`[Security] Access denied` copy — the remaining 38 templates, classified: admin-surface should be RETAINED as developer copy, four end-user sites need their own decision

[os-zhuang]

Successor to #7451, which is closed by PR #7471. Filed unassigned, no domain:* label — routing and grading are the triage seat's call.

#7451 was a ~40-template sweep card. PR #7471 implemented the end-user-facing half under a scope limit set at claim time, and produced an audience classification of every producer template with evidence. This card carries the remainder, so the classification does not die inside a merged PR.

The remainder is not one backlog. It splits into a decision and a short list of open questions, and conflating them is what made #7451 hard to price.

Part 1 — the admin-surface family: recommend RETAIN, do not translate (~30 templates)

delegated-admin-gate.ts (13), suggested-audience-bindings.ts (3), permission-set-projection.ts (1), system-write-guard.ts (1), plugin-auth/invitation-role-cap.ts (3), and security-plugin.ts's admin-door family (:2457, :3314, :3339, :3376, :3389, :3456, :3482, :3500).

These are reached from an admin console by someone administering the system, and most cite ADR clauses (ADR-0090 D5/D9 and D6/D12, ADR-0091 D3, ADR-0103). Localizing copy that cites an ADR clause destroys the citation without helping anyone: the reader is an operator who benefits from the clause number.

This is a decision to record, not work to schedule. The useful outcome is a written verdict — "this family is correctly developer-facing" — so the next census does not re-file it as a translation backlog. If triage agrees, closing this part as not planned with that sentence in the thread is a better artifact than a card that stays open forever.

Part 2 — four end-user-reachable sites that are NOT cleanly one situation

Each was measured as end-user reachable but declined conversion for a stated reason. None is a copy fix; each needs a decision first.

site	why it was not converted
security-plugin.ts:3981 assertControlledByParentWrite	Already filed as #7474. One deny() multiplexes six conditions, three of which are not access verdicts (a metadata defect, a not-found, a null master FK). User copy would tell a user they lack access when their app is misconfigured.
security-plugin.ts:1657 owner_id transfer grant	Plausible end-user situation (record reassignment) but zero measured pull — allowTransfer appears in neither example app. Converting on speculation is the capability-expansion this repo defers.
security-plugin.ts:1069 / :1140 fail-closed	End-user visible during degradation, but the situation is "the check could not run", not "you lack permission". Copy saying the latter would be false. Needs its own message key and arguably its own status.
:953 public-form grant · :1891 tenant wall · :1094 / :1265 on-behalf-of · predicate-guard.ts:122	Reached via a misbuilt or forged client, a configured agent integration, or a team-administration action — not an ordinary business operation.

What PR #7471 leaves for whoever takes any of this

• The mechanism is settled and has three consumers: @objectstack/spec/system's renderOperationMessage / BUILTIN_OPERATION_MESSAGES, errors.<key> override address, four-rung ladder.
• Key granularity is settled: one key per situation, not per gate and not per wire code (DELETE_RESTRICTED (409) message is shown verbatim to end users: English-only, leaks API names, and contains developer-facing advice #7307 gave one code two keys; fix(plugin-security,spec): the end-user-facing [Security] Access denied gates stop showing developer copy (#7451) #7471 gave three gates two new keys and reused a third).
• ⚠️ The developer half is LOGGED, not shipped — fix(plugin-security,spec): PERMISSION_DENIED stops showing developer copy to end users (#7414) #7449 measured that fix(objectql,rest,spec): DELETE_RESTRICTED stops showing developer copy to end users (#7307) #7423's "discloses nothing new" premise fails for 403s. developerMessage is a sibling of details, never a member, because details is what the runtime dispatcher serialises.
• The dispatcher-side details.positions disclosure is The runtime dispatcher serialises a PermissionDeniedError's details to the client, so positions / permissionSets reach the browser on the /data transport #7450 (needs-user-decision, cli lane), not part of this.
• A consumption-radius warning worth inheriting: fix(plugin-security,spec): the end-user-facing [Security] Access denied gates stop showing developer copy (#7451) #7471's repo-wide grep found three pins, and two more were found only by running the suites — one pinned a fragment, one pinned a regex (toThrow(/denied|permission/i)) that matched only because the English sentence happened to start with "Access denied". Grep is necessary and not sufficient here.

Refs: #7451 (predecessor), PR #7471, #7414 / PR #7449, #7307 / PR #7423, #7450, #7474.

[claude]

Triage: needs-user-decision + domain:identity.

• Classification: both halves of the card are rulings, not scheduled work. Part 1 asks for a written retain-as-developer-copy verdict on the ~30 admin-surface templates (localization policy for ADR-citing operator copy = product-surface semantics — outside the triage seat's close authority, since this is a fresh decision card, not a graded finding). Part 2's four sites each hinge on their own decision (one is already split out as assertControlledByParentWrite answers a metadata defect and a missing row with the same 403 PERMISSION_DENIED "requires edit access to its master record" #7474). Routed so the identity seat picks it up once the maintainer rules; the seat can then close Part 1 with the verdict sentence and file/queue whatever Part 2 yields.
• Landing anchor (read, not inferred): the named template families all exist on origin/main @ c6a4eeb — delegated-admin-gate, suggested-audience-bindings, permission-set-projection, system-write-guard under packages/plugins/plugin-security/src/, and packages/plugins/plugin-auth/src/invitation-role-cap.ts — all inside identity-lane packages ⇒ domain:identity.
• Dup check: keyword sweep over open issues/PRs in all three repos — no duplicate. Predecessor The other ~40 [Security] Access denied sentences are still English-only developer copy shown verbatim to end users (same class as #7414, one template fixed) #7451 is closed by PR fix(plugin-security,spec): the end-user-facing [Security] Access denied gates stop showing developer copy (#7451) #7471; The runtime dispatcher serialises a PermissionDeniedError's details to the client, so positions / permissionSets reach the browser on the /data transport #7450 (dispatcher details disclosure) is explicitly out of scope per the body; assertControlledByParentWrite answers a metadata defect and a missing row with the same 403 PERMISSION_DENIED "requires edit access to its master record" #7474 carries the assertControlledByParentWrite site separately.
• Stale-premise check: premise is the state PR fix(plugin-security,spec): the end-user-facing [Security] Access denied gates stop showing developer copy (#7451) #7471 left behind (merged to main today); template files verified present as above. Premise stands.
• target:v17: not applied — a classification/policy decision card; nothing here is a shipped-surface defect in the four blocking classes.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code