feat(admin): explain document access in business terms

[kl3inIT]

Summary

• add tenant-scoped business labels to protected access-explanation path steps without changing authorization decisions
• redesign User Detail access checking around Current access, named assignment source, document availability, and evaluation freshness
• distinguish Allowed, Denied, Unknown, direct, inherited, relationship-only, and unavailable derivation states without exposing raw IDs or OpenFGA details
• add and update increment, domain specification, test mapping, OpenAPI contract, and regression coverage

Security and correctness

• audit-view guard remains before target-user, resource, and metadata resolution
• department and Knowledge Space labels remain organization-scoped
• organization/user labels are restricted to the current tenant and inspected user
• direct access requires an exact <type>:<id> target match
• empty or unreadable paths report Assignment path unavailable instead of inventing direct or inherited access
• final independent pre-commit review: passed with no security or correctness blockers

Verification

• focused access-inspector tests: 12/12
• full web unit suite: 142/142
• web lint and TypeScript build
• web production build after gen:api
• PermissionsAdminIntegrationTests
• OpenApiContractTests
• core:test
• desktop synthetic production-build Playwright flow
• mobile 390px Playwright flow with 0px horizontal overflow
• git diff --check

Deployment

Not deployed by this PR. Production verification and Slide 8 capture remain explicit post-merge/deployment steps in the increment plan.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5491808a-07c0-45a6-8e8f-d3b6f9297a37

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Tegami

This repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under .tegami/ before merging.

Create a changelog → · Changelog format

Release preview

Package	Bump	Version
orgmemory	minor	0.5.0 → 0.6.0

Changelogs in this PR

Changelog	Title
2026-08-15-business-access-explanation.md	Features

Run pnpm run tegami locally to create a changelog interactively.

_{Managed by Tegami.}