docs(adr): ADR-0105 — group tenancy posture and first-class org scope

[os-zhuang]

Summary

Proposes ADR-0105: Group Tenancy Posture — Organization Scope as a First-Class Authorization Dimension, synthesizing the group/multi-plant (MES-shaped) architecture review into a formal decision record.

Core proposal: extend the tenancy spectrum to single | group | isolated, where the new group posture makes organizations membership boundaries over one shared dataset, with an engine-enforced union wall (organization_id IN accessible_org_ids, Oracle-MOAC semantics) that preserves ADR-0095's W1/W2 invariants.

Key contents

• Two P0 findings that ship regardless of the posture work (both verified with file:line in the ADR):
  • F1/D3 — collectRLSPolicies (plugin-security/src/security-plugin.ts:2785-2791) substring-strips app-authored RLS policies referencing current_user.organization_id when org-scoping is absent — an ADR-0049 "declared but unenforced" class defect.
  • F2/D4 — organization_admin's wildcard viewAllRecords/modifyAllRecords (auto-granted to every owner/admin) is contained only by the isolated-posture Layer 0 wall; wall-less deployments make org admins environment-wide superusers.
• D6 cut-line doctrine: org grouping metadata is reporting-only (no permission inheritance on the org axis); BU trees stay org-internal.
• D7 rides the ADR-0092 identity-write-guard whitelist for managed-table extension fields (plus a better-auth collision lint).
• D8–D10: scoped invitations (adminScope-governed), cross-org approval targeting, layered master data (group template + org override).
• D11 enforce-or-remove cleanup: remove PermissionSet.contextVariables and the territory spec; productize the rlsMembership resolver seam.
• D12 edition split per cloud ADR-0016's iron rule (enforcement open, governance commercial) — deliberately moves wall correctness into the open edition.
• D13 migration along the spectrum, incl. a BU-subtree → organization promotion tool.
• Industry benchmark table (SAP org-field auth objects / derived roles, Oracle MOAC, NetSuite OneWorld, Dataverse BU depth, Workday, Odoo cautionary tale) and an Appendix with pre-Phase-1 deployment guidance for group MES engagements on today's platform.

Status

Proposed / draft — opened for architect review. No runtime code changes in this PR; the two P0 findings (F1/F2) deserve issues filed independently of the ADR's acceptance.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CbjR5BaHy9tGwUR8DoJA36

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 25, 2026 8:10am