docs(adr): ADR-0091 (Proposed) — grant lifecycle: effective-dated assignments, delegation, break-glass, recertification substrate - #2751
Merged
Conversation
…ignments, delegation, break-glass, recertification substrate First named follow-up of ADR-0090. Seven decisions, all additive to the v2 model: valid_from/valid_until on the two user-grant tables (null = unbounded, zero migration); correctness = resolution-time filtering in every resolver (fail-closed, no cleanup job required); self-service delegation of delegatable positions (time-boxed, dual-audited, no re-delegation); break-glass as pre-authorized dormant sets activated into short time-boxed grants; recertification substrate in framework with campaigns as enterprise product; agent grants must be time-boxed and task-attributed (D10 hookup); open-core line keeps correctness community and workflow enterprise. Status: Proposed — decisions await review. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
os-zhuang
marked this pull request as ready for review
July 10, 2026 09:22
This was referenced Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Drafts ADR-0091, the first named follow-up from ADR-0090 (§Non-goals #1): making time a first-class axis of authorization. Status is Proposed — the decisions below are open for review; nothing is implemented by this PR.
The seven proposed decisions
valid_from/valid_until(half-open, UTC) + lifecycle-audit columns (reason,delegated_from,last_certified_at/certified_by) onsys_user_positionandsys_user_permission_setonly. Bindings and record shares deliberately excluded (scheduled binding changes are a publish-track feature; share links already do time-boxed record access). Null = unbounded → zero migration.delegatable: trueposition; mandatoryvalid_until+reason; dual audit (granted_by+delegated_from); no re-delegation. Substitution semantics (union) — the intersection rule stays agent-only.Placement rationale (per the docs-split decision)
Contract + semantics live here (framework, CI-governed, publicly auditable); implementation/product design for the enterprise half (campaign mechanics, activation workflow, notifications) will be a cloud-repo design doc referencing this ADR — no duplication.
Phasing
L1 spec+filtering (community-complete) → L2 delegation+break-glass shape with dogfood proof → L3 enterprise product docs/impl in cloud.
Verification
Docs-only (one new ADR file). No code, no changeset.
🤖 Generated with Claude Code
https://claude.ai/code/session_012oLzaP8n7A3YKFmgaHWC8H
Generated by Claude Code