docs(permissions): clarify View/Modify All × OWD interaction and posture-gated RLS bypass#3008
Merged
os-zhuang merged 1 commit intoJul 16, 2026
Conversation
…ure-gated RLS bypass (#3005) Answers the #3005 clarification: under public_read_write the sharing baseline is already org-wide, so viewAllRecords has nothing to widen on that layer; and the super-user RLS short-circuit is posture-gated (ADR-0066 D2 revised ①) — on ordinary tenant business objects the member_default owner-scoped write policies still narrow org_member holders even when modifyAllRecords is granted. Neither bit is an enterprise capability; only the hierarchy depth scopes are enterprise-resolved (ADR-0057). Adds the supervisor-writes-all recipe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019jw7PHSUa3rtRTnK6dwedX
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/s
documentation
os-zhuang
marked this pull request as ready for review
July 16, 2026 04:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Answers the clarification asked in #3005 by documenting the actual (intentional) semantics, verified against the 15.0.0 enforcement chain.
What the reporter observed, and why
With OWD
public_read_write:viewAllRecordsmakes no difference — expected:public_read_writeis the org-wide read+write baseline at the sharing layer (plugin-sharing/src/sharing-service.tseffectiveSharingModel→ no read filter). The super-user bits widen the sharing axis to depthorg; under this OWD there is nothing left to widen.modifyAllRecords: truedoes not grant cross-owner update/delete — the blocker is not the OWD/sharing layer (which is write-open underpublic_read_write) but the baselinemember_defaultRLS policiesowner_only_writes/owner_only_deletes(created_by == current_user.id, applicability domainorg_member), enforced by the pre-image write check. The super-user RLS short-circuit is posture-gated (ADR-0066 D2 revised ①): it applies only toaccess: { default: 'private' }, platform-global (tenancy.enabled: false), or better-auth-managed objects — never to ordinary tenant business objects (plugin-security/src/security-plugin.tscomputeLayeredRlsFilter).Neither bit is an enterprise capability: both are enforced by the open-source
plugin-security. The only enterprise-resolved axis (the #2920 "fail-closed to owner-only" note) is the hierarchy depth scopesown_and_reports/unit/unit_and_below(ADR-0057IHierarchyScopeResolver).Changes
content/docs/permissions/sharing-rules.mdx— new subsection under the OWD table: howviewAllRecords/modifyAllRecordsinteract with each OWD value, what they never override (baseline member RLS on ordinary business objects, the Layer 0 tenant wall), the open-core boundary, and the "owners edit their own, supervisors edit all" recipe (OR-widening RLS policy bound to a supervisor position, oraccess: privateposture).content/docs/permissions/permissions-matrix.mdx— the Super-user bypass callout previously said the bits "bypass ownership and sharing" unconditionally, which is exactly the expectation 澄清:viewAllRecords / modifyAllRecords 在 public_read_write 下失效,是否为开源版有意设计? #3005 formed; added the posture-gate caveat with pointers to ADR-0066 D2 ① and the sharing docs section above.Docs-only change; no runtime behavior touched.
Closes #3005 (clarification — behavior is by design).
🤖 Generated with Claude Code
https://claude.ai/code/session_019jw7PHSUa3rtRTnK6dwedX
Generated by Claude Code