Parked follow-up to EPIC R (#108). Scheduled SOON after R lands (p2-high, not p2 — see EPIC R §6 correction 1 sign-off).
Context
EPIC R §5 correction 3 accepted a defensive v1 workflow dropdown filter for scoped policy authors: "show only enabled + non-system workflows." Without a proper opt-in flag on `workflow_definitions`, scoped authors may eventually see workflows that are enabled but not INTENDED for self-service policy authoring (e.g. a workflow that platform reserves for emergency-bypass).
This issue tracks adding the explicit flag so platform admins can curate the list scoped authors see.
Proposed change
Migration 0035 (post-EPIC R) adds:
```sql
ALTER TABLE workflow_definitions
ADD COLUMN scoped_policy_authorable BOOLEAN NOT NULL DEFAULT false;
```
Default false — every existing workflow stays invisible to scoped authors until platform explicitly opts each one in via the admin SPA. Same default-deny posture as EPIC Q's `self_service_bindable` and EPIC R's `project_id` column.
Scoped author rule create / update gate (new clause in R1's chain):
```
workflow.scoped_policy_authorable = true → ErrWorkflowNotAuthorable
```
New stable error code: `workflow_not_authorable_for_scope` (403).
SPA changes:
- Admin `/admin/workflows` page's create/edit drawer gets a new "Available for scoped policy authoring" toggle. Default off.
- Scoped policy authoring drawer's workflow dropdown filters to `scoped_policy_authorable = true` rows (replacing the defensive v1 filter).
Why p2-high (not p2)
Per §6 correction 1: this is the safe long-term model. The defensive v1 filter is a stopgap. Without this flag, an operator could enable a workflow that's intended for security review only, and a scoped author could route their non-prod rule through it. Worth landing soon after EPIC R closes.
When to revisit
Land this immediately after EPIC R skills round-trip (R5) merges. Should NOT block EPIC R from being closed, but should be the first follow-up taken up.
Acceptance criteria
Parked follow-up to EPIC R (#108). Scheduled SOON after R lands (p2-high, not p2 — see EPIC R §6 correction 1 sign-off).
Context
EPIC R §5 correction 3 accepted a defensive v1 workflow dropdown filter for scoped policy authors: "show only enabled + non-system workflows." Without a proper opt-in flag on `workflow_definitions`, scoped authors may eventually see workflows that are enabled but not INTENDED for self-service policy authoring (e.g. a workflow that platform reserves for emergency-bypass).
This issue tracks adding the explicit flag so platform admins can curate the list scoped authors see.
Proposed change
Migration 0035 (post-EPIC R) adds:
```sql
ALTER TABLE workflow_definitions
ADD COLUMN scoped_policy_authorable BOOLEAN NOT NULL DEFAULT false;
```
Default false — every existing workflow stays invisible to scoped authors until platform explicitly opts each one in via the admin SPA. Same default-deny posture as EPIC Q's `self_service_bindable` and EPIC R's `project_id` column.
Scoped author rule create / update gate (new clause in R1's chain):
```
workflow.scoped_policy_authorable = true → ErrWorkflowNotAuthorable
```
New stable error code: `workflow_not_authorable_for_scope` (403).
SPA changes:
Why p2-high (not p2)
Per §6 correction 1: this is the safe long-term model. The defensive v1 filter is a stopgap. Without this flag, an operator could enable a workflow that's intended for security review only, and a scoped author could route their non-prod rule through it. Worth landing soon after EPIC R closes.
When to revisit
Land this immediately after EPIC R skills round-trip (R5) merges. Should NOT block EPIC R from being closed, but should be the first follow-up taken up.
Acceptance criteria