docs(permissions): rewrite content/docs/permissions/* to the Permission Model v2 vocabulary (ADR-0090)

[os-zhuang]

Summary

Brings the hand-written permission docs in line with Permission Model v2 (ADR-0090, landed across #2697/#2708/#2711/#2716). This closes the highest-value slice of the docs-drift list those PRs flagged — the pages that actively documented the old model, including one documented fail-open default that P1 inverted.

Page-by-page

• roles.mdx → positions.mdx — flat positions (岗位), no parent tree; the hierarchy narrative moves to business units; assignment BU anchor; built-in identity positions; everyone/guest audience anchors and their binding tier.
• profiles.mdx — migration tombstone: the Profile concept was removed (D2); a table maps each former use to everyone-anchor bindings, isDefault suggestions, and position-bound sets.
• permission-sets.mdx — rewritten as the single capability container: union semantics, access depth (moved here from the old profiles page), capabilities, built-in sets with the additive member_default baseline (D5), the governed assignment tables (D12), isDefault, adminScope with a worked 华东 example, package provenance.
• sharing-rules.mdx — corrects the documented OWD default: the page said "the default is open, not private"; since D1 an unset/unknown sharingModel fails closed to private and the D7 linter makes it a build error. Also: canonical four values only, externalSharingModel dial (D11), recipient types position / unit_and_subordinates / team.
• authorization.mdx — position vocabulary in the three-way separation; D1/D11 in the enforcement chain; delegated-admin gate in the anti-escalation paragraph; new Explaining a decision section (D6 security.explain); the D7 publish linter and the access-matrix snapshot added to the governance section; ADR-0090 in the index.
• permissions-matrix.mdx — role-hierarchy section replaced with business-unit hierarchy & positions (mermaid updated); isProfile removed from all samples; position recipients; evaluation-order step 1 reworded.
• permission-metadata.mdx — isProfile → isDefault/adminScope in the schema table; "Profile vs Permission Set" replaced with union semantics; current_user.positions.
• index.mdx — five-concepts overview paragraph, v2 implementation-status callout, best-practice sections (permission sets / positions / BU depth), checklist and real-world example updated.
• access-recipes.mdx / field-level-security.mdx — link and heading fixes.
• Nav (meta.json): roles → positions; no dangling /docs/permissions/roles links remain in content/.

Authoritative reference: docs/design/permission-model.md · decision record: ADR-0090.

Verification

• pnpm turbo build --filter=docs green (full docs-site build over the rewritten pages)
• grep sweeps: no remaining isProfile (outside the migration note), role_and_subordinates, sys_role*, type: 'role', or current_user.roles in content/docs/permissions/
• Content-only change — no code, no changeset needed

🤖 Generated with Claude Code

https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 9, 2026 8:18am