audit) A capstone governance ADR that applies the ADR-0049 (enforce-or-remove) and ADR-0054 (prove-it-runs) gates to the ENTIRE authorization model for the first time. Based on a four-pass read-only audit (spec inventory, runtime-enforcement trace, proof-coverage matrix, prior-ADR reconciliation), it presents a per-primitive declared↔enforced↔proven verification table and makes 10 reconciling decisions: - D1 collapse the 3-way-mismatched OWD enum to one canonical set + reject unknown - D2 close the anonymous default-allow fail-open (default-deny) - D3 OWD baseline must not depend on plugin-sharing being loaded - D4 RLS compiler must error at authoring time / fail-closed at runtime, never silently drop - D5 reconcile Sharing Rules spec↔runtime divergence per ADR-0049 - D6 role-hierarchy widening: implement or mark experimental (it is a silent no-op today) - D7 first-class app-declared default Profile (replaces hardcoded fallback) - D8 triage compliance/encryption/masking surface per ADR-0049 - D9 bind enforced-but-unproven invariants into the liveness ledger - D10 (durable) an Authorization Conformance Matrix as a CI-checked artifact Phased P1 honesty-pass → P2 close fail-open holes → P3 provisioning+proofs → P4 evidence-gated. Status: Proposed. No code change; design only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…table #15) The verification table cited permission-evaluator.ts for the role-hierarchy no-op; the accurate evidence is sharing-rule-service.ts expandRecipient (no role_and_subordinates branch) + flat team-graph + no Role.parent consumer. Substance (widening unimplemented) unchanged; citation corrected after re-verification. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx
os-zhuang
marked this pull request as ready for review
June 20, 2026 06:43
Uh oh!
There was an error while loading. Please reload this page.
os-zhuang added a commit
that referenced
this pull request
Jun 28, 2026
feat(core): curated PUBLIC block contract (ADR-0080 M5) (#2058) objectui@1311749ff9bc216eb2e902862e2b9cb76527815c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
ADR-0056 — a capstone governance ADR that, for the first time, applies the ADR-0049 (enforce-or-remove) and ADR-0054 (prove-it-runs) gates to the entire authorization model, rather than one primitive at a time.
It is design only (one new
docs/adr/file, no code change), produced from a four-pass read-only audit:The core finding
The Salesforce-shaped model is sound, but its landing is uneven: ~12/21 primitives enforced cleanly, ~5 partial, ~3 silent fail-open holes, 1 not-implemented; only ~7 invariants carry an end-to-end proof. The three security-relevant holes:
public_read/public_read_write/read_write/fullsilently collapse to default-allow.requireAuthdefaults false ⇒ unauthenticated reads see unscoped rows.Role.parentis declared but never rolls subordinate access up.(It also surfaced why the showcase owner predicate was inert for two PRs: the RLS compiler silently drops uncompilable
usingclauses — D4.)The decisions
A per-primitive verification table + 10 decisions (D1–D10), each resolving a gap to enforce now / mark
experimental/ remove (per 0049) and adding a proof where enforced-but-unproven (per 0054). D10 is the durable one: an Authorization Conformance Matrix — extend the liveness ledger to the whole authz surface so "the model is fully landed" becomes a CI-checked artifact, not a one-time scan.Phased: P1 honesty-pass (no behavior change) → P2 close fail-open holes → P3 provisioning + proofs → P4 evidence-gated (role hierarchy, SSO/JIT).
Status
Proposed— opening as a draft for architectural review. No implementation in this PR.🤖 Generated with Claude Code
Generated by Claude Code