Skip to content

docs(adr-0056): reconcile Consequences with the P2/P4 pure model#5970

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-trump merged 1 commit into from
Aug 25, 2026
Merged

docs(adr-0056): reconcile Consequences with the P2/P4 pure model #5970

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions docs/adr/0056-permission-editing-studio.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -222,8 +222,9 @@ change framework source).

- **One authoring path per concern.** Objects/fields/RLS/tabs/admin-scope are
authored once, in Studio, through validated editors the explain engine (D6)
and publish linter (D7) can see. Capabilities are authored once, in Setup,
through the `sys_capability` picker.
and publish linter (D7) can see. Capabilities are designed once, in Studio,
through the `sys_capability` picker (P2); Setup only assigns permission sets
to users (P1b) and shows every facet read-only (P1).
- **The Setup/Studio audience split (ADR-0084 / studio.app) is honored:**
operators assign and grant-entry; makers design permissions.
- **AI-authoring safety improves** exactly where ADR-0090 wants it: no security
Expand All@@ -240,10 +241,15 @@ change framework source).
summary reads — so Studio edits aren't reflected in Setup until the projection
refreshes. Display-freshness only (enforcement reads the authoritative
metadata), but it needs a framework-side fix to close the loop.
- **Studio becomes load-bearing for permission ops.** An admin who can assign
sets but lacks `studio.access` can no longer *design* them. That is the
intended boundary, but it makes "who holds `studio.access`" operationally
important — hence P2 keeps that grant in Setup and first-class.
- **The structured editor becomes load-bearing for permission ops.** Designing a
set now means opening the permission matrix editor; no facet can be authored
from the record's own fields any more. The same editor has two entry points
(Decision 1) — the package-scoped Studio Access pillar (`studio.access`) and
Setup's own env-scope metadata route (`setup.access`) — so an operator who
lacks `studio.access` can still design a set at environment scope, including
granting `studio.access` itself. That is what dissolves the bootstrap knot A2
worried about, and why P2 puts the capability picker in the structured editor
instead of keeping a Setup exception (Decision 3).

## Open design questions

Expand Down