Skip to content

docs(concepts): Authorization Architecture overview (#2561 P1) - #2569

Merged
os-zhuang merged 1 commit into
mainfrom
claude/authorization-architecture-overview
Jul 4, 2026
Merged

docs(concepts): Authorization Architecture overview (#2561 P1)#2569
os-zhuang merged 1 commit into
mainfrom
claude/authorization-architecture-overview

Conversation

@os-zhuang

Copy link
Copy Markdown
Contributor

概述

落地 #2561 P1 的「授权架构综述文档」项:把九份授权 ADR(0049/0054/0056/0057/0066/0068/0069/0078/0086)缝成单篇 content/docs/concepts/authorization.mdx。缺口是「综述缺失」而非「设计缺失」——本文不做任何新决策,每条论断都链回拥有它的 ADR。

内容

  • 六道强制门链(匿名拒绝 → 公开表单 grant → 对象 CRUD → OWD/共享 → RLS → FLS),每道门标注运行时强制点文件
  • 固定组合语义:AND-门 → 并集 → RLS(对象内 OR / 租户 AND)→ 预留的 deny 层
  • 包来源与组合(ADR-0086):managedBy/packageIdbootstrapDeclaredPermissions、Shape B
  • 生命周期五阶段覆盖表
  • 治理机制:CI 一致性矩阵 + liveness 账本如何保证「声明 = 强制」
  • 已知缺口与路线指回 [umbrella][security] 授权全生命周期缺口地图 — 包开发 → 生产上线(P0–P3) #2561,含 FLS 姿态(⑧)、能力注册表(⑨)等
  • ADR 索引表

配套:meta.json 在 Architecture 之后插入导航项。

关联

🤖 Generated with Claude Code

https://claude.ai/code/session_014y5kiH3aPLWtRRRGcVrXcT


Generated by Claude Code

@vercel

vercelBot commented Jul 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
specReadyReadyPreview, CommentJul 4, 2026 8:34am

Request Review

Consolidates the nine authorization ADRs (0049/0054/0056/0057/0066/0068/
0069/0078/0086) into one page: the six-gate enforcement chain with each
gate's runtime enforcement site, the fixed combination semantics
(AND-gates → union → RLS OR/AND → reserved deny), package provenance &
composition, five-stage lifecycle coverage, and the CI conformance-matrix
+ liveness governance that keeps "declared" equal to "enforced". Adds no
new decisions — every claim links to its owning ADR. Wired into the
Concepts nav after Architecture.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y5kiH3aPLWtRRRGcVrXcT
@os-zhuang
os-zhuangforce-pushed the claude/authorization-architecture-overview branch from a460370 to 8b6a65aCompareJuly 4, 2026 08:25
@os-zhuang
os-zhuang marked this pull request as ready for review July 4, 2026 08:36
@os-zhuang
os-zhuang merged commit a72a3a9 into mainJul 4, 2026
15 checks passed
@os-zhuang
os-zhuang deleted the claude/authorization-architecture-overview branch July 4, 2026 08:36
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentationImprovements or additions to documentationsize/m

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@os-zhuang@claude