docs(site): fix permissions.write — executor defaults to System.AccessToken

[github-actions]

Summary

• Users no longer see inaccurate guidance saying permissions.write is required for safe outputs or that compilation fails without it
• The permission combinations table now correctly shows all four configurations — including the (common) case where neither service connection is set but safe outputs still work via $(System.AccessToken)
• The {{ executor_ado_env }} template-marker description now accurately reflects that the env: block is always emitted

Changes

• site/src/content/docs/reference/network.mdx:
  • Removed stale claim "System.AccessToken is never used for agent or executor operations"
  • Rewrote intro paragraph and Note block to reflect Stage 3 using $(System.AccessToken) as its default write token
  • Updated Security Model: permissions.write is now documented as optional override for cross-org / named-identity writes
  • Removed the incorrect "Compile-Time Validation" section
  • Updated examples to include the default no-SC case
• site/src/content/docs/setup/service-connections.mdx:
  • Changed table row from "Write (required for safe outputs)" → "Write (optional override)"
  • Changed section description from "minimum required connection" → explains when to use an override
  • Replaced incorrect "compile-time safety check" callout with an accurate "Default executor token" note
  • Fixed permission combinations table: Only read and Neither rows now correctly show writes as ✅ (with clarifying labels)
• site/src/content/docs/reference/template-markers.mdx:
  • Rewrote {{ executor_ado_env }} description: env block is always emitted, not only when permissions.write is set

Accuracy checks

• src/compile/common.rs generate_executor_ado_env() (lines 1769–1797): always pushes SYSTEM_ACCESSTOKEN — confirmed always-emitted behavior
• Test at line 6162: "Should always emit env: block (executor needs SYSTEM_ACCESSTOKEN)" — confirmed
• Test at line 6165: "Default executor token is $(System.AccessToken)" — confirmed default path
• Test at line 6139: "Executor should use SC_WRITE_TOKEN when write SC is configured" — confirmed override path
• PR feat(compile): default executor to System.AccessToken and add always-on Azure CLI #873 description: validate_write_permissions deleted — confirmed compilation no longer fails without permissions.write

Validation

• cd site && npm ci && npm run build — 33 pages built, all internal links valid

---

Created by the docs-writer workflow.

Generated by Docs Writer · sonnet46 3M · ◷