docs(adr): ADR-0095 — authz kernel chain: tenant isolation as Layer 0, posture ladder, capability-derived posture (B0 of #2920)

[os-zhuang]

Summary

B0 of tracking issue #2920 — the kernel-chain ADR that must land before B1/B2/B4 start. The number moves to 0095 because 0094 is taken by the permission-set pure-projection ADR (the v1 tracking issue referenced "ADR-0094" for this chain; that reference was stale).

Decisions recorded:

• D1 — Tenant isolation becomes Layer 0: extracted from the business-RLS compile pass into an independent, always-first, AND-composed layer with its own code path, driven by the ADR-0093 tenancy service. The seeded wildcard tenant_isolation policy retires once Layer 0 enforces.
• D2 — Monotonic posture ladder: PLATFORM_ADMIN > TENANT_ADMIN > MEMBER > EXTERNAL, resolved once in resolveAuthzContext, exactly one row-visibility injection rule per rung, strict nesting as the tested invariant. EXTERNAL semantics (explicit shares only, never OWD) are defined and test-locked now; enforcement ships when an external principal type exists.
• D3 — Posture derives from capabilities: better-auth role='admin' demoted to a grant source; no enforcement-time path consults the role directly (ends the ADR-0092 D4/D5: sys_user 编辑对"同时持有 organization_admin 的平台管理员"被权限合成挡住（explicit deny 胜 wildcard allow） #2836 dual-track adjudication class).
• Rejected: Postgres-native RLS backstop (maintainer decision, 2026-07-14) — recorded in Alternatives with rationale.

Findings surfaced while drafting (worth reviewer attention)

• W1, spec-vs-impl divergence: ADR-0066's precedence documents tenant-isolation as "AND on top", but RLSCompiler.compileFilter OR-combines all applicable policies — the wildcard tenant_isolation policy is just one disjunct, so a permissive business row rule is (at the RLS layer) sufficient to admit foreign-org rows. The ADR makes resolving this a deliberate, called-out behavior change within otherwise behavior-preserving work.
• Topology scoping: ADR-0073's "cross-tenant RLS does not exist here" claim is kept true for the physical env-per-DB topology and explicitly scoped; the load-bearing case for Layer 0 is the ADR-0093 multi shared-DB mode.

Reviewer checklist

• Confirm the W1 OR-merge reading of rls-compiler.ts / computeRlsFilter
• Confirm retiring the seeded tenant_isolation policy is acceptable release-notes-wise
• Confirm EXTERNAL rung semantics (explicit shares only, never OWD)
• Confirm the PG-RLS rejection wording matches the maintainer decision

Docs-only change; no runtime surface. Verification = review of the decision text against the cited code (rls-compiler.ts, security-plugin.ts computeRlsFilter, default-permission-sets.ts, resolve-authz-context.ts, permission-evaluator.ts).

Relates: #2920 (B0) · #2836 · ADR-0002/0066/0073/0093/0094

🤖 Generated with Claude Code

https://claude.ai/code/session_019QRUvVfpvSycAHMMF2xTxs

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 14, 2026 3:15pm